Skip to content

Commit 27ae44b

Browse files
committed
ams: copy the payload struct size into the message slot
The slot copy length came from a macro that adds the message length, which over-read past the payload struct since the message data is referenced by pointer, not stored inline. Copy exactly the struct size, which is what the slot stores and the consumer reads back. Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
1 parent 3f7738d commit 27ae44b

1 file changed

Lines changed: 6 additions & 1 deletion

File tree

src/lib/ams.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -285,9 +285,14 @@ static uint32_t ams_push_slot(struct ams_shared_context __sparse_cache *ctx_shar
285285

286286
for (uint32_t i = 0; i < ARRAY_SIZE(ctx_shared->slots); ++i) {
287287
if (ctx_shared->slot_uses[i] == 0) {
288+
/* the slot stores the payload struct (read back via
289+
* u.msg); AMS_MESSAGE_SIZE() adds message_length, which
290+
* over-reads past the struct since message is a pointer,
291+
* not inline data
292+
*/
288293
err = memcpy_s((__sparse_force void *)ctx_shared->slots[i].u.msg_raw,
289294
sizeof(ctx_shared->slots[i].u.msg_raw),
290-
msg, AMS_MESSAGE_SIZE(msg));
295+
msg, sizeof(*msg));
291296

292297
if (err != 0)
293298
return AMS_INVALID_SLOT;

0 commit comments

Comments
 (0)