dsp: validate token before usage as array index
Token from DSP might be invalid for array index. Validate the token before being used as array index. Change-Id: I9f47e1328d75d9f9acf7e85ddb452019b6eced0a Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
This commit is contained in:
parent
74e190f54e
commit
9be69e398a
|
@ -1,4 +1,4 @@
|
||||||
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
|
/* Copyright (c) 2012-2016, 2019 The Linux Foundation. All rights reserved.
|
||||||
*
|
*
|
||||||
* This program is free software; you can redistribute it and/or modify
|
* This program is free software; you can redistribute it and/or modify
|
||||||
* it under the terms of the GNU General Public License version 2 and
|
* it under the terms of the GNU General Public License version 2 and
|
||||||
|
@ -160,6 +160,15 @@ static void afe_callback_debug_print(struct apr_client_data *data)
|
||||||
__func__, data->opcode, data->payload_size);
|
__func__, data->opcode, data->payload_size);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static bool afe_token_is_valid(uint32_t token)
|
||||||
|
{
|
||||||
|
if (token >= AFE_MAX_PORTS) {
|
||||||
|
pr_err("%s: token %d is invalid.\n", __func__, token);
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
static int32_t afe_callback(struct apr_client_data *data, void *priv)
|
static int32_t afe_callback(struct apr_client_data *data, void *priv)
|
||||||
{
|
{
|
||||||
if (!data) {
|
if (!data) {
|
||||||
|
@ -217,7 +226,10 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv)
|
||||||
cali_state[this_afe.calib_data.res_cfg.th_vi_ca_state]);
|
cali_state[this_afe.calib_data.res_cfg.th_vi_ca_state]);
|
||||||
} else
|
} else
|
||||||
atomic_set(&this_afe.state, -1);
|
atomic_set(&this_afe.state, -1);
|
||||||
wake_up(&this_afe.wait[data->token]);
|
if (afe_token_is_valid(data->token))
|
||||||
|
wake_up(&this_afe.wait[data->token]);
|
||||||
|
else
|
||||||
|
return -EINVAL;
|
||||||
} else if (data->payload_size) {
|
} else if (data->payload_size) {
|
||||||
uint32_t *payload;
|
uint32_t *payload;
|
||||||
uint16_t port_id = 0;
|
uint16_t port_id = 0;
|
||||||
|
@ -247,7 +259,10 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv)
|
||||||
case AFE_PORTS_CMD_DTMF_CTL:
|
case AFE_PORTS_CMD_DTMF_CTL:
|
||||||
case AFE_SVC_CMD_SET_PARAM:
|
case AFE_SVC_CMD_SET_PARAM:
|
||||||
atomic_set(&this_afe.state, 0);
|
atomic_set(&this_afe.state, 0);
|
||||||
wake_up(&this_afe.wait[data->token]);
|
if (afe_token_is_valid(data->token))
|
||||||
|
wake_up(&this_afe.wait[data->token]);
|
||||||
|
else
|
||||||
|
return -EINVAL;
|
||||||
break;
|
break;
|
||||||
case AFE_SERVICE_CMD_REGISTER_RT_PORT_DRIVER:
|
case AFE_SERVICE_CMD_REGISTER_RT_PORT_DRIVER:
|
||||||
break;
|
break;
|
||||||
|
@ -259,7 +274,10 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv)
|
||||||
break;
|
break;
|
||||||
case AFE_CMD_ADD_TOPOLOGIES:
|
case AFE_CMD_ADD_TOPOLOGIES:
|
||||||
atomic_set(&this_afe.state, 0);
|
atomic_set(&this_afe.state, 0);
|
||||||
wake_up(&this_afe.wait[data->token]);
|
if (afe_token_is_valid(data->token))
|
||||||
|
wake_up(&this_afe.wait[data->token]);
|
||||||
|
else
|
||||||
|
return -EINVAL;
|
||||||
pr_debug("%s: AFE_CMD_ADD_TOPOLOGIES cmd 0x%x\n",
|
pr_debug("%s: AFE_CMD_ADD_TOPOLOGIES cmd 0x%x\n",
|
||||||
__func__, payload[1]);
|
__func__, payload[1]);
|
||||||
break;
|
break;
|
||||||
|
@ -281,7 +299,10 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv)
|
||||||
else
|
else
|
||||||
this_afe.mmap_handle = payload[0];
|
this_afe.mmap_handle = payload[0];
|
||||||
atomic_set(&this_afe.state, 0);
|
atomic_set(&this_afe.state, 0);
|
||||||
wake_up(&this_afe.wait[data->token]);
|
if (afe_token_is_valid(data->token))
|
||||||
|
wake_up(&this_afe.wait[data->token]);
|
||||||
|
else
|
||||||
|
return -EINVAL;
|
||||||
} else if (data->opcode == AFE_EVENT_RT_PROXY_PORT_STATUS) {
|
} else if (data->opcode == AFE_EVENT_RT_PROXY_PORT_STATUS) {
|
||||||
port_id = (uint16_t)(0x0000FFFF & payload[0]);
|
port_id = (uint16_t)(0x0000FFFF & payload[0]);
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue