Piteball/android_kernel_samsung_msm8976
1
1
Fork 0
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git synced 2024-09-21 11:53:01 +00:00
Code Issues Projects Releases Wiki Activity

Merge "ASoC: msm: qdsp6v2: DAP: Fix buffer overflow"

Browse source
This commit is contained in:
Linux Build Service Account 2016-05-02 03:07:32 -07:00 committed by Gerrit - the friendly Code Review server
parent bae1c87257 4aecfab390
commit d8f80af659
1 changed files with 20 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
* only version 2 as published by the Free Software Foundation.
@ -1356,7 +1356,11 @@ static int msm_ds2_dap_handle_commands(u32 cmd, void *arg)
int ret = 0, port_id = 0;
int32_t data;
struct dolby_param_data *dolby_data = (struct dolby_param_data *)arg;
get_user(data, &dolby_data->data[0]);
if (get_user(data, &dolby_data->data[0])) {
pr_debug("%s error getting data\n", __func__);
ret = -EFAULT;
goto end;
}
pr_debug("%s: param_id %d,be_id %d,device_id 0x%x,length %d,data %d\n",
__func__, dolby_data->param_id, dolby_data->be_id,
@ -1471,11 +1475,23 @@ static int msm_ds2_dap_set_param(u32 cmd, void *arg)
goto end;
}
off = ds2_dap_params_offset[idx];
if ((dolby_data->length <= 0) ||
(dolby_data->length > TOTAL_LENGTH_DS2_PARAM - off)) {
pr_err("%s: invalid length %d at idx %d\n",
__func__, dolby_data->length, idx);
rc = -EINVAL;
goto end;
}
/* cache the parameters */
ds2_dap_params[cdev].dap_params_modified[idx] += 1;
for (j = 0; j < dolby_data->length; j++) {
off = ds2_dap_params_offset[idx];
get_user(data, &dolby_data->data[j]);
if (get_user(data, &dolby_data->data[j])) {
pr_debug("%s:error getting data\n", __func__);
rc = -EFAULT;
goto end;
}
ds2_dap_params[cdev].params_val[off + j] = data;
pr_debug("%s:off %d,val[i/p:o/p]-[%d / %d]\n",
__func__, off, data,