Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7289a6a5 authored by Xiaojun Sang's avatar Xiaojun Sang Committed by Gerrit - the friendly Code Review server
Browse files

dsp: validate token before usage as array index 



Token from DSP might be invalid for array index. Validate the
token before being used as array index.

Change-Id: I9f47e1328d75d9f9acf7e85ddb452019b6eced0a
Signed-off-by: default avatarXiaojun Sang <xsang@codeaurora.org>
parent 8bc8a30b

sound/soc/msm/qdsp6v2/q6afe.c

+26 −5
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -482,6 +482,15 @@ static int32_t afe_lpass_resources_callback(struct apr_client_data *data) 
	return 0;

}



static bool afe_token_is_valid(uint32_t token)

{

	if (token >= AFE_MAX_PORTS) {

		pr_err("%s: token %d is invalid.\n", __func__, token);

		return false;

	}

	return true;

}



static int32_t afe_callback(struct apr_client_data *data, void *priv)

{

	if (!data) {
@@ -574,7 +583,10 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv) 


		ret = afe_lpass_resources_callback(data);

		atomic_set(&this_afe.state, 0);

		if (afe_token_is_valid(data->token))

			wake_up(&this_afe.wait[data->token]);

		else

			return -EINVAL;

		if (!ret) {

			return ret;

		}
@@ -610,7 +622,10 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv) 
			case AFE_SVC_CMD_SET_PARAM_V2:

			case AFE_CMD_REQUEST_LPASS_RESOURCES:

				atomic_set(&this_afe.state, 0);

				if (afe_token_is_valid(data->token))

					wake_up(&this_afe.wait[data->token]);

				else

					return -EINVAL;

				break;

			case AFE_SERVICE_CMD_REGISTER_RT_PORT_DRIVER:

				break;
@@ -622,7 +637,10 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv) 
				break;

			case AFE_CMD_ADD_TOPOLOGIES:

				atomic_set(&this_afe.state, 0);

				if (afe_token_is_valid(data->token))

					wake_up(&this_afe.wait[data->token]);

				else

					return -EINVAL;

				pr_debug("%s: AFE_CMD_ADD_TOPOLOGIES cmd 0x%x\n",

						__func__, payload[1]);

				break;
@@ -678,7 +696,10 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv) 
			else

				this_afe.mmap_handle = payload[0];

			atomic_set(&this_afe.state, 0);

			if (afe_token_is_valid(data->token))

				wake_up(&this_afe.wait[data->token]);

			else

				return -EINVAL;

		} else if (data->opcode == AFE_EVENT_RT_PROXY_PORT_STATUS) {

			port_id = (uint16_t)(0x0000FFFF & payload[0]);

		}