Merge "asoc: Fix invalid size pointer access in routing driver"
diff --git a/asoc/msm-pcm-routing-v2.c b/asoc/msm-pcm-routing-v2.c
index f820f21..300cf30 100644
--- a/asoc/msm-pcm-routing-v2.c
+++ b/asoc/msm-pcm-routing-v2.c
@@ -23938,6 +23938,11 @@
uint32_t size = 0;
/* Retrieve cal_info size from cal data*/
+ if (data_size < sizeof(struct audio_cal_type_basic) +
+ sizeof(struct audio_cal_info_adm_top)) {
+ pr_err("%s: Invalid data size: %zd\n", __func__, data_size);
+ goto done;
+ }
size = data_size - sizeof(struct audio_cal_type_basic);
cal_info = kzalloc(size, GFP_KERNEL);