Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 97f63069 authored by Michael Bestas's avatar Michael Bestas
Browse files

Merge tag 'LA.UM.9.1.r1-14700-SMxxx0.QSSI13.0' of... 

Merge tag 'LA.UM.9.1.r1-14700-SMxxx0.QSSI13.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel into android13-4.14-msmnile

"LA.UM.9.1.r1-14700-SMxxx0.QSSI13.0"

* tag 'LA.UM.9.1.r1-14700-SMxxx0.QSSI13.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
  dsp: q6asm: Add check for ADSP payload size
  ASoC: msm-pcm-host-voice: Check validity of session idx
  dsp: q6lsm: Address use after free for mmap handle
  ASoC: msm-pcm-host-voice: Check validity of session idx

Change-Id: I67d335424302625bc06ba0c597a3755a0359a7f3
parents f48d1b97 2e574ea1

techpack/audio/dsp/q6asm.c

+10 −1
Original line number Diff line number Diff line
@@ -2371,7 +2371,16 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
				__func__, data->payload_size);

		break;

	case ASM_SESSION_CMDRSP_GET_MTMX_STRTR_PARAMS_V2:

		q6asm_process_mtmx_get_param_rsp(ac, (void *) payload);

		payload_size = sizeof(struct asm_mtmx_strtr_get_params_cmdrsp);

		if (data->payload_size < payload_size) {

			pr_err("%s: insufficient payload size = %d\n",

				__func__, data->payload_size);

			spin_unlock_irqrestore(

				&(session[session_id].session_lock), flags);

			return -EINVAL;

		}

		q6asm_process_mtmx_get_param_rsp(ac,

			(struct asm_mtmx_strtr_get_params_cmdrsp *) payload);

		break;

	case ASM_STREAM_PP_EVENT:

	case ASM_STREAM_CMD_ENCDEC_EVENTS: