diff --git a/asoc/msm-lsm-client.c b/asoc/msm-lsm-client.c index aa38e8c71490..622880b0e9de 100644 --- a/asoc/msm-lsm-client.c +++ b/asoc/msm-lsm-client.c @@ -2653,6 +2653,15 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, err = -EFAULT; goto done; } + + if (temp_p_info.param_size > 0 && + ((INT_MAX - sizeof(temp_p_info)) < + temp_p_info.param_size)) { + pr_err("%s: Integer overflow\n", __func__); + err = -EINVAL; + goto done; + } + size = sizeof(temp_p_info) + temp_p_info.param_size; p_info = kzalloc(size, GFP_KERNEL);