evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

dsp: validate token before usage as array index

Browse source 
Token from DSP might be invalid for array index. Validate the
token before being used as array index.

Change-Id: I9f47e1328d75d9f9acf7e85ddb452019b6eced0a
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
This commit is contained in:
Xiaojun Sang 2019-02-12 17:01:22 +08:00 • committed by Gerrit - the friendly Code Review server
parent 8bc8a30bdb
commit 7289a6a51e
1 changed files with 26 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
sound/soc/msm/qdsp6v2/q6afe.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -482,6 +482,15 @@ static int32_t afe_lpass_resources_callback(struct apr_client_data *data)
return 0;
}
static bool afe_token_is_valid(uint32_t token)
{
if (token >= AFE_MAX_PORTS) {
pr_err("%s: token %d is invalid.\n", __func__, token);
return false;
}
return true;
}
static int32_t afe_callback(struct apr_client_data *data, void *priv)
{
if (!data) {
@ -574,7 +583,10 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv)
ret = afe_lpass_resources_callback(data);
atomic_set(&this_afe.state, 0);
wake_up(&this_afe.wait[data->token]);
if (afe_token_is_valid(data->token))
wake_up(&this_afe.wait[data->token]);
else
return -EINVAL;
if (!ret) {
return ret;
}
@ -610,7 +622,10 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv)
case AFE_SVC_CMD_SET_PARAM_V2:
case AFE_CMD_REQUEST_LPASS_RESOURCES:
atomic_set(&this_afe.state, 0);
wake_up(&this_afe.wait[data->token]);
if (afe_token_is_valid(data->token))
wake_up(&this_afe.wait[data->token]);
else
return -EINVAL;
break;
case AFE_SERVICE_CMD_REGISTER_RT_PORT_DRIVER:
break;
@ -622,7 +637,10 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv)
break;
case AFE_CMD_ADD_TOPOLOGIES:
atomic_set(&this_afe.state, 0);
wake_up(&this_afe.wait[data->token]);
if (afe_token_is_valid(data->token))
wake_up(&this_afe.wait[data->token]);
else
return -EINVAL;
pr_debug("%s: AFE_CMD_ADD_TOPOLOGIES cmd 0x%x\n",
__func__, payload[1]);
break;
@ -678,7 +696,10 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv)
else
this_afe.mmap_handle = payload[0];
atomic_set(&this_afe.state, 0);
wake_up(&this_afe.wait[data->token]);
if (afe_token_is_valid(data->token))
wake_up(&this_afe.wait[data->token]);
else
return -EINVAL;
} else if (data->opcode == AFE_EVENT_RT_PROXY_PORT_STATUS) {
port_id = (uint16_t)(0x0000FFFF & payload[0]);
}