Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit bcb29014 authored by Michael Bestas's avatar Michael Bestas
Browse files

Merge tag 'LA.UM.9.12.1.r1-09700-SMxx50.QSSI12.0' of... 

Merge tag 'LA.UM.9.12.1.r1-09700-SMxx50.QSSI12.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel into android13-4.19-kona

"LA.UM.9.12.1.r1-09700-SMxx50.QSSI12.0"

* tag 'LA.UM.9.12.1.r1-09700-SMxx50.QSSI12.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
  dsp: q6voice: Adds checks for an integer overflow
  asoc: Fix out-of-bound write
  dsp: q6voice: Adds checks for an integer overflow
  dsp: q6lsm: Check size of payload before access
  Fix for OOB access issue
  Audio legacy: Integer overflow in msm_lsm_ioctl_compat during audio playback usecase. size = sizeof(p_info_32) + p_info_32.param_size; This overflow issue may result heap overflow during copying the data: memcpy(param_info_rsp, &p_info_32, sizeof(p_info_32));
  ASoC: Resolve use after free in listen sound client
  dsp: q6lsm: Add check for payload buffer
  ASoC: msm-pcm-voip: Avoid interger underflow
  soc: swr-mstr: Store and compare dev_addr along with dev_num

 Conflicts:
	techpack/audio/asoc/msm-compress-q6-v2.c
	techpack/audio/asoc/msm-pcm-routing-v2.c

Change-Id: I76045565c18bea94657ac7bbb46a49058f108f8d
parents 30a1ea9e 68df146c

techpack/audio/asoc/msm-compress-q6-v2.c

+3 −3
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.

 */
@@ -3950,7 +3950,7 @@ static int msm_compr_channel_map_put(struct snd_kcontrol *kcontrol, 


	pr_debug("%s: fe_id- %llu\n", __func__, fe_id);



	if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) {

	if (fe_id >= MSM_FRONTEND_DAI_MAX) {

		pr_err("%s Received out of bounds fe_id %llu\n",

			__func__, fe_id);

		rc = -EINVAL;
@@ -3992,7 +3992,7 @@ static int msm_compr_channel_map_get(struct snd_kcontrol *kcontrol, 
	int rc = 0, i;



	pr_debug("%s: fe_id- %llu\n", __func__, fe_id);

	if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) {

	if (fe_id >= MSM_FRONTEND_DAI_MAX) {

		pr_err("%s: Received out of bounds fe_id %llu\n",

			__func__, fe_id);

		rc = -EINVAL;

techpack/audio/asoc/msm-pcm-routing-v2.c

+3 −3
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.

 * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.

 */















#include <linux/init.h>










@@ -1656,7 +1656,7 @@ static int msm_pcm_routing_channel_mixer_v2(int fe_id, bool perf_mode,













	int j = 0, be_id = 0;















	int ret = 0;



























	if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) {













	if (fe_id >= MSM_FRONTEND_DAI_MAX) {















		pr_err("%s: invalid FE %d\n", __func__, fe_id);















		return 0;















	}










@@ -1723,7 +1723,7 @@ static int msm_pcm_routing_channel_mixer(int fe_id, bool perf_mode,













		return ret;















	}



























	if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) {













	if (fe_id >= MSM_FRONTEND_DAI_MAX) {















		pr_err("%s: invalid FE %d\n", __func__, fe_id);















		return 0;















	}

























techpack/audio/asoc/msm-qti-pp-config.c



+2
−1




























Original line number
Diff line number
Diff line















// SPDX-License-Identifier: GPL-2.0-only















/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.













 * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.















 */































#include <linux/err.h>










@@ -179,7 +180,7 @@ static int msm_qti_pp_put_dtmf_module_enable





























	fe_id = ((struct soc_multi_mixer_control *)















			kcontrol->private_value)->shift;













	if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) {













	if (fe_id >= MSM_FRONTEND_DAI_MAX) {















		pr_err("%s: invalid FE %d\n", __func__, fe_id);















		return -EINVAL;















	}

































techpack/audio/dsp/q6adm.c



+5
−10




























Original line number
Diff line number
Diff line








@@ -1593,17 +1593,12 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv)













		if (data->opcode == APR_BASIC_RSP_RESULT) {















			pr_debug("%s: APR_BASIC_RSP_RESULT id 0x%x\n",















				__func__, payload[0]);



























			if (!((client_id != ADM_CLIENT_ID_SOURCE_TRACKING) &&













			     ((payload[0] == ADM_CMD_SET_PP_PARAMS_V5) ||













			      (payload[0] == ADM_CMD_SET_PP_PARAMS_V6)))) {















			if (data->payload_size <















					(2 * sizeof(uint32_t))) {















				pr_err("%s: Invalid payload size %d\n",















					__func__, data->payload_size);















				return 0;















			}













			}































			if (payload[1] != 0) {















				pr_err("%s: cmd = 0x%x returned error = 0x%x\n",

































techpack/audio/dsp/q6lsm.c



+7
−1




























Original line number
Diff line number
Diff line















// SPDX-License-Identifier: GPL-2.0-only















/*















 * Copyright (c) 2013-2020, Linux Foundation. All rights reserved.













 * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.













 * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.















 */















#include <linux/fs.h>















#include <linux/mutex.h>










@@ -2036,6 +2036,12 @@ static int q6lsm_mmapcallback(struct apr_client_data *data, void *priv)













		return 0;















	}





























	if (data->payload_size < (2 * sizeof(uint32_t))) {













		pr_err("%s: payload has invalid size[%d]\n", __func__,













			data->payload_size);













		return -EINVAL;













	}





























	command = payload[0];















	retcode = payload[1];















	sid = (data->token >> 8) & 0x0F;