Merge "dsp: asm: validate ADSP data size before access" (e848e37c) · Commits · e / devices / android_kernel_oneplus_sm7250

dsp/q6asm.c

+23 −2

Original line number	Diff line number	Diff line
		@@ -1950,9 +1950,10 @@ static int32_t q6asm_callback(struct apr_client_data data, void priv)
		data->dest_port);
		if ((data->opcode != ASM_DATA_EVENT_RENDERED_EOS) &&
		(data->opcode != ASM_DATA_EVENT_EOS) &&
		(data->opcode != ASM_SESSION_EVENTX_OVERFLOW) &&
		(data->opcode != ASM_SESSION_EVENT_RX_UNDERFLOW)) {
		if (payload == NULL) {
		pr_err("%s: payload is null\n", __func__);
		if (payload == NULL \|\| (data->payload_size < (2 * sizeof(uint32_t)))) {
		pr_err("%s: payload is null or invalid size[%d]\n", __func__, data->payload_size);
		spin_unlock_irqrestore(
		&(session[session_id].session_lock), flags);
		return -EINVAL;
		@@ -2165,6 +2166,16 @@ static int32_t q6asm_callback(struct apr_client_data data, void priv)
		}
		spin_lock_irqsave(&port->dsp_lock, dsp_flags);
		buf_index = asm_token._token.buf_index;
		if (buf_index < 0 \|\| buf_index >= port->max_buf_cnt) {
		pr_debug("%s: Invalid buffer index %u\n",
		__func__, buf_index);
		spin_unlock_irqrestore(&port->dsp_lock,
		dsp_flags);
		spin_unlock_irqrestore(
		&(session[session_id].session_lock),
		flags);
		return -EINVAL;
		}
		if ( data->payload_size >= 2 * sizeof(uint32_t) &&
		(lower_32_bits(port->buf[buf_index].phys) !=
		payload[0] \|\|
		@@ -2267,6 +2278,16 @@ static int32_t q6asm_callback(struct apr_client_data data, void priv)
		}
		spin_lock_irqsave(&port->dsp_lock, dsp_flags);
		buf_index = asm_token._token.buf_index;
		if (buf_index < 0 \|\| buf_index >= port->max_buf_cnt) {
		pr_debug("%s: Invalid buffer index %u\n",
		__func__, buf_index);
		spin_unlock_irqrestore(&port->dsp_lock,
		dsp_flags);
		spin_unlock_irqrestore(
		&(session[session_id].session_lock),
		flags);
		return -EINVAL;
		}
		port->buf[buf_index].used = 0;
		if (lower_32_bits(port->buf[buf_index].phys) !=
		payload[READDONE_IDX_BUFADD_LSW] \|\|