Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

msm: asm: validate ADSP data before access 

Validate buffer index obtained from ADSP token before using it.

CRs-Fixed: 2372302
Change-Id: I5c3b1634bd08b516844638dd67f726a882edfc17
Signed-off-by: Vignesh Kulothungan <vigneshk@codeaurora.org>
This commit is contained in:
Vignesh Kulothungan 2019-02-28 14:55:05 -08:00 committed by syphyr
parent aea54399b0
commit dbb4420cbd
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
sound/soc/msm/qdsp6v2/q6asm.c
View File

@ -1625,6 +1625,7 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
data->dest_port);
if ((data->opcode != ASM_DATA_EVENT_RENDERED_EOS) &&
(data->opcode != ASM_DATA_EVENT_EOS) &&
(data->opcode != ASM_SESSION_EVENTX_OVERFLOW) &&
(data->opcode != ASM_SESSION_EVENT_RX_UNDERFLOW)) {
if (payload == NULL) {
pr_err("%s: payload is null\n", __func__);
@ -1769,6 +1770,14 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
return -EINVAL;
}
spin_lock_irqsave(&port->dsp_lock, dsp_flags);
if (data->token < 0 ||
data->token >= port->max_buf_cnt) {
pr_err("%s: Invalid token buffer index %u\n",
__func__, data->token);
spin_unlock_irqrestore(&port->dsp_lock,
dsp_flags);
return -EINVAL;
}
if (lower_32_bits(port->buf[data->token].phys) !=
payload[0] ||
populate_upper_32_bits(port->buf[data->token].phys) !=
@ -1860,6 +1869,13 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
}
spin_lock_irqsave(&port->dsp_lock, dsp_flags);
token = data->token;
if (token < 0 || token >= port->max_buf_cnt) {
pr_err("%s: Invalid token buffer index %u\n",
__func__, token);
spin_unlock_irqrestore(&port->dsp_lock,
dsp_flags);
return -EINVAL;
}
port->buf[token].used = 0;
if (lower_32_bits(port->buf[token].phys) !=
payload[READDONE_IDX_BUFADD_LSW] ||