Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

This project is archived. Its data is read-only.

Commit 2f9678cd authored Mar 21, 2014 by Aravind Kumar

ASoC: wcdxxxx: Add check for buffer overflow



Current code does not check if the indexes of array
codec_dai being accessed is within the maximum
number of codec dais for a particular codec. The change
adds this check and ensures that indexes outside the
bounds of array are not accessed.

CRs-Fixed: 628865
Change-Id: Ibf81f91b35e43feddc6b03a1239b4d12e04a95da
Signed-off-by: Aravind Kumar <akumark@codeaurora.org>

parent b5c75c4d

drivers/mfd/wcd9xxx-slimslave.c

+20 −12

Original line number	Diff line number	Diff line
		@@ -499,7 +499,8 @@ EXPORT_SYMBOL_GPL(wcd9xxx_rx_vport_validation);

		/* This function is called with mutex acquired */
		int wcd9xxx_tx_vport_validation(u32 table, u32 port_id,
		struct wcd9xxx_codec_dai_data *codec_dai)
		struct wcd9xxx_codec_dai_data *codec_dai,
		u32 num_codec_dais)
		{
		struct wcd9xxx_ch *ch;
		int ret = 0;
		@@ -510,11 +511,13 @@ int wcd9xxx_tx_vport_validation(u32 table, u32 port_id,
		pr_debug("%s: vtable 0x%lx port_id %u size %d\n", __func__,
		vtable, port_id, size);
		for_each_set_bit(index, &vtable, size) {
		if (index < num_codec_dais) {
		list_for_each_entry(ch,
		&codec_dai[index].wcd9xxx_ch_list,
		list) {
		pr_debug("%s: index %u ch->port %u vtable 0x%lx\n",
		__func__, index, ch->port, vtable);
		__func__, index, ch->port,
		vtable);
		if (ch->port == port_id) {
		pr_err("%s: TX%u is used by AIF%u_CAP Mixer\n",
		__func__, port_id + 1,
		@@ -523,6 +526,11 @@ int wcd9xxx_tx_vport_validation(u32 table, u32 port_id,
		break;
		}
		}
		} else {
		pr_err("%s: Invalid index %d of codec dai",
		__func__, index);
		ret = -EINVAL;
		}
		if (ret)
		break;
		}

include/linux/mfd/wcd9xxx/wcd9xxx-slimslave.h

+3 −2

Original line number	Diff line number	Diff line
		/* Copyright (c) 2012, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -112,5 +112,6 @@ int wcd9xxx_disconnect_port(struct wcd9xxx *wcd9xxx,
		int wcd9xxx_rx_vport_validation(u32 port_id,
		struct list_head *codec_dai_list);
		int wcd9xxx_tx_vport_validation(u32 vtable, u32 port_id,
		struct wcd9xxx_codec_dai_data *codec_dai);
		struct wcd9xxx_codec_dai_data *codec_dai,
		u32 num_codec_dais);
		#endif /* __WCD9310_SLIMSLAVE_H_ */

sound/soc/codecs/wcd9306.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1696,7 +1696,7 @@ static int slim_tx_mixer_put(struct snd_kcontrol *kcontrol,
		if (wcd9xxx_tx_vport_validation(
		vtable,
		port_id,
		tapan_p->dai)) {
		tapan_p->dai, NUM_CODEC_DAIS)) {
		dev_dbg(codec->dev, "%s: TX%u is used by other virtual port\n",
		__func__, port_id + 1);
		mutex_unlock(&codec->mutex);

sound/soc/codecs/wcd9310.c

+2 −2

Original line number	Diff line number	Diff line
		/* Copyright (c) 2011-2013, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2011-2014, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -2032,7 +2032,7 @@ static int slim_tx_mixer_put(struct snd_kcontrol *kcontrol,
		if (wcd9xxx_tx_vport_validation(
		vtable,
		port_id,
		tabla_p->dai)) {
		tabla_p->dai, NUM_CODEC_DAIS)) {
		dev_dbg(codec->dev, "%s: TX%u is used by other virtual port\n",
		__func__, port_id + 1);
		mutex_unlock(&codec->mutex);

sound/soc/codecs/wcd9320.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2194,7 +2194,7 @@ static int slim_tx_mixer_put(struct snd_kcontrol *kcontrol,
		if (wcd9xxx_tx_vport_validation(
		vtable,
		port_id,
		taiko_p->dai)) {
		taiko_p->dai, NUM_CODEC_DAIS)) {
		dev_dbg(codec->dev, "%s: TX%u is used by other virtual port\n",
		__func__, port_id + 1);
		mutex_unlock(&codec->mutex);