Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 142cf65f authored by Harshal Ahire's avatar Harshal Ahire
Browse files

asoc: Add check to handle negative value passed for num_app_cfg_type 



Long int negative value passed as part of ucontrol structure
is assigned to int num_app_cfg_type making it positive and
leading to overflow while populating maximum supported
lsm_app_type_cfg structures.

Change-Id: Idd0be79e97bd0a1f5d0ba4461acf1bc770a6fce9
Signed-off-by: default avatarHarshal Ahire <hahire@codeaurora.org>
parent 6678bc64

4.0/asoc/msm-pcm-routing-v2.c

+8 −7
Original line number Original line Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

// SPDX-License-Identifier: GPL-2.0-only

/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.

 */

 */











#include <linux/init.h>




#include <linux/init.h>








@@ -22393,9 +22393,9 @@ static int msm_routing_put_app_type_cfg_control(struct snd_kcontrol *kcontrol,
















	memset(app_type_cfg, 0, MAX_APP_TYPES*




	memset(app_type_cfg, 0, MAX_APP_TYPES*








				sizeof(struct msm_pcm_routing_app_type_data));




				sizeof(struct msm_pcm_routing_app_type_data));








	if (num_app_types > MAX_APP_TYPES) {




	if (num_app_types > MAX_APP_TYPES || num_app_types < 0) {








		pr_err("%s: number of app types exceed the max supported\n",




		pr_err("%s: number of app types %d is invalid\n",








			__func__);




			__func__, num_app_types);








		return -EINVAL;




		return -EINVAL;








	}




	}








	for (j = 0; j < num_app_types; j++) {




	for (j = 0; j < num_app_types; j++) {








@@ -22599,9 +22599,10 @@ static int msm_routing_put_lsm_app_type_cfg_control(






	int i = 0, j;




	int i = 0, j;


















	mutex_lock(&routing_lock);




	mutex_lock(&routing_lock);








	if (ucontrol->value.integer.value[0] > MAX_APP_TYPES) {




	if (ucontrol->value.integer.value[0] < 0 ||








		pr_err("%s: number of app types exceed the max supported\n",




		ucontrol->value.integer.value[0] > MAX_APP_TYPES) {








			__func__);




		pr_err("%s: number of app types %ld is invalid\n",










			__func__, ucontrol->value.integer.value[0]);








		mutex_unlock(&routing_lock);




		mutex_unlock(&routing_lock);








		return -EINVAL;




		return -EINVAL;








	}




	}