diff --git a/sound/soc/msm/qdsp6v2/q6adm.c b/sound/soc/msm/qdsp6v2/q6adm.c index ffa78af72544..45b09c094207 100644 --- a/sound/soc/msm/qdsp6v2/q6adm.c +++ b/sound/soc/msm/qdsp6v2/q6adm.c @@ -2630,7 +2630,8 @@ int adm_matrix_map(int path, struct route_payload payload_map, int perf_mode) if (port_idx < 0) { pr_err("%s: Invalid port_id 0x%x\n", __func__, payload_map.port_id[i]); - return -EINVAL; + ret = -EINVAL; + goto fail_cmd; } copp_idx = payload_map.copp_idx[i]; copps_list[i] = atomic_read(&this_adm.copp.id[port_idx] @@ -2667,6 +2668,12 @@ int adm_matrix_map(int path, struct route_payload payload_map, int perf_mode) for (i = 0; i < payload_map.num_copps; i++) { port_idx = afe_get_port_index(payload_map.port_id[i]); copp_idx = payload_map.copp_idx[i]; + if (port_idx < 0 || copp_idx < 0 || + (copp_idx > MAX_COPPS_PER_PORT - 1)) { + pr_err("%s: Invalid idx port_idx %d copp_idx %d\n", + __func__, port_idx, copp_idx); + continue; + } if (atomic_read( &this_adm.copp.topology[port_idx][copp_idx]) == ADM_CMD_COPP_OPEN_TOPOLOGY_ID_DTS_HPX) diff --git a/sound/soc/msm/qdsp6v2/q6afe.c b/sound/soc/msm/qdsp6v2/q6afe.c index f6a687611f8a..2119fc8ef282 100644 --- a/sound/soc/msm/qdsp6v2/q6afe.c +++ b/sound/soc/msm/qdsp6v2/q6afe.c @@ -1293,7 +1293,7 @@ static int afe_send_port_topology_id(u16 port_id) u32 topology_id = 0; index = q6audio_get_port_index(port_id); - if (index < 0 || index > AFE_MAX_PORTS) { + if (index < 0 || index > AFE_MAX_PORTS - 1) { pr_err("%s: AFE port index[%d] invalid!\n", __func__, index); return -EINVAL; @@ -1537,7 +1537,7 @@ static int afe_send_codec_reg_page_config( static int afe_send_codec_reg_config( struct afe_param_cdc_reg_cfg_data *cdc_reg_cfg) { - int i, j, ret; + int i, j, ret = -EINVAL; int pkt_size, payload_size, reg_per_pkt, num_pkts, num_regs; struct afe_svc_cmd_cdc_reg_cfg *config; struct afe_svc_cmd_set_param *param; @@ -5677,6 +5677,13 @@ int afe_get_sp_ex_vi_ftm_data(struct afe_sp_ex_vi_get_param *ex_vi) } index = q6audio_get_port_index(port); + if (index < 0) { + pr_err("%s: invalid index %d port 0x%x\n", __func__, + index, port); + ret = -EINVAL; + goto done; + } + ex_vi->hdr.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD, APR_HDR_LEN(APR_HDR_SIZE), APR_PKT_VER); ex_vi->hdr.pkt_size = sizeof(*ex_vi);