Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 176f0d25 authored by Amit Shekhar's avatar Amit Shekhar
Browse files

ASoC: msm: qdsp6v2: Fix bit alignment in snd_codec params 



Pointer member variables in snd_codec params break bit alignment and
causes data corruption. By changing these pointers to fixed size
array variables, the bit alignment is rectified. The size has been
set to max possible size. Also, remove params which are not required
anymore.

Change-Id: Ib87bbeb07b0df1ce8a81166b319976fe54c0f013
Signed-off-by: default avatarAmit Shekhar <ashekhar@codeaurora.org>
parent 6eb2af6d

include/uapi/sound/compress_params.h

+0 −8
Original line number Diff line number Diff line
@@ -337,13 +337,8 @@ struct snd_enc_generic { 
	__u32 bw;	/* encoder bandwidth */

	__s32 reserved[15];

};

struct snd_dec_dts {

	__u32 modelIdLength;

	__u8 *modelId;

};

struct snd_dec_ddp {

	__u32 params_length;

	__u8 *params;

	__u32 params_id[18];

	__u32 params_value[18];

};
@@ -360,7 +355,6 @@ union snd_codec_options { 
	struct snd_enc_real real;

	struct snd_enc_flac flac;

	struct snd_enc_generic generic;

	struct snd_dec_dts dts;

	struct snd_dec_ddp ddp;

	struct snd_dec_flac flac_dec;

};
@@ -436,8 +430,6 @@ struct snd_codec { 
	__u32 ch_mode;

	__u32 format;

	__u32 align;

	__u32 transcode_dts;

	struct snd_dec_dts dts;

	union snd_codec_options options;

	__u32 reserved[3];

};

sound/soc/msm/qdsp6v2/msm-compr-q6-v2.c

+0 −23
Original line number Diff line number Diff line
@@ -1052,10 +1052,6 @@ static int msm_compr_ioctl_shared(struct snd_pcm_substream *substream, 
			}

			pr_debug("SND_AUDIOCODEC_AC3\n");

			compr->codec = FORMAT_AC3;

			if (copy_from_user(params_value, (void *)ddp->params,

					params_length))

				pr_err("%s: copy ddp params value, size=%d\n",

					__func__, params_length);

			pr_debug("params_length: %d\n", ddp->params_length);

			for (i = 0; i < params_length/sizeof(int); i++)

				pr_debug("params_value[%d]: %x\n", i,
@@ -1095,10 +1091,6 @@ static int msm_compr_ioctl_shared(struct snd_pcm_substream *substream, 
			}

			pr_debug("SND_AUDIOCODEC_EAC3\n");

			compr->codec = FORMAT_EAC3;

			if (copy_from_user(params_value, (void *)ddp->params,

					params_length))

				pr_err("%s: copy ddp params value, size=%d\n",

					__func__, params_length);

			pr_debug("params_length: %d\n", ddp->params_length);

			for (i = 0; i < ddp->params_length; i++)

				pr_debug("params_value[%d]: %x\n", i,
@@ -1211,13 +1203,8 @@ struct snd_enc_generic32 { 
	u32 bw;	/* encoder bandwidth */

	s32 reserved[15];

};

struct snd_dec_dts32 {

	u32 modelIdLength;

	compat_uptr_t modelId;

};

struct snd_dec_ddp32 {

	u32 params_length;

	compat_uptr_t params;

	u32 params_id[18];

	u32 params_value[18];

};
@@ -1228,7 +1215,6 @@ union snd_codec_options32 { 
	struct snd_enc_real32 real;

	struct snd_enc_flac32 flac;

	struct snd_enc_generic32 generic;

	struct snd_dec_dts32 dts;

	struct snd_dec_ddp32 ddp;

};
@@ -1244,8 +1230,6 @@ struct snd_codec32 { 
	u32 ch_mode;

	u32 format;

	u32 align;

	u32 transcode_dts;

	struct snd_dec_dts32 dts;

	union snd_codec_options32 options;

	u32 reserved[3];

};
@@ -1372,7 +1356,6 @@ static int msm_compr_compat_ioctl(struct snd_pcm_substream *substream, 
		params.codec.ch_mode = params32.codec.ch_mode;

		params.codec.format = params32.codec.format;

		params.codec.align = params32.codec.align;

		params.codec.transcode_dts = params32.codec.transcode_dts;



		switch (params.codec.id) {

		case SND_AUDIOCODEC_WMA:
@@ -1415,17 +1398,11 @@ static int msm_compr_compat_ioctl(struct snd_pcm_substream *substream, 
		case SND_AUDIOCODEC_DTS_LBR:

		case SND_AUDIOCODEC_DTS_LBR_PASS_THROUGH:

		case SND_AUDIOCODEC_DTS_TRANSCODE_LOOPBACK:

			params.codec.options.dts.modelIdLength =

			params32.codec.options.dts.modelIdLength;

			params.codec.options.dts.modelId =

			compat_ptr(params32.codec.options.dts.modelId);

		break;

		case SND_AUDIOCODEC_AC3:

		case SND_AUDIOCODEC_EAC3:

			params.codec.options.ddp.params_length =

			params32.codec.options.ddp.params_length;

			params.codec.options.ddp.params =

			compat_ptr(params32.codec.options.ddp.params);

			memcpy(params.codec.options.ddp.params_value,

			params32.codec.options.ddp.params_value,

			sizeof(params32.codec.options.ddp.params_value));