Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 1e34b6e9 authored by Shalini Manjunatha's avatar Shalini Manjunatha Committed by Michael Bestas
Browse files

BACKPORT: dsp: afe: check for param size before copying 



Check for the proper param size before copying,
to avoid buffer overflow.

Original-Change-Id: I70c52e6ab76f528ea3714784ab9013b070839c40
Signed-off-by: default avatarShalini Manjunatha <quic_c_shalma@quicinc.com>
Change-Id: Ic7fa9b3dd047d8eeba3cea02b99d6bc5b9df8daf
parent a9029636

techpack/audio/dsp/q6afe.c

+25 −0
Original line number Original line Diff line number Diff line
@@ -382,23 +382,48 @@ static int32_t sp_make_afe_callback(uint32_t opcode, uint32_t *payload, 
	switch (param_hdr.param_id) {

	switch (param_hdr.param_id) {

	case AFE_PARAM_ID_CALIB_RES_CFG_V2:

	case AFE_PARAM_ID_CALIB_RES_CFG_V2:

		expected_size += sizeof(struct asm_calib_res_cfg);

		expected_size += sizeof(struct asm_calib_res_cfg);

		if (param_hdr.param_size != sizeof(struct asm_calib_res_cfg)) {

			pr_err("%s: Error: param_size %d is greater than expected\n",

				__func__,param_hdr.param_size);

			return -EINVAL;

		}

		data_dest = (u32 *) &this_afe.calib_data;

		data_dest = (u32 *) &this_afe.calib_data;

		break;

		break;

	case AFE_PARAM_ID_SP_V2_TH_VI_FTM_PARAMS:

	case AFE_PARAM_ID_SP_V2_TH_VI_FTM_PARAMS:

		expected_size += sizeof(struct afe_sp_th_vi_ftm_params);

		expected_size += sizeof(struct afe_sp_th_vi_ftm_params);

		if (param_hdr.param_size != sizeof(struct afe_sp_th_vi_ftm_params)) {

			pr_err("%s: Error: param_size %d is greater than expected\n",

				__func__,param_hdr.param_size);

			return -EINVAL;

		}

		data_dest = (u32 *) &this_afe.th_vi_resp;

		data_dest = (u32 *) &this_afe.th_vi_resp;

		break;

		break;

	case AFE_PARAM_ID_SP_V2_TH_VI_V_VALI_PARAMS:

	case AFE_PARAM_ID_SP_V2_TH_VI_V_VALI_PARAMS:

		expected_size += sizeof(struct afe_sp_th_vi_v_vali_params);

		expected_size += sizeof(struct afe_sp_th_vi_v_vali_params);

		if (param_hdr.param_size != sizeof(struct afe_sp_th_vi_v_vali_params)) {

			pr_err("%s: Error: param_size %d is greater than expected\n",

				__func__,param_hdr.param_size);

			return -EINVAL;

		}

		data_dest = (u32 *) &this_afe.th_vi_v_vali_resp;

		data_dest = (u32 *) &this_afe.th_vi_v_vali_resp;

		break;

		break;

	case AFE_PARAM_ID_SP_V2_EX_VI_FTM_PARAMS:

	case AFE_PARAM_ID_SP_V2_EX_VI_FTM_PARAMS:

		expected_size += sizeof(struct afe_sp_ex_vi_ftm_params);

		expected_size += sizeof(struct afe_sp_ex_vi_ftm_params);

		if (param_hdr.param_size != sizeof(struct afe_sp_ex_vi_ftm_params)) {

			pr_err("%s: Error: param_size %d is greater than expected\n",

				__func__,param_hdr.param_size);

			return -EINVAL;

		}

		data_dest = (u32 *) &this_afe.ex_vi_resp;

		data_dest = (u32 *) &this_afe.ex_vi_resp;

		break;

		break;

	case AFE_PARAM_ID_SP_RX_TMAX_XMAX_LOGGING:

	case AFE_PARAM_ID_SP_RX_TMAX_XMAX_LOGGING:

		expected_size += sizeof(

		expected_size += sizeof(

				struct afe_sp_rx_tmax_xmax_logging_param);

				struct afe_sp_rx_tmax_xmax_logging_param);

		if (param_hdr.param_size != sizeof(struct afe_sp_rx_tmax_xmax_logging_param)) {

			pr_err("%s: Error: param_size %d is greater than expected\n",

				__func__,param_hdr.param_size);

			return -EINVAL;

		}

		data_dest = (u32 *) &this_afe.xt_logging_resp;

		data_dest = (u32 *) &this_afe.xt_logging_resp;

		break;

		break;

	default:

	default: