evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "drivers: soc: qcom: Add overflow check in ADM driver"

Browse source
This commit is contained in:
Linux Build Service Account 2017-01-19 09:52:38 -08:00 • committed by Gerrit - the friendly Code Review server
commit 59656208b7
1 changed files with 13 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
sound/soc/msm/qdsp6v2/q6adm.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. /* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and * it under the terms of the GNU General Public License version 2 and
@ -978,9 +978,10 @@ int adm_get_params_v2(int port_id, int copp_idx, uint32_t module_id,
char *params, uint32_t client_id) char *params, uint32_t client_id)
{ {
struct adm_cmd_get_pp_params_v5 *adm_params = NULL; struct adm_cmd_get_pp_params_v5 *adm_params = NULL;
int sz, rc = 0, i = 0; int rc = 0, i = 0;
int port_idx, idx; int port_idx, idx;
int *params_data = (int *)params; int *params_data = (int *)params;
uint64_t sz = 0;
port_id = afe_convert_virtual_to_portid(port_id); port_id = afe_convert_virtual_to_portid(port_id);
port_idx = adm_validate_and_get_port_index(port_id); port_idx = adm_validate_and_get_port_index(port_id);
@ -989,7 +990,16 @@ int adm_get_params_v2(int port_id, int copp_idx, uint32_t module_id,
return -EINVAL; return -EINVAL;
} }
sz = sizeof(struct adm_cmd_get_pp_params_v5) + params_length; sz = (uint64_t)sizeof(struct adm_cmd_get_pp_params_v5) +
(uint64_t)params_length;
/*
* Check if the value of "sz" (which is ultimately assigned to
* "hdr.pkt_size") crosses U16_MAX.
*/
if (sz > U16_MAX) {
pr_err("%s: Invalid params_length\n", __func__);
return -EINVAL;
}
adm_params = kzalloc(sz, GFP_KERNEL); adm_params = kzalloc(sz, GFP_KERNEL);
if (!adm_params) { if (!adm_params) {
pr_err("%s: adm params memory alloc failed", __func__); pr_err("%s: adm params memory alloc failed", __func__);