Merge "drivers: soc: qcom: Add overflow check in ADM driver" (59656208) · Commits · e / devices / android_kernel_sony_msm8998

sound/soc/msm/qdsp6v2/q6adm.c

+13 −3

Original line number	Diff line number	Diff line
		/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -978,9 +978,10 @@ int adm_get_params_v2(int port_id, int copp_idx, uint32_t module_id,
		char *params, uint32_t client_id)
		{
		struct adm_cmd_get_pp_params_v5 *adm_params = NULL;
		int sz, rc = 0, i = 0;
		int rc = 0, i = 0;
		int port_idx, idx;
		int params_data = (int )params;
		uint64_t sz = 0;

		port_id = afe_convert_virtual_to_portid(port_id);
		port_idx = adm_validate_and_get_port_index(port_id);
		@@ -989,7 +990,16 @@ int adm_get_params_v2(int port_id, int copp_idx, uint32_t module_id,
		return -EINVAL;
		}

		sz = sizeof(struct adm_cmd_get_pp_params_v5) + params_length;
		sz = (uint64_t)sizeof(struct adm_cmd_get_pp_params_v5) +
		(uint64_t)params_length;
		/*
		* Check if the value of "sz" (which is ultimately assigned to
		* "hdr.pkt_size") crosses U16_MAX.
		*/
		if (sz > U16_MAX) {
		pr_err("%s: Invalid params_length\n", __func__);
		return -EINVAL;
		}
		adm_params = kzalloc(sz, GFP_KERNEL);
		if (!adm_params) {
		pr_err("%s: adm params memory alloc failed", __func__);