Merge "dsp: Fix issues due to accessing array out of bounds" (156b3650) · Commits · e / devices / android_kernel_fairphone_FP5

dsp/rtac.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -957,6 +957,12 @@ void rtac_set_asm_handle(u32 session_id, void *handle)
		{
		pr_debug("%s\n", __func__);

		if (session_id >= (ASM_ACTIVE_STREAMS_ALLOWED + 1)) {
		pr_err_ratelimited("%s: Invalid Session = %d\n",
		__func__, session_id);
		return;
		}

		mutex_lock(&rtac_asm_apr_mutex);
		rtac_asm_apr_data[session_id].apr_handle = handle;
		mutex_unlock(&rtac_asm_apr_mutex);
		@@ -965,6 +971,12 @@ void rtac_set_asm_handle(u32 session_id, void *handle)
		bool rtac_make_asm_callback(u32 session_id, uint32_t *payload,
		u32 payload_size)
		{
		if (session_id >= (ASM_ACTIVE_STREAMS_ALLOWED + 1)) {
		pr_err_ratelimited("%s: Invalid Session = %d\n",
		__func__, session_id);
		return false;
		}

		if (atomic_read(&rtac_asm_apr_data[session_id].cmd_state) != 1)
		return false;