Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 7df3d997 authored by Michael Bestas's avatar Michael Bestas
Browse files

Merge tag 'LA.UM.9.15.2.r1-10600-KAMORTA.QSSI14.0' of... 

Merge tag 'LA.UM.9.15.2.r1-10600-KAMORTA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel into android13-4.19-kona

"LA.UM.9.15.2.r1-10600-KAMORTA.QSSI14.0"

* tag 'LA.UM.9.15.2.r1-10600-KAMORTA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
  dsp: q6lsm: Check size of payload before access
  asoc: codecs: Fix for the SSR issue on qcm2150
  dsp: q6voice: Adds checks for an integer overflow
  asoc: Fix out-of-bound write
  dsp: q6voice: Adds checks for an integer overflow
  Fix for OOB access issue
  dsp: q6lsm: Check size of payload before access

Change-Id: I708a0be36841731d8c5126b8135123b642a8a7d7
parents bcb29014 6c57248b

techpack/audio/asoc/codecs/sdm660_cdc/msm-digital-cdc.c

+9 −3
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2015-2017, 2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.

 */

#include <linux/module.h>

#include <linux/init.h>
@@ -1141,8 +1142,10 @@ static int msm_dig_cdc_event_notify(struct notifier_block *block, 
		break;

	case DIG_CDC_EVENT_SSR_UP:

		regcache_cache_only(msm_dig_cdc->regmap, false);

		if ((msm_dig_cdc->regmap) != NULL && (msm_dig_cdc->regmap->lock) != NULL &&

			(msm_dig_cdc->regmap->lock_arg) != NULL) {

			regcache_mark_dirty(msm_dig_cdc->regmap);



		}

		mutex_lock(&pdata->cdc_int_mclk0_mutex);

		pdata->digital_cdc_core_clk.enable = 1;

		ret = afe_set_lpass_clock_v2(
@@ -1156,7 +1159,10 @@ static int msm_dig_cdc_event_notify(struct notifier_block *block, 
		}

		mutex_unlock(&pdata->cdc_int_mclk0_mutex);



		if ((msm_dig_cdc->regmap) != NULL && (msm_dig_cdc->regmap->lock) != NULL &&

                        (msm_dig_cdc->regmap->lock_arg) != NULL) {

			regcache_sync(msm_dig_cdc->regmap);

		}



		mutex_lock(&pdata->cdc_int_mclk0_mutex);

		pdata->digital_cdc_core_clk.enable = 0;

techpack/audio/dsp/q6lsm.c

+11 −1
Original line number Diff line number Diff line
@@ -2036,7 +2036,17 @@ static int q6lsm_mmapcallback(struct apr_client_data *data, void *priv) 
		return 0;

	}

	

	if (data->payload_size < (2 * sizeof(uint32_t))) {

	/*

	The payload_size can be either 4 or 8 bytes.

	It has to be verified whether the payload_size is

	atleast 4 bytes. If it is less, returns errorcode.



	The opcode for 4 bytes is 0x12A80

	The opcode for 8 bytes is 0x110E8.

	 

	*/



	if (data->payload_size < (2 * sizeof(uint16_t))) {

		pr_err("%s: payload has invalid size[%d]\n", __func__,

			data->payload_size);

		return -EINVAL;