evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ASoC: msm: qdsp6v2: Index check for out of range

Browse source 
Check if index is a non-negative value before it is used.
Also, initialize return variable to default value before
it is used so that it does not return uninitialized value.

CRs-Fixed: 1059495
Change-Id: I94a6fc02436734b4f398d1a72f53b3ae68612679
Signed-off-by: Vikram Panduranga <vpandura@codeaurora.org>
This commit is contained in:
Vikram Panduranga 2016-09-19 12:13:06 -07:00 • committed by Gerrit - the friendly Code Review server
parent 1d36d1fe94
commit 7f43c41e90
2 changed files with 17 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
sound/soc/msm/qdsp6v2/q6adm.c
View file

@ -2630,7 +2630,8 @@ int adm_matrix_map(int path, struct route_payload payload_map, int perf_mode)
if (port_idx < 0) { if (port_idx < 0) {
pr_err("%s: Invalid port_id 0x%x\n", __func__, pr_err("%s: Invalid port_id 0x%x\n", __func__,
payload_map.port_id[i]); payload_map.port_id[i]);
return -EINVAL; ret = -EINVAL;
goto fail_cmd;
} }
copp_idx = payload_map.copp_idx[i]; copp_idx = payload_map.copp_idx[i];
copps_list[i] = atomic_read(&this_adm.copp.id[port_idx] copps_list[i] = atomic_read(&this_adm.copp.id[port_idx]
@ -2667,6 +2668,12 @@ int adm_matrix_map(int path, struct route_payload payload_map, int perf_mode)
for (i = 0; i < payload_map.num_copps; i++) { for (i = 0; i < payload_map.num_copps; i++) {
port_idx = afe_get_port_index(payload_map.port_id[i]); port_idx = afe_get_port_index(payload_map.port_id[i]);
copp_idx = payload_map.copp_idx[i]; copp_idx = payload_map.copp_idx[i];
if (port_idx < 0 || copp_idx < 0 ||
(copp_idx > MAX_COPPS_PER_PORT - 1)) {
pr_err("%s: Invalid idx port_idx %d copp_idx %d\n",
__func__, port_idx, copp_idx);
continue;
}
if (atomic_read( if (atomic_read(
&this_adm.copp.topology[port_idx][copp_idx]) == &this_adm.copp.topology[port_idx][copp_idx]) ==
ADM_CMD_COPP_OPEN_TOPOLOGY_ID_DTS_HPX) ADM_CMD_COPP_OPEN_TOPOLOGY_ID_DTS_HPX)

11
sound/soc/msm/qdsp6v2/q6afe.c
View file

@ -1293,7 +1293,7 @@ static int afe_send_port_topology_id(u16 port_id)
u32 topology_id = 0; u32 topology_id = 0;
index = q6audio_get_port_index(port_id); index = q6audio_get_port_index(port_id);
if (index < 0 || index > AFE_MAX_PORTS) { if (index < 0 || index > AFE_MAX_PORTS - 1) {
pr_err("%s: AFE port index[%d] invalid!\n", pr_err("%s: AFE port index[%d] invalid!\n",
__func__, index); __func__, index);
return -EINVAL; return -EINVAL;
@ -1537,7 +1537,7 @@ static int afe_send_codec_reg_page_config(
static int afe_send_codec_reg_config( static int afe_send_codec_reg_config(
struct afe_param_cdc_reg_cfg_data *cdc_reg_cfg) struct afe_param_cdc_reg_cfg_data *cdc_reg_cfg)
{ {
int i, j, ret; int i, j, ret = -EINVAL;
int pkt_size, payload_size, reg_per_pkt, num_pkts, num_regs; int pkt_size, payload_size, reg_per_pkt, num_pkts, num_regs;
struct afe_svc_cmd_cdc_reg_cfg *config; struct afe_svc_cmd_cdc_reg_cfg *config;
struct afe_svc_cmd_set_param *param; struct afe_svc_cmd_set_param *param;
@ -5677,6 +5677,13 @@ int afe_get_sp_ex_vi_ftm_data(struct afe_sp_ex_vi_get_param *ex_vi)
} }
index = q6audio_get_port_index(port); index = q6audio_get_port_index(port);
if (index < 0) {
pr_err("%s: invalid index %d port 0x%x\n", __func__,
index, port);
ret = -EINVAL;
goto done;
}
ex_vi->hdr.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD, ex_vi->hdr.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD,
APR_HDR_LEN(APR_HDR_SIZE), APR_PKT_VER); APR_HDR_LEN(APR_HDR_SIZE), APR_PKT_VER);
ex_vi->hdr.pkt_size = sizeof(*ex_vi); ex_vi->hdr.pkt_size = sizeof(*ex_vi);