Merge "dsp: afe: check for payload size before payload access" (744acb85) · Commits · e / devices / android_kernel_sony_msm8998

sound/soc/msm/qdsp6v2/q6afe.c

+22 −7

Original line number	Diff line number	Diff line
		@@ -554,6 +554,7 @@ static int32_t afe_callback(struct apr_client_data data, void priv)
		data->opcode == AFE_PORT_CMDRSP_GET_PARAM_V3) {
		uint32_t *payload = data->payload;
		uint32_t param_id;
		uint32_t param_id_pos = 0;

		if (!payload \|\| (data->token >= AFE_MAX_PORTS)) {
		pr_err("%s: Error: size %d payload %pK token %d\n",
		@@ -562,17 +563,26 @@ static int32_t afe_callback(struct apr_client_data data, void priv)
		return -EINVAL;
		}

		param_id = (data->opcode == AFE_PORT_CMDRSP_GET_PARAM_V3) ?
		payload[3] :
		payload[2];
		if (param_id == AFE_PARAM_ID_DEV_TIMING_STATS) {
		av_dev_drift_afe_cb_handler(data->opcode, data->payload,
		data->payload_size);
		} else {
		if (rtac_make_afe_callback(data->payload,
		data->payload_size))
		return 0;

		if (data->opcode == AFE_PORT_CMDRSP_GET_PARAM_V3)
		param_id_pos = 4;
		else
		param_id_pos = 3;

		if (data->payload_size >= param_id_pos * sizeof(uint32_t))
		param_id = payload[param_id_pos - 1];
		else {
		pr_err("%s: Error: size %d is less than expected\n",
		__func__, data->payload_size);
		return -EINVAL;
		}
		if (param_id == AFE_PARAM_ID_DEV_TIMING_STATS) {
		av_dev_drift_afe_cb_handler(data->opcode, data->payload,
		data->payload_size);
		} else {
		if (sp_make_afe_callback(data->opcode, data->payload,
		data->payload_size))
		return -EINVAL;
		@@ -595,6 +605,11 @@ static int32_t afe_callback(struct apr_client_data data, void priv)
		uint16_t port_id = 0;
		payload = data->payload;
		if (data->opcode == APR_BASIC_RSP_RESULT) {
		if (data->payload_size < (2 * sizeof(uint32_t))) {
		pr_err("%s: Error: size %d is less than expected\n",
		__func__, data->payload_size);
		return -EINVAL;
		}
		pr_debug("%s:opcode = 0x%x cmd = 0x%x status = 0x%x token=%d\n",
		__func__, data->opcode,
		payload[0], payload[1], data->token);