Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cb966737 authored by Linux Build Service Account's avatar Linux Build Service Account
Browse files

Merge 2837dbef on remote branch 

Change-Id: I15e74340ed5b0edc1883e06fca6880b858ca85bd
parents 4fcc4a5c 2837dbef

asoc/msm-audio-effects-q6-v2.c

+9 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/* Copyright (c) 2013-2019, The Linux Foundation. All rights reserved.

 * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.

 */



#include <linux/slab.h>
@@ -1002,6 +1003,14 @@ int msm_audio_effects_pbe_handler(struct audio_client *ac, 
			pbe->config.reserved =

				GET_NEXT(values, param_max_offset, rc);



			if ((pbe->config.bandpass_filter_order > 3) ||

				(pbe->config.bandpass_filter_order < 1)) {

				pr_err("%s: Invalid BPF order\n",

					__func__);

				rc = -EINVAL;

				goto invalid_config;

			}



			p_coeffs = &pbe->config.p1LowPassCoeffs[0];

			lpf_len = (pbe->config.xover_filter_order == 3) ? 10 : 5;

			hpf_len = (pbe->config.xover_filter_order == 3) ? 10 : 5;

asoc/msm-lsm-client.c

+10 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.

 */

#include <linux/init.h>

#include <linux/err.h>
@@ -2430,6 +2431,15 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
			err = -EFAULT;

			goto done;

		}



		if (temp_p_info.param_size > 0 &&

			((INT_MAX - sizeof(temp_p_info)) <

				temp_p_info.param_size)) {

			pr_err("%s: Integer overflow\n", __func__);

			err = -EINVAL;

			goto done;

		}



		size = sizeof(temp_p_info) + temp_p_info.param_size;

		p_info = kzalloc(size, GFP_KERNEL);

dsp/msm_audio_ion.c

+21 −8
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

<<<<<<< HEAD   (df9a24 dsp: q6lsm: Add check for payload buffer)

 * Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.

=======

 * Copyright (c) 2013-2019, 2020, The Linux Foundation. All rights reserved.

 *

 * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.

>>>>>>> CHANGE (b0c91b dsp: add lock in ion free to avoid use after free)

 */



#include <linux/init.h>
@@ -63,6 +69,7 @@ static void msm_audio_ion_add_allocation( 
	mutex_unlock(&(msm_audio_ion_data->list_mutex));

}



/* This function is called with ion_data list mutex lock */

static int msm_audio_dma_buf_map(struct dma_buf *dma_buf,

				 dma_addr_t *addr, size_t *len)

{
@@ -151,7 +158,6 @@ static int msm_audio_dma_buf_unmap(struct dma_buf *dma_buf) 
	 * should be explicitly acquired to avoid race condition

	 * on adding elements to the list.

	 */

	mutex_lock(&(msm_audio_ion_data.list_mutex));

	list_for_each_safe(ptr, next,

			    &(msm_audio_ion_data.alloc_list)) {
@@ -175,7 +181,6 @@ static int msm_audio_dma_buf_unmap(struct dma_buf *dma_buf) 
			break;

		}

	}

	mutex_unlock(&(msm_audio_ion_data.list_mutex));



	if (!found) {

		dev_err(cb_dev,
@@ -230,6 +235,7 @@ int msm_audio_ion_get_smmu_info(struct device **cb_dev, 
	return 0;

}



/* This function is called with ion_data list mutex lock */

static void *msm_audio_ion_map_kernel(struct dma_buf *dma_buf)

{

	int rc = 0;
@@ -278,7 +284,6 @@ static int msm_audio_ion_unmap_kernel(struct dma_buf *dma_buf) 
	 * TBD: remove the below section once new API

	 * for unmapping kernel virtual address is available.

	 */

	mutex_lock(&(msm_audio_ion_data.list_mutex));

	list_for_each_entry(alloc_data, &(msm_audio_ion_data.alloc_list),

			    list) {

		if (alloc_data->dma_buf == dma_buf) {
@@ -286,7 +291,6 @@ static int msm_audio_ion_unmap_kernel(struct dma_buf *dma_buf) 
			break;

		}

	}

	mutex_unlock(&(msm_audio_ion_data.list_mutex));



	if (!vaddr) {

		dev_err(cb_dev,
@@ -309,7 +313,8 @@ static int msm_audio_ion_unmap_kernel(struct dma_buf *dma_buf) 
	return rc;

}



static int msm_audio_ion_map_buf(struct dma_buf *dma_buf, dma_addr_t *paddr,

/* This function is called with ion_data list mutex lock */

static int msm_audio_ion_buf_map(struct dma_buf *dma_buf, dma_addr_t *paddr,

				 size_t *plen, void **vaddr)

{

	int rc = 0;
@@ -331,7 +336,10 @@ static int msm_audio_ion_map_buf(struct dma_buf *dma_buf, dma_addr_t *paddr, 
	if (IS_ERR_OR_NULL(*vaddr)) {

		pr_err("%s: ION memory mapping for AUDIO failed\n", __func__);

		rc = -ENOMEM;

		mutex_lock(&(msm_audio_ion_data.list_mutex));

		msm_audio_dma_buf_unmap(dma_buf);

		mutex_unlock(&(msm_audio_ion_data.list_mutex));



		goto err;

	}
@@ -390,7 +398,7 @@ int msm_audio_ion_alloc(struct dma_buf **dma_buf, size_t bufsz, 
		goto err;

	}



	rc = msm_audio_ion_map_buf(*dma_buf, paddr, plen, vaddr);

	rc = msm_audio_ion_buf_map(*dma_buf, paddr, plen, vaddr);

	if (rc) {

		pr_err("%s: failed to map ION buf, rc = %d\n", __func__, rc);

		goto err;
@@ -490,7 +498,7 @@ int msm_audio_ion_import(struct dma_buf **dma_buf, int fd, 
		}

	}



	rc = msm_audio_ion_map_buf(*dma_buf, paddr, plen, vaddr);

	rc = msm_audio_ion_buf_map(*dma_buf, paddr, plen, vaddr);

	if (rc) {

		pr_err("%s: failed to map ION buf, rc = %d\n", __func__, rc);

		goto err;
@@ -516,6 +524,7 @@ EXPORT_SYMBOL(msm_audio_ion_import); 
 *

 * Returns 0 on success or error on failure

 */

/* This funtion is called with ion_data list mutex lock */

int msm_audio_ion_free(struct dma_buf *dma_buf)

{

	int ret = 0;
@@ -525,11 +534,15 @@ int msm_audio_ion_free(struct dma_buf *dma_buf) 
		return -EINVAL;

	}



	mutex_lock(&(msm_audio_ion_data.list_mutex));

	ret = msm_audio_ion_unmap_kernel(dma_buf);

	if (ret)

	if (ret) {

		mutex_unlock(&(msm_audio_ion_data.list_mutex));

		return ret;

	}



	msm_audio_dma_buf_unmap(dma_buf);

	mutex_unlock(&(msm_audio_ion_data.list_mutex));



	return 0;

}

dsp/q6afe.c

+14 −0
Original line number Diff line number Diff line
@@ -9611,6 +9611,7 @@ static int afe_spv4_get_calib_data( 
	struct param_hdr_v3 param_hdr;

	int port = SLIMBUS_4_TX;

	int ret = -EINVAL;

	uint32_t th_vi_ca_state;



	if (!calib_resp) {

		pr_err("%s: Invalid params\n", __func__);
@@ -9632,6 +9633,12 @@ static int afe_spv4_get_calib_data( 
		       __func__, port, param_hdr.param_id, ret);

		goto get_params_fail;

	}

	th_vi_ca_state = this_afe.spv4_calib_data.res_cfg.th_vi_ca_state;

	if (th_vi_ca_state < FBSP_INCORRECT_OP_MODE ||

		th_vi_ca_state > MAX_FBSP_STATE) {

		pr_err("%s: invalid fbsp state %d\n", __func__, th_vi_ca_state);

		goto get_params_fail;

	}

	memcpy(&calib_resp->res_cfg, &this_afe.spv4_calib_data.res_cfg,

		sizeof(this_afe.calib_data.res_cfg));

	pr_info("%s: state %s resistance %d %d\n", __func__,
@@ -9650,6 +9657,7 @@ int afe_spk_prot_get_calib_data(struct afe_spkr_prot_get_vi_calib *calib_resp) 
	struct param_hdr_v3 param_hdr;

	int port = SLIMBUS_4_TX;

	int ret = -EINVAL;

	uint32_t th_vi_ca_state;



	if (!calib_resp) {

		pr_err("%s: Invalid params\n", __func__);
@@ -9671,6 +9679,12 @@ int afe_spk_prot_get_calib_data(struct afe_spkr_prot_get_vi_calib *calib_resp) 
		       __func__, port, param_hdr.param_id, ret);

		goto get_params_fail;

	}

	th_vi_ca_state = this_afe.calib_data.res_cfg.th_vi_ca_state;

	if (th_vi_ca_state < FBSP_INCORRECT_OP_MODE ||

		th_vi_ca_state > MAX_FBSP_STATE) {

		pr_err("%s: invalid fbsp state %d\n", __func__, th_vi_ca_state);

		goto get_params_fail;

	}

	memcpy(&calib_resp->res_cfg, &this_afe.calib_data.res_cfg,

		sizeof(this_afe.calib_data.res_cfg));

	pr_info("%s: state %s resistance %d %d\n", __func__,

dsp/q6asm.c

+10 −1
Original line number Diff line number Diff line
@@ -2405,7 +2405,16 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
				__func__, data->payload_size);

		break;

	case ASM_SESSION_CMDRSP_GET_MTMX_STRTR_PARAMS_V2:

		q6asm_process_mtmx_get_param_rsp(ac, (void *) payload);

		payload_size = sizeof(struct asm_mtmx_strtr_get_params_cmdrsp);

		if (data->payload_size < payload_size) {

			pr_err("%s: insufficient payload size = %d\n",

				__func__, data->payload_size);

			spin_unlock_irqrestore(

				&(session[session_id].session_lock), flags);

			return -EINVAL;

		}

		q6asm_process_mtmx_get_param_rsp(ac,

			(struct asm_mtmx_strtr_get_params_cmdrsp *) payload);

		break;

	case ASM_STREAM_PP_EVENT:

	case ASM_STREAM_CMD_ENCDEC_EVENTS: