Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b73e6b6b authored by Siena Richard's avatar Siena Richard Committed by Gerrit - the friendly Code Review server
Browse files

drivers: soc: add size checks and update log messages 



Add size checks to validate minimum size is met. Update log messages
to include only relevant information to ensure logs are accurate and
useful.

Change-Id: Idf76a7d964ec6989a0474d49895e54103f17938b
CRs-fixed: 1073129
Signed-off-by: default avatarSiena Richard <sienar@codeaurora.org>
parent 64120cd2

drivers/soc/qcom/qdsp6v2/voice_svc.c

+38 −19
Original line number Original line Diff line number Diff line
@@ -223,8 +223,8 @@ static int voice_svc_send_req(struct voice_svc_cmd_request *apr_request, 
	} else if (!strcmp(apr_request->svc_name, VOICE_SVC_MVM_STR)) {

	} else if (!strcmp(apr_request->svc_name, VOICE_SVC_MVM_STR)) {

		apr_handle = prtd->apr_q6_mvm;

		apr_handle = prtd->apr_q6_mvm;

	} else {

	} else {

		pr_err("%s: Invalid service %s\n", __func__,

		pr_err("%s: Invalid service %.*s\n", __func__,

			apr_request->svc_name);

			MAX_APR_SERVICE_NAME_LEN, apr_request->svc_name);





		ret = -EINVAL;

		ret = -EINVAL;

		goto done;

		goto done;
@@ -338,8 +338,8 @@ static int process_reg_cmd(struct voice_svc_register *apr_reg_svc, 
		svc = VOICE_SVC_CVS_STR;

		svc = VOICE_SVC_CVS_STR;

		handle = &prtd->apr_q6_cvs;

		handle = &prtd->apr_q6_cvs;

	} else {

	} else {

		pr_err("%s: Invalid Service: %s\n", __func__,

		pr_err("%s: Invalid Service: %.*s\n", __func__,

		       apr_reg_svc->svc_name);

			MAX_APR_SERVICE_NAME_LEN, apr_reg_svc->svc_name);

		ret = -EINVAL;

		ret = -EINVAL;

		goto done;

		goto done;

	}

	}
@@ -365,7 +365,17 @@ static ssize_t voice_svc_write(struct file *file, const char __user *buf, 




	pr_debug("%s\n", __func__);

	pr_debug("%s\n", __func__);





	/*

	 * Check if enough memory is allocated to parse the message type.

	 * Will check there is enough to hold the payload later.

	 */

	if (count >= sizeof(struct voice_svc_write_msg)) {

		data = kmalloc(count, GFP_KERNEL);

		data = kmalloc(count, GFP_KERNEL);

	} else {

		pr_debug("%s: invalid data size\n", __func__);

		ret = -EINVAL;

		goto done;

	}





	if (data == NULL) {

	if (data == NULL) {

		pr_err("%s: data kmalloc failed.\n", __func__);

		pr_err("%s: data kmalloc failed.\n", __func__);
@@ -393,9 +403,13 @@ static ssize_t voice_svc_write(struct file *file, const char __user *buf, 




	switch (cmd) {

	switch (cmd) {

	case MSG_REGISTER:

	case MSG_REGISTER:

		if (count  >=

		/*

				(sizeof(struct voice_svc_register) +

		 * Check that count reflects the expected size to ensure

				sizeof(*data))) {

		 * sufficient memory was allocated. Since voice_svc_register

		 * has a static size, this should be exact.

		 */

		if (count == (sizeof(struct voice_svc_write_msg) +

			      sizeof(struct voice_svc_register))) {

			ret = process_reg_cmd(

			ret = process_reg_cmd(

			(struct voice_svc_register *)data->payload, prtd);

			(struct voice_svc_register *)data->payload, prtd);

			if (!ret)

			if (!ret)
@@ -407,8 +421,13 @@ static ssize_t voice_svc_write(struct file *file, const char __user *buf, 
		}

		}

		break;

		break;

	case MSG_REQUEST:

	case MSG_REQUEST:

	if (count >= (sizeof(struct voice_svc_cmd_request) +

		/*

					sizeof(*data))) {

		 * Check that count reflects the expected size to ensure

		 * sufficient memory was allocated. Since voice_svc_cmd_request

		 * has a variable size, check the minimum value count must be.

		 */

		if (count >= (sizeof(struct voice_svc_write_msg) +

			      sizeof(struct voice_svc_cmd_request))) {

			ret = voice_svc_send_req(

			ret = voice_svc_send_req(

			(struct voice_svc_cmd_request *)data->payload, prtd);

			(struct voice_svc_cmd_request *)data->payload, prtd);

			if (!ret)

			if (!ret)