evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: asm: validate ADSP data before access"

Browse source
This commit is contained in:
Linux Build Service Account 2019-04-02 14:00:26 -07:00 • committed by Gerrit - the friendly Code Review server
commit dd45e2fcea
1 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
sound/soc/msm/qdsp6v2/q6asm.c
View file

@ -1948,6 +1948,7 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
data->dest_port); data->dest_port);
if ((data->opcode != ASM_DATA_EVENT_RENDERED_EOS) && if ((data->opcode != ASM_DATA_EVENT_RENDERED_EOS) &&
(data->opcode != ASM_DATA_EVENT_EOS) && (data->opcode != ASM_DATA_EVENT_EOS) &&
(data->opcode != ASM_SESSION_EVENTX_OVERFLOW) &&
(data->opcode != ASM_SESSION_EVENT_RX_UNDERFLOW)) { (data->opcode != ASM_SESSION_EVENT_RX_UNDERFLOW)) {
if (payload == NULL) { if (payload == NULL) {
pr_err("%s: payload is null\n", __func__); pr_err("%s: payload is null\n", __func__);
@ -2130,6 +2131,17 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
} }
spin_lock_irqsave(&port->dsp_lock, dsp_flags); spin_lock_irqsave(&port->dsp_lock, dsp_flags);
buf_index = asm_token._token.buf_index; buf_index = asm_token._token.buf_index;
if (buf_index < 0 ||
buf_index >= port->max_buf_cnt) {
pr_err("%s: Invalid buffer index %u\n",
__func__, buf_index);
spin_unlock_irqrestore(&port->dsp_lock,
dsp_flags);
spin_unlock_irqrestore(
&(session[session_id].session_lock),
flags);
return -EINVAL;
}
if (lower_32_bits(port->buf[buf_index].phys) != if (lower_32_bits(port->buf[buf_index].phys) !=
payload[0] || payload[0] ||
msm_audio_populate_upper_32_bits( msm_audio_populate_upper_32_bits(
@ -2220,6 +2232,16 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
} }
spin_lock_irqsave(&port->dsp_lock, dsp_flags); spin_lock_irqsave(&port->dsp_lock, dsp_flags);
buf_index = asm_token._token.buf_index; buf_index = asm_token._token.buf_index;
if (buf_index < 0 || buf_index >= port->max_buf_cnt) {
pr_err("%s: Invalid buffer index %u\n",
__func__, buf_index);
spin_unlock_irqrestore(&port->dsp_lock,
dsp_flags);
spin_unlock_irqrestore(
&(session[session_id].session_lock),
flags);
return -EINVAL;
}
port->buf[buf_index].used = 0; port->buf[buf_index].used = 0;
if (lower_32_bits(port->buf[buf_index].phys) != if (lower_32_bits(port->buf[buf_index].phys) !=
payload[READDONE_IDX_BUFADD_LSW] || payload[READDONE_IDX_BUFADD_LSW] ||