ipc : audio-pkt: Add check to avoid invalid count size

Count should not be equal to or greater than this packet_size.
Add check to avoid invalid count size.

Change-Id: I1235425c0807f50784da9d7181c8e29d297b9013
Signed-off-by: Nimit Jain <[email protected]>

ipc/audio-pkt.c

@@ -1,4 +1,5 @@
 /* Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -62,6 +63,7 @@ do {									      \
 #define MINOR_NUMBER_COUNT 1
 #define AUDPKT_DRIVER_NAME "aud_pasthru_adsp"
 #define CHANNEL_NAME "adsp_apps"
+#define MAX_PACKET_SIZE 4096
 
 
 enum audio_pkt_state {
@@ -359,6 +361,14 @@ ssize_t audio_pkt_write(struct file *file, const char __user *buf,
 		return PTR_ERR(kbuf);
 
 	audpkt_hdr = (struct gpr_hdr *) kbuf;
+
+	/* validate packet size */
+	if ((count > MAX_PACKET_SIZE) || (count < GPR_PKT_GET_PACKET_BYTE_SIZE(audpkt_hdr->header)))
+	{
+		ret = -EINVAL;
+		goto free_kbuf;
+	}
+
 	if (audpkt_hdr->opcode == APM_CMD_SHARED_MEM_MAP_REGIONS) {
 		ret = audpkt_chk_and_update_physical_addr((struct audio_gpr_pkt *) audpkt_hdr);
 		if (ret < 0) {