Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 050fcfa2 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "Asoc: msm: qdsp6v2: Fix Out-of-bounds memory access in adm_get_params_v2"

parents 1a40ab74 ddce1761

sound/soc/msm/qdsp6v2/msm-dolby-dap-config.c

+3 −4
Original line number Diff line number Diff line 
/* Copyright (c) 2013-2014, 2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2013-2014,2016-2017, The Linux Foundation. All rights reserved.

* This program is free software; you can redistribute it and/or modify

* it under the terms of the GNU General Public License version 2 and

* only version 2 as published by the Free Software Foundation.
@@ -803,7 +803,7 @@ int msm_dolby_dap_param_to_get_control_get(struct snd_kcontrol *kcontrol, 
			 __func__, copp_idx);

		return -EINVAL;

	}

	params_value = kzalloc(params_length, GFP_KERNEL);

	params_value = kzalloc(params_length + param_payload_len, GFP_KERNEL);

	if (!params_value) {

		pr_err("%s, params memory alloc failed\n", __func__);

		return -ENOMEM;
@@ -822,8 +822,7 @@ int msm_dolby_dap_param_to_get_control_get(struct snd_kcontrol *kcontrol, 
			pr_err("%s: invalid param id to set", __func__);

			rc = -EINVAL;

		} else {

			params_length = (dolby_dap_params_length[i] +

						DOLBY_PARAM_PAYLOAD_SIZE) *

			params_length = dolby_dap_params_length[i] *

						sizeof(uint32_t);

			rc = adm_get_params(port_id, copp_idx,

					    DOLBY_BUNDLE_MODULE_ID,

sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c

+2 −1
Original line number Diff line number Diff line
@@ -198,7 +198,8 @@ static void msm_ds2_dap_check_and_update_ramp_wait(int port_id, int copp_idx, 
	uint32_t param_payload_len = PARAM_PAYLOAD_SIZE * sizeof(uint32_t);

	int rc = 0;



	update_params_value = kzalloc(params_length, GFP_KERNEL);

	update_params_value = kzalloc(params_length + param_payload_len,

				      GFP_KERNEL);

	if (!update_params_value) {

		pr_err("%s: params memory alloc failed\n", __func__);

		goto end;

sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c

+1 −1
Original line number Diff line number Diff line
@@ -7945,7 +7945,7 @@ int msm_routing_get_rms_value_control(struct snd_kcontrol *kcontrol, 
	int *update_param_value;

	uint32_t param_length = sizeof(uint32_t);

	uint32_t param_payload_len = RMS_PAYLOAD_LEN * sizeof(uint32_t);

	param_value = kzalloc(param_length, GFP_KERNEL);

	param_value = kzalloc(param_length + param_payload_len, GFP_KERNEL);

	if (!param_value) {

		pr_err("%s, param memory alloc failed\n", __func__);

		return -ENOMEM;

sound/soc/msm/qdsp6v2/msm-qti-pp-config.c

+2 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -345,7 +345,7 @@ static int msm_qti_pp_get_rms_value_control(struct snd_kcontrol *kcontrol, 
	uint32_t param_length = sizeof(uint32_t);

	uint32_t param_payload_len = RMS_PAYLOAD_LEN * sizeof(uint32_t);

	struct msm_pcm_routing_bdai_data msm_bedai;

	param_value = kzalloc(param_length, GFP_KERNEL);

	param_value = kzalloc(param_length + param_payload_len, GFP_KERNEL);

	if (!param_value) {

		pr_err("%s, param memory alloc failed\n", __func__);

		return -ENOMEM;