Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d6ec3945 authored by Karthikeyan Mani's avatar Karthikeyan Mani Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: qdsp6v2: Fix out-of-bounds access in put functions 



Add out of bounds check in routing put functions
for the mux value before accessing the texts
pointer of soc_enum struct with mux as index.

CRs-fixed: 1097569
Change-Id: If1161ea918680deacc0d322d11f42637f377a9ab
Signed-off-by: default avatarKarthikeyan Mani <kmani@codeaurora.org>
parent e5b69732

sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c

+15 −0
Original line number Diff line number Diff line
@@ -1900,6 +1900,11 @@ static int msm_routing_lsm_mux_put(struct snd_kcontrol *kcontrol, 
	int lsm_port = AFE_PORT_ID_SLIMBUS_MULTI_CHAN_5_TX;

	struct snd_soc_dapm_update *update = NULL;









	if (mux >= e->items) {









		pr_err("%s: Invalid mux value %d\n", __func__, mux);









		return -EINVAL;









	}

















	pr_debug("%s: LSM enable %ld\n", __func__,









			ucontrol->value.integer.value[0]);









	switch (ucontrol->value.integer.value[0]) {








@@ -2223,6 +2228,11 @@ static int msm_routing_ec_ref_rx_put(struct snd_kcontrol *kcontrol,







	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;









	struct snd_soc_dapm_update *update = NULL;

















	if (mux >= e->items) {









		pr_err("%s: Invalid mux value %d\n", __func__, mux);









		return -EINVAL;









	}

















	mutex_lock(&routing_lock);









	switch (ucontrol->value.integer.value[0]) {









	case 0:








@@ -2419,6 +2429,11 @@ static int msm_routing_ext_ec_put(struct snd_kcontrol *kcontrol,







	uint16_t ext_ec_ref_port_id;









	struct snd_soc_dapm_update *update = NULL;

















	if (mux >= e->items) {









		pr_err("%s: Invalid mux value %d\n", __func__, mux);









		return -EINVAL;









	}

















	mutex_lock(&routing_lock);









	msm_route_ext_ec_ref = ucontrol->value.integer.value[0];