Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3aaf15ea authored by Sandhya Mutha Naga Venkata's avatar Sandhya Mutha Naga Venkata
Browse files

dsp: afe: Add check for sidetone iir config copy size 



Avoid OOB access of sidetone iir config array when
iir_num_biquad_stages returned from cal block is > 10

Change-Id: I45b95e8bdd1a993a526590c94cf2f9a85c12af37
Signed-off-by: default avatarSoumya Managoli <quic_c_smanag@quicinc.com>
parent f134827a

dsp/q6afe.c

+9 −1
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.

 * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.

 */

#include <linux/slab.h>

#include <linux/debugfs.h>
@@ -8050,6 +8050,14 @@ static int afe_sidetone_iir(u16 tx_port_id) 
		pr_debug("%s: adding 2 to size:%d\n", __func__, size);

		size = size + 2;

	}



	if (size > MAX_SIDETONE_IIR_DATA_SIZE) {

		pr_err("%s: iir_config size is out of bounds:%d\n", __func__, size);

		mutex_unlock(&this_afe.cal_data[cal_index]->lock);

		ret = -EINVAL;

		goto done;

	}



	memcpy(&filter_data.iir_config, &st_iir_cal_info->iir_config, size);

	mutex_unlock(&this_afe.cal_data[cal_index]->lock);