Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 88a57c69 authored by Sandhya Mutha Naga Venkata's avatar Sandhya Mutha Naga Venkata
Browse files

dsp: q6afe: Add check for fbsp state 



Added check for fbsp state in get_calib_data functions
to avoid OOB read issues

Change-Id: I6e818892a6b76497aa41241db3849802f394160a
Signed-off-by: default avatarSoumya Managoli <quic_c_smanag@quicinc.com>
parent b52120be

dsp/q6afe.c

+14 −0
Original line number Diff line number Diff line
@@ -9974,6 +9974,7 @@ static int afe_spv4_get_calib_data( 
	struct param_hdr_v3 param_hdr;

	int port = SLIMBUS_4_TX;

	int ret = -EINVAL;

	uint32_t th_vi_ca_state;



	if (!calib_resp) {

		pr_err("%s: Invalid params\n", __func__);
@@ -9995,6 +9996,12 @@ static int afe_spv4_get_calib_data( 
		       __func__, port, param_hdr.param_id, ret);

		goto get_params_fail;

	}

	th_vi_ca_state = this_afe.spv4_calib_data.res_cfg.th_vi_ca_state;

	if (th_vi_ca_state < FBSP_INCORRECT_OP_MODE ||

		th_vi_ca_state > MAX_FBSP_STATE) {

		pr_err("%s: invalid fbsp state %d\n", __func__, th_vi_ca_state);

		goto get_params_fail;

	}

	memcpy(&calib_resp->res_cfg, &this_afe.spv4_calib_data.res_cfg,

		sizeof(this_afe.calib_data.res_cfg));

	pr_info("%s: state %s resistance %d %d\n", __func__,
@@ -10013,6 +10020,7 @@ int afe_spk_prot_get_calib_data(struct afe_spkr_prot_get_vi_calib *calib_resp) 
	struct param_hdr_v3 param_hdr;

	int port = SLIMBUS_4_TX;

	int ret = -EINVAL;

	uint32_t th_vi_ca_state;



	if (!calib_resp) {

		pr_err("%s: Invalid params\n", __func__);
@@ -10034,6 +10042,12 @@ int afe_spk_prot_get_calib_data(struct afe_spkr_prot_get_vi_calib *calib_resp) 
		       __func__, port, param_hdr.param_id, ret);

		goto get_params_fail;

	}

	th_vi_ca_state = this_afe.calib_data.res_cfg.th_vi_ca_state;

	if (th_vi_ca_state < FBSP_INCORRECT_OP_MODE ||

		th_vi_ca_state > MAX_FBSP_STATE) {

		pr_err("%s: invalid fbsp state %d\n", __func__, th_vi_ca_state);

		goto get_params_fail;

	}

	memcpy(&calib_resp->res_cfg, &this_afe.calib_data.res_cfg,

		sizeof(this_afe.calib_data.res_cfg));

	pr_info("%s: state %s resistance %d %d\n", __func__,