Merge "rtac: add size check when reading cal data kvaddr buffer" (88f238f1) · Commits · e / devices / android_kernel_sony_msm8998

sound/soc/msm/qdsp6v2/rtac.c

+32 −0

Original line number	Diff line number	Diff line
		@@ -901,6 +901,14 @@ int send_adm_apr(void *buf, u32 opcode)
		bytes_returned = ((u32 *)rtac_cal[ADM_RTAC_CAL].cal_data.
		kvaddr)[2] + 3 * sizeof(u32);

		if (bytes_returned > rtac_cal[ADM_RTAC_CAL].
		map_data.map_size) {
		pr_err("%s: Invalid data size = %d\n",
		__func__, bytes_returned);
		result = -EINVAL;
		goto err;
		}

		if (bytes_returned > user_buf_size) {
		pr_err("%s: User buf not big enough, size = 0x%x, returned size = 0x%x\n",
		__func__, user_buf_size, bytes_returned);
		@@ -1123,6 +1131,14 @@ int send_rtac_asm_apr(void *buf, u32 opcode)
		bytes_returned = ((u32 *)rtac_cal[ASM_RTAC_CAL].cal_data.
		kvaddr)[2] + 3 * sizeof(u32);

		if (bytes_returned > rtac_cal[ASM_RTAC_CAL].
		map_data.map_size) {
		pr_err("%s: Invalid data size = %d\n",
		__func__, bytes_returned);
		result = -EINVAL;
		goto err;
		}

		if (bytes_returned > user_buf_size) {
		pr_err("%s: User buf not big enough, size = 0x%x, returned size = 0x%x\n",
		__func__, user_buf_size, bytes_returned);
		@@ -1382,6 +1398,14 @@ static int send_rtac_afe_apr(void *buf, uint32_t opcode)
		bytes_returned = get_resp->param_size +
		sizeof(struct afe_port_param_data_v2);

		if (bytes_returned > rtac_cal[AFE_RTAC_CAL].
		map_data.map_size) {
		pr_err("%s: Invalid data size = %d\n",
		__func__, bytes_returned);
		result = -EINVAL;
		goto err;
		}

		if (bytes_returned > user_afe_buf.buf_size) {
		pr_err("%s: user size = 0x%x, returned size = 0x%x\n",
		__func__, user_afe_buf.buf_size,
		@@ -1606,6 +1630,14 @@ int send_voice_apr(u32 mode, void *buf, u32 opcode)
		bytes_returned = ((u32 *)rtac_cal[VOICE_RTAC_CAL].cal_data.
		kvaddr)[2] + 3 * sizeof(u32);

		if (bytes_returned > rtac_cal[VOICE_RTAC_CAL].
		map_data.map_size) {
		pr_err("%s: Invalid data size = %d\n",
		__func__, bytes_returned);
		result = -EINVAL;
		goto err;
		}

		if (bytes_returned > user_buf_size) {
		pr_err("%s: User buf not big enough, size = 0x%x, returned size = 0x%x\n",
		__func__, user_buf_size, bytes_returned);