Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ff89deb7 authored by Fred Oh's avatar Fred Oh Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: qdsp6v2: fix incorrect packet size calculation 



The header size included twice which cause memory out of bounds.

Change-Id: I3a6f429283cfa28a1f3761f655c00b154e25f8ce
Signed-off-by: default avatarFred Oh <fred@codeaurora.org>
parent cdecac51

sound/soc/msm/qdsp6v2/q6adm.c

+1 −2
Original line number Diff line number Diff line
@@ -1640,8 +1640,7 @@ static void send_adm_custom_topology(void) 


	adm_top.hdr.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD,

		APR_HDR_LEN(20), APR_PKT_VER);

	adm_top.hdr.pkt_size = APR_PKT_SIZE(APR_HDR_SIZE,

		sizeof(adm_top));

	adm_top.hdr.pkt_size = sizeof(adm_top);

	adm_top.hdr.src_svc = APR_SVC_ADM;

	adm_top.hdr.src_domain = APR_DOMAIN_APPS;

	adm_top.hdr.src_port = 0;

sound/soc/msm/qdsp6v2/q6asm.c

+2 −3
Original line number Diff line number Diff line
@@ -608,9 +608,8 @@ int send_asm_custom_topology(struct audio_client *ac) 
			__func__, ASM_CUSTOM_TOP_CAL);

		goto unlock;

	}

	q6asm_add_hdr_custom_topology(ac, &asm_top.hdr,

				      APR_PKT_SIZE(APR_HDR_SIZE,

					sizeof(asm_top)), TRUE);



	q6asm_add_hdr_custom_topology(ac, &asm_top.hdr, sizeof(asm_top), TRUE);

	atomic_set(&ac->mem_state, 1);

	asm_top.hdr.opcode = ASM_CMD_ADD_TOPOLOGIES;

	asm_top.payload_addr_lsw = lower_32_bits(cal_block->cal_data.paddr);