ipc : audio-pkt: Add check to avoid invalid count size

Count should not be equal to or greater than this packet_size.
Add check to avoid invalid count size.

Change-Id: I1934f9bc37f0809693276fafa4259880959ba8a2
Signed-off-by: Nimit Jain <quic_nimijain@quicinc.com>

ipc/audio-pkt.c

 /* Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -37,6 +38,7 @@ static void *audio_pkt_ilctxt;
 static int audio_pkt_debug_mask;
 module_param_named(debug_mask, audio_pkt_debug_mask, int, 0664);
 
+#define MAX_PACKET_SIZE 4096
 #define APM_CMD_SHARED_MEM_MAP_REGIONS		0x0100100C
 #define APM_MEMORY_MAP_BIT_MASK_IS_OFFSET_MODE	0x00000004UL
 enum {
@@ -364,6 +366,14 @@ ssize_t audio_pkt_write(struct file *file, const char __user *buf,
 		return PTR_ERR(kbuf);
 
 	audpkt_hdr = (struct gpr_hdr *) kbuf;
+
+	/* validate packet size */
+	if ((count > MAX_PACKET_SIZE) || (count < GPR_PKT_GET_PACKET_BYTE_SIZE(audpkt_hdr->header)))
+	{
+		ret = -EINVAL;
+		goto free_kbuf;
+	}
+
 	if (audpkt_hdr->opcode == APM_CMD_SHARED_MEM_MAP_REGIONS) {
 		ret = audpkt_chk_and_update_physical_addr((struct audio_gpr_pkt *) audpkt_hdr);
 		if (ret < 0) {