From: Alan gnomes@lxorguk.ukuu.org.uk
skl_tplg_tlv_control_set does pointer maths on data but forgets that data is not uint8_t so the maths is already scaled in the pointer type.
Signed-off-by: Alan Cox alan@linux.intel.com Signed-off-by: Vinod Koul vinod.koul@intel.com --- sound/soc/intel/skylake/skl-topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c index ba0d02d1613e..22a9e6fe1c05 100644 --- a/sound/soc/intel/skylake/skl-topology.c +++ b/sound/soc/intel/skylake/skl-topology.c @@ -1111,7 +1111,7 @@ static int skl_tplg_tlv_control_set(struct snd_kcontrol *kcontrol, return -EFAULT; } else { if (copy_from_user(ac->params, - data + 2 * sizeof(u32), size)) + data + 2, size)) return -EFAULT; }