"data" is a u32 pointer so this copies the information to wrong place entirely.
Fixes: 140adfba5280 ('ASoC: Intel: Skylake: Add tlv byte kcontrols') Signed-off-by: Dan Carpenter dan.carpenter@oracle.com
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c index dde8d3c..2c4405e 100644 --- a/sound/soc/intel/skylake/skl-topology.c +++ b/sound/soc/intel/skylake/skl-topology.c @@ -885,9 +885,9 @@ static int skl_tplg_tlv_control_get(struct snd_kcontrol *kcontrol, if (bc->params) { if (copy_to_user(data, &bc->param_id, sizeof(u32))) return -EFAULT; - if (copy_to_user(data + sizeof(u32), &size, sizeof(u32))) + if (copy_to_user(data + 1, &size, sizeof(u32))) return -EFAULT; - if (copy_to_user(data + 2 * sizeof(u32), bc->params, size)) + if (copy_to_user(data + 2, bc->params, size)) return -EFAULT; }