Payload size validity is not checked before using it in array index.
Check payload size to avoid out-of-boundary memory.
Change-Id: Ic0b06bb331fc1753ff7543bb218ab12d6a4a3ca8
Signed-off-by: kunleiz <kunleiz@codeaurora.org>
The fixed issues include variable initialization missing and improper NULL
pointer checking.
Change-Id: I5302cf84f7f0414fe0cf69ccc0cafc8225142c5f
Signed-off-by: Tony Han <xiahan@codeaurora.org>
set variable arg to correct type in copy_from_user.
Change-Id: If17e49c473c95c597aeaee7f33dc87806ce71b4f
Signed-off-by: Revathi Uddaraju <revathiu@codeaurora.org>
It is uncommon behavior to expect the caller of a get mixer control
to specify information. Return the last configuration information set
for the mixer control instead of expecting the caller to specify a
backend ID to get configuration information for.
CRs-Fixed: 2031732
Signed-off-by: Siena Richard <sienar@codeaurora.org>
Change-Id: Id1a5fd3e2cf9b7282df916c3973249137efde8c5
In the ioctl function, driver allocates memory to store data
internally before calling copy_to_user to copy data to user-space.
It is possible that kernel internal information can be leaked to
user space through this if the allocated memory is not completely
overwritten with valid data. Use kzalloc to fix this.
CRs-fixed: 2026045
Change-Id: I754ae2157034a135aaca4a15badf10d2567b7ed6
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
Fix the issue where copy_from_user interface is not used properly.
Cleanup the ioctl function so that there is no illegal memory access.
Change-Id: Iffe2bbc0d33f365a852bb0974ee5c45ab724214b
Signed-off-by: Revathi Uddaraju <revathiu@codeaurora.org>
If two ioctls are triggered with different commands,
there is a possibility to access freed confidence level
memory. To resolve this acquire lock in ioctl.
Also release mutex lock properly in error cases.
CRs-Fixed: 1103085
Change-Id: I7d6b2eff21c8297e5f0755a0c141254be32f777d
Signed-off-by: Yeleswarapu Nagaradhesh <nagaradh@codeaurora.org>
Add support for multi-copps for multiple BEs with independent
calibration data. This allows for more accurate calibration of device
copps.
CRs-fixed: 1110411
Change-Id: I72ce501408a474eb620a088172e3c4d789ab5ef0
Signed-off-by: Siena Richard <sienar@codeaurora.org>
LSM needs to connect to ADM in cases where processing of
captured data is required. App type config support is added
to configure ADM in such cases.
Change-Id: I2e429235e0486c958cacf18e5b704736791c2f7e
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
Signed-off-by: Revathi Uddaraju <revathiu@codeaurora.org>
Enhance LSM code to support maximum configuration of 48khz, 24bit
and 4 channel.
Change-Id: I03895c983527d87389ca69e85235b1def5b4a2fa
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
Signed-off-by: Revathi Uddaraju <revathiu@codeaurora.org>
Add support to parse LSM_SESSION_EVENT_DETECTION_STATUS_V3
in cases where event status requires timestamp corresponding
to detection.
Framework mode config is set to timestamp mode in cases where
LSM_SESSION_EVENT_DETECTION_STATUS_V3 is required.
Change-Id: Id0da3b24d55ac56ff6b61372ede9c63f50b2f4d4
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
Signed-off-by: Revathi Uddaraju <revathiu@codeaurora.org>
LSM will connect to ADM to apply preprocessing and improve
detection performance. LSM can also directly connect to AFE
similar to the existing mechanism.
MAD polling will be disabled in case of LSM connects to ADM.
Add EC reference end channel, bit format and sample rate control
to configure far end params for Echo Cancellation.
Change-Id: I4684ae346884d656e95350b7a63929b91a843512
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
Signed-off-by: Revathi Uddaraju <revathiu@codeaurora.org>
Polling needs to be disabled when LSM connects to ADM.
Add interface to enable or disable polling through
set_params. Add support to set port.
Change-Id: If027418a6d8a1ea48dcb6a0c146f68e7dd7a2664
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
Signed-off-by: Revathi Uddaraju <revathiu@codeaurora.org>
Some of the ioctl command handling is not properly using the
copy_from_user interface. Fix these issues and cleanup the ioctl
functions to make sure there is no illegal memory access.
CRs-Fixed: 1087469
Change-Id: Ieb1beb92e7854a05b8045de0ce179d12c9a6da74
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
Change all qdsp6v2 audio driver to use %pK instead
of %p. %pK hides addresses when the users doesn't
have kernel permissions. If address information
is needed echo 0 > /proc/sys/kernel/kptr_restrict.
Change-Id: I7baa9f127266726fecf9238167a1e0128a258847
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
Currently lsm client data is deallocated when q6lsm_open() fails
which can cause memory corruption if lsm client data is accessed
after freed. Fix this issue by deallocating the client data only
in msm_lsm_close().
Change-Id: If048c26a0ffd8a346a28622183cbf2ba1e7e5ff3
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
In audio ion driver, append msm_audio_ to API
populate_upper_32bits to maintain consistency
across other API names in this driver.
Change-Id: I72aace56bf8e80c6dd83f768876253d2c7f334bb
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Add snapshot for audio drivers for MSM targets. The code is
migrated from msm-3.18 kernel at the below commit/AU level -
AU_LINUX_ANDROID_LA.HB.1.3.1.06.00.00.187.056
(e70ad0cd5efdd9dc91a77dcdac31d6132e1315c1)
(Promotion of kernel.lnx.3.18-151201.)
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
