Merge "dsp: validate token before usage as array index" (84eff29a) · Commits · e / devices / android_kernel_fairphone_FP3

dsp/q6afe.c

+26 −5

Original line number	Diff line number	Diff line
		/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -300,6 +300,15 @@ static int32_t sp_make_afe_callback(uint32_t *payload, uint32_t payload_size)
		return 0;
		}

		static bool afe_token_is_valid(uint32_t token)
		{
		if (token >= AFE_MAX_PORTS) {
		pr_err("%s: token %d is invalid.\n", __func__, token);
		return false;
		}
		return true;
		}

		static int32_t afe_callback(struct apr_client_data data, void priv)
		{
		if (!data) {
		@@ -374,7 +383,10 @@ static int32_t afe_callback(struct apr_client_data data, void priv)
		data->payload_size))
		return -EINVAL;
		}
		if (afe_token_is_valid(data->token))
		wake_up(&this_afe.wait[data->token]);
		else
		return -EINVAL;
		} else if (data->payload_size) {
		uint32_t *payload;
		uint16_t port_id = 0;
		@@ -405,7 +417,10 @@ static int32_t afe_callback(struct apr_client_data data, void priv)
		case AFE_PORTS_CMD_DTMF_CTL:
		case AFE_SVC_CMD_SET_PARAM:
		atomic_set(&this_afe.state, 0);
		if (afe_token_is_valid(data->token))
		wake_up(&this_afe.wait[data->token]);
		else
		return -EINVAL;
		break;
		case AFE_SERVICE_CMD_REGISTER_RT_PORT_DRIVER:
		break;
		@@ -417,7 +432,10 @@ static int32_t afe_callback(struct apr_client_data data, void priv)
		break;
		case AFE_CMD_ADD_TOPOLOGIES:
		atomic_set(&this_afe.state, 0);
		if (afe_token_is_valid(data->token))
		wake_up(&this_afe.wait[data->token]);
		else
		return -EINVAL;
		pr_debug("%s: AFE_CMD_ADD_TOPOLOGIES cmd 0x%x\n",
		__func__, payload[1]);
		break;
		@@ -439,7 +457,10 @@ static int32_t afe_callback(struct apr_client_data data, void priv)
		else
		this_afe.mmap_handle = payload[0];
		atomic_set(&this_afe.state, 0);
		if (afe_token_is_valid(data->token))
		wake_up(&this_afe.wait[data->token]);
		else
		return -EINVAL;
		} else if (data->opcode == AFE_EVENT_RT_PROXY_PORT_STATUS) {
		port_id = (uint16_t)(0x0000FFFF & payload[0]);
		}