Merge "dsp: asm: validate ADSP data size before access" (a2d7b3d2) · Commits · e / devices / android_kernel_xiaomi_nabu

dsp/q6asm.c

+24 −3

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
		* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.
		* Author: Brian Swetland <swetland@google.com>
		*
		* This software is licensed under the terms of the GNU General Public
		@@ -1938,9 +1938,10 @@ static int32_t q6asm_callback(struct apr_client_data data, void priv)
		data->dest_port);
		if ((data->opcode != ASM_DATA_EVENT_RENDERED_EOS) &&
		(data->opcode != ASM_DATA_EVENT_EOS) &&
		(data->opcode != ASM_SESSION_EVENTX_OVERFLOW) &&
		(data->opcode != ASM_SESSION_EVENT_RX_UNDERFLOW)) {
		if (payload == NULL) {
		pr_err("%s: payload is null\n", __func__);
		if (payload == NULL \|\| (data->payload_size < (2 * sizeof(uint32_t)))) {
		pr_err("%s: payload is null or invalid size[%d]\n", __func__, data->payload_size);
		spin_unlock_irqrestore(
		&(session[session_id].session_lock), flags);
		return -EINVAL;
		@@ -2122,6 +2123,16 @@ static int32_t q6asm_callback(struct apr_client_data data, void priv)
		}
		spin_lock_irqsave(&port->dsp_lock, dsp_flags);
		buf_index = asm_token._token.buf_index;
		if (buf_index < 0 \|\| buf_index >= port->max_buf_cnt) {
		pr_debug("%s: Invalid buffer index %u\n",
		__func__, buf_index);
		spin_unlock_irqrestore(&port->dsp_lock,
		dsp_flags);
		spin_unlock_irqrestore(
		&(session[session_id].session_lock),
		flags);
		return -EINVAL;
		}
		if (lower_32_bits(port->buf[buf_index].phys) !=
		payload[0] \|\|
		msm_audio_populate_upper_32_bits(
		@@ -2212,6 +2223,16 @@ static int32_t q6asm_callback(struct apr_client_data data, void priv)
		}
		spin_lock_irqsave(&port->dsp_lock, dsp_flags);
		buf_index = asm_token._token.buf_index;
		if (buf_index < 0 \|\| buf_index >= port->max_buf_cnt) {
		pr_debug("%s: Invalid buffer index %u\n",
		__func__, buf_index);
		spin_unlock_irqrestore(&port->dsp_lock,
		dsp_flags);
		spin_unlock_irqrestore(
		&(session[session_id].session_lock),
		flags);
		return -EINVAL;
		}
		port->buf[buf_index].used = 0;
		if (lower_32_bits(port->buf[buf_index].phys) !=
		payload[READDONE_IDX_BUFADD_LSW] \|\|