Merge "ASoC: msm: qdsp6v2: Fix out-of-bounds access in put functions" (9bf671bc) · Commits · e / devices / android_kernel_sony_msm8998

sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c

+15 −0

Original line number	Diff line number	Diff line
		@@ -1860,6 +1860,11 @@ static int msm_routing_lsm_mux_put(struct snd_kcontrol *kcontrol,
		int lsm_port = AFE_PORT_ID_SLIMBUS_MULTI_CHAN_5_TX;
		struct snd_soc_dapm_update *update = NULL;

		if (mux >= e->items) {
		pr_err("%s: Invalid mux value %d\n", __func__, mux);
		return -EINVAL;
		}

		pr_debug("%s: LSM enable %ld\n", __func__,
		ucontrol->value.integer.value[0]);
		switch (ucontrol->value.integer.value[0]) {
		@@ -2183,6 +2188,11 @@ static int msm_routing_ec_ref_rx_put(struct snd_kcontrol *kcontrol,
		struct soc_enum e = (struct soc_enum )kcontrol->private_value;
		struct snd_soc_dapm_update *update = NULL;

		if (mux >= e->items) {
		pr_err("%s: Invalid mux value %d\n", __func__, mux);
		return -EINVAL;
		}

		mutex_lock(&routing_lock);
		switch (ucontrol->value.integer.value[0]) {
		case 0:
		@@ -2379,6 +2389,11 @@ static int msm_routing_ext_ec_put(struct snd_kcontrol *kcontrol,
		uint16_t ext_ec_ref_port_id;
		struct snd_soc_dapm_update *update = NULL;

		if (mux >= e->items) {
		pr_err("%s: Invalid mux value %d\n", __func__, mux);
		return -EINVAL;
		}

		mutex_lock(&routing_lock);
		msm_route_ext_ec_ref = ucontrol->value.integer.value[0];