Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 108157a5 authored by Vignesh Kulothungan's avatar Vignesh Kulothungan Committed by Gerrit - the friendly Code Review server
Browse files

msm: asm: validate ADSP data before access 



Validate buffer index obtained from ADSP token before using it.

CRs-Fixed: 2372302
Change-Id: I5c3b1634bd08b516844638dd67f726a882edfc17
Signed-off-by: default avatarVignesh Kulothungan <vigneshk@codeaurora.org>
parent 90059640

sound/soc/msm/qdsp6v2/q6asm.c

+22 −0
Original line number Diff line number Diff line
@@ -1962,6 +1962,7 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
		data->dest_port);

	if ((data->opcode != ASM_DATA_EVENT_RENDERED_EOS) &&

	    (data->opcode != ASM_DATA_EVENT_EOS) &&

	    (data->opcode != ASM_SESSION_EVENTX_OVERFLOW) &&

	    (data->opcode != ASM_SESSION_EVENT_RX_UNDERFLOW)) {

		if (payload == NULL) {

			pr_err("%s: payload is null\n", __func__);
@@ -2177,6 +2178,17 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
			}

			spin_lock_irqsave(&port->dsp_lock, dsp_flags);

			buf_index = asm_token._token.buf_index;

			if (buf_index < 0 ||

					buf_index >= port->max_buf_cnt) {

				pr_debug("%s: Invalid buffer index %u\n",

				__func__, buf_index);

				spin_unlock_irqrestore(&port->dsp_lock,

								dsp_flags);

				spin_unlock_irqrestore(

					&(session[session_id].session_lock),

					flags);

				return -EINVAL;

			}

			if (data->payload_size >= 2 * sizeof(uint32_t) &&

				(lower_32_bits(port->buf[buf_index].phys) !=

				payload[0] ||
@@ -2287,6 +2299,16 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
			}

			spin_lock_irqsave(&port->dsp_lock, dsp_flags);

			buf_index = asm_token._token.buf_index;

			if (buf_index < 0 || buf_index >= port->max_buf_cnt) {

				pr_debug("%s: Invalid buffer index %u\n",

				__func__, buf_index);

				spin_unlock_irqrestore(&port->dsp_lock,

								dsp_flags);

				spin_unlock_irqrestore(

					&(session[session_id].session_lock),

					flags);

				return -EINVAL;

			}

			port->buf[buf_index].used = 0;

			if (lower_32_bits(port->buf[buf_index].phys) !=

			payload[READDONE_IDX_BUFADD_LSW] ||