Merge ac5c8f457b8961d56d15075d9a5bfa729606757e on remote branch (f9a425cb) · Commits · e / devices / android_kernel_oneplus_sm7250

asoc/msm-lsm-client.c

+10 −0

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/*
		* Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
		* Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
		*/
		#include <linux/init.h>
		#include <linux/err.h>
		@@ -2425,6 +2426,15 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream,
		err = -EFAULT;
		goto done;
		}

		if (temp_p_info.param_size > 0 &&
		((INT_MAX - sizeof(temp_p_info)) <
		temp_p_info.param_size)) {
		pr_err("%s: Integer overflow\n", __func__);
		err = -EINVAL;
		goto done;
		}

		size = sizeof(temp_p_info) + temp_p_info.param_size;
		p_info = kzalloc(size, GFP_KERNEL);

+3 −0

Original line number	Diff line number	Diff line
		@@ -475,6 +475,8 @@ static int32_t aprv2_core_fn_q(struct apr_client_data data, void priv)
		case AVCS_CMD_RSP_LOAD_MODULES:
		pr_debug("%s: Received AVCS_CMD_RSP_LOAD_MODULES\n",
		__func__);
		if (!rsp_payload)
		return -EINVAL;
		if (data->payload_size != ((sizeof(struct avcs_load_unload_modules_sec_payload)
		* rsp_payload->num_modules) + sizeof(uint32_t))) {
		pr_err("%s: payload size greater than expected size %d\n",
		@@ -1099,6 +1101,7 @@ int32_t q6core_avcs_load_unload_modules(struct avcs_load_unload_modules_payload
		done:
		kfree(mod);
		kfree(rsp_payload);
		rsp_payload = NULL;
		mutex_unlock(&(q6core_lcl.cmd_lock));
		return ret;
		}