Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 287879c3 authored by Karthik Reddy Katta's avatar Karthik Reddy Katta Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: Add Buffer overflow check 



The overflow check is required to ensure that user space data
in kernel may not go beyond buffer boundary.

CRs-Fixed: 1064411
Change-Id: I54c28a8942cf1a6a47a4e8272f3159b35d753ead
Signed-off-by: default avatarKarthik Reddy Katta <a_katta@codeaurora.org>
parent 2590d5fa

drivers/misc/qcom/qdsp6v2/audio_utils.c

+14 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2010-2015, The Linux Foundation. All rights reserved.

/* Copyright (c) 2010-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -24,6 +24,15 @@ 
#include <asm/ioctls.h>

#include "audio_utils.h"



/*

 * Define maximum buffer size. Below values are chosen considering the higher

 * values used among all native drivers.

 */

#define MAX_FRAME_SIZE	1536

#define MAX_FRAMES	5

#define META_SIZE	(sizeof(struct meta_out_dsp))

#define MAX_BUFFER_SIZE	(1 + ((MAX_FRAME_SIZE + META_SIZE) * MAX_FRAMES))



static int audio_in_pause(struct q6audio_in  *audio)

{

	int rc;
@@ -329,6 +338,10 @@ long audio_in_ioctl(struct file *file, 
			rc = -EINVAL;

			break;

		}

		if (cfg.buffer_size > MAX_BUFFER_SIZE) {

			rc = -EINVAL;

			break;

		}

		audio->str_cfg.buffer_size = cfg.buffer_size;

		audio->str_cfg.buffer_count = cfg.buffer_count;

		if (audio->opened) {

include/sound/q6asm-v2.h

+1 −1
Original line number Diff line number Diff line
@@ -226,7 +226,7 @@ struct audio_client *q6asm_get_audio_client(int session_id); 
int q6asm_audio_client_buf_alloc(unsigned int dir/* 1:Out,0:In */,

				struct audio_client *ac,

				unsigned int bufsz,

				unsigned int bufcnt);

				uint32_t bufcnt);

int q6asm_audio_client_buf_alloc_contiguous(unsigned int dir

				/* 1:Out,0:In */,

				struct audio_client *ac,

sound/soc/msm/qdsp6v2/q6asm.c

+2 −2
Original line number Diff line number Diff line
@@ -1195,7 +1195,7 @@ err: 
int q6asm_audio_client_buf_alloc(unsigned int dir,

			struct audio_client *ac,

			unsigned int bufsz,

			unsigned int bufcnt)

			uint32_t bufcnt)

{

	int cnt = 0;

	int rc = 0;
@@ -1222,7 +1222,7 @@ int q6asm_audio_client_buf_alloc(unsigned int dir, 
			return 0;

		}

		mutex_lock(&ac->cmd_lock);

		if (bufcnt > (LONG_MAX/sizeof(struct audio_buffer))) {

		if (bufcnt > (U32_MAX/sizeof(struct audio_buffer))) {

			pr_err("%s: Buffer size overflows", __func__);

			mutex_unlock(&ac->cmd_lock);

			goto fail;