Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 75a7e363 authored by Soumya Managoli's avatar Soumya Managoli
Browse files

ASoC: msm-pcm-host-voice: Handle OOB access in hpcm_start 



There is no error check for case when hpcm_start
is called for the same RX or TX tap points multiple times.
This can result in OOB access of struct vss_ivpcm_tap_point.
Handle this scenario with appropriate no_of_tp check.

Change-Id: Ib384d21c9bf372f3e5d78f64b5c056e836728399
Signed-off-by: default avatarSoumya Managoli <quic_c_smanag@quicinc.com>
parent cfcdfaa7

asoc/msm-pcm-host-voice-v2.c

+7 −1
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/* Copyright (c) 2013-2019, The Linux Foundation. All rights reserved.

 * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.

 */



#include <linux/init.h>
@@ -627,6 +627,12 @@ static int hpcm_start_vocpcm(char *pcm_id, struct hpcm_drv *prtd, 
		}

	}



	if (*no_of_tp != no_of_tp_req && *no_of_tp > 2) {

		pr_err("%s:: Invalid hpcm start request\n", __func__);

		memset(&prtd->start_cmd, 0, sizeof(struct start_cmd));

		return -EINVAL;

	}



	if ((prtd->mixer_conf.tx.enable || prtd->mixer_conf.rx.enable) &&

	    *no_of_tp == no_of_tp_req) {

		voc_send_cvp_start_vocpcm(voc_get_session_id(sess_name),