samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "dsp: asm: validate ADSP data size before access"

Browse Source
This commit is contained in:
Linux Build Service Account
2019-03-14 06:55:35 -07:00
committed by Gerrit - the friendly Code Review server
parent 766e57f94b 52b8722a94
commit e848e37cb2
1 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
dsp/q6asm.c
View File

@@ -1950,9 +1950,10 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
data->dest_port);
if ((data->opcode != ASM_DATA_EVENT_RENDERED_EOS) &&
(data->opcode != ASM_DATA_EVENT_EOS) &&
(data->opcode != ASM_SESSION_EVENTX_OVERFLOW) &&
(data->opcode != ASM_SESSION_EVENT_RX_UNDERFLOW)) {
if (payload == NULL) {
pr_err("%s: payload is null\n", __func__);
if (payload == NULL || (data->payload_size < (2 * sizeof(uint32_t)))) {
pr_err("%s: payload is null or invalid size[%d]\n", __func__, data->payload_size);
spin_unlock_irqrestore(
&(session[session_id].session_lock), flags);
return -EINVAL;
@@ -2165,6 +2166,16 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
}
spin_lock_irqsave(&port->dsp_lock, dsp_flags);
buf_index = asm_token._token.buf_index;
if (buf_index < 0 || buf_index >= port->max_buf_cnt) {
pr_debug("%s: Invalid buffer index %u\n",
__func__, buf_index);
spin_unlock_irqrestore(&port->dsp_lock,
dsp_flags);
spin_unlock_irqrestore(
&(session[session_id].session_lock),
flags);
return -EINVAL;
}
if ( data->payload_size >= 2 * sizeof(uint32_t) &&
(lower_32_bits(port->buf[buf_index].phys) !=
payload[0] ||
@@ -2267,6 +2278,16 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
}
spin_lock_irqsave(&port->dsp_lock, dsp_flags);
buf_index = asm_token._token.buf_index;
if (buf_index < 0 || buf_index >= port->max_buf_cnt) {
pr_debug("%s: Invalid buffer index %u\n",
__func__, buf_index);
spin_unlock_irqrestore(&port->dsp_lock,
dsp_flags);
spin_unlock_irqrestore(
&(session[session_id].session_lock),
flags);
return -EINVAL;
}
port->buf[buf_index].used = 0;
if (lower_32_bits(port->buf[buf_index].phys) !=
payload[READDONE_IDX_BUFADD_LSW] ||