Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d43ba96b authored by Marco Zhang's avatar Marco Zhang Committed by Lakshman Chaluvaraju
Browse files

Post fix for missing part in 4.0 

Asoc: check for invalid voice session id
dsp: adm: add to check output/input channel
dsp: add change to fix use-after-free issue

Change-Id: Ic2fcdb8561ae9de57bd130d0f3f11e675f8e48af
parent 4e179a61

4.0/asoc/msm-pcm-routing-v2.c

+18 −2
Original line number Diff line number Diff line
@@ -1721,6 +1721,11 @@ static int msm_pcm_routing_channel_mixer(int fe_id, bool perf_mode, 
	for (i = 0; i < ADM_MAX_CHANNELS && channel_input[fe_id][i] > 0;

		++i) {

		be_id = channel_input[fe_id][i] - 1;

		if (be_id < 0 || be_id >= MSM_BACKEND_DAI_MAX) {

			pr_err("%s: Received out of bounds be_id %d\n",

					__func__, be_id);

			return -EINVAL;

		}

		channel_mixer[fe_id].input_channels[i] =

						msm_bedais[be_id].channel;










@@ -2361,6 +2366,11 @@ static void msm_pcm_routing_process_voice(u16 reg, u16 val, int set)



























	session_id = msm_pcm_routing_get_voc_sessionid(val);



























	if (!session_id) {













		pr_err("%s: Invalid session_id %x\n", __func__, session_id);













		return;













	}



























	pr_debug("%s: FE DAI 0x%x session_id 0x%x\n",















		__func__, val, session_id);
























@@ -3457,10 +3467,10 @@ static int msm_pcm_get_out_chs(struct snd_kcontrol *kcontrol,













static int msm_pcm_put_out_chs(struct snd_kcontrol *kcontrol,















				struct snd_ctl_elem_value *ucontrol)















{













	u16 fe_id = 0;

























	u16 fe_id = 0, out_ch = 0;















	fe_id = ((struct soc_multi_mixer_control *)















			kcontrol->private_value)->shift;













	out_ch = ucontrol->value.integer.value[0];















	if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) {















		pr_err("%s: invalid FE %d\n", __func__, fe_id);















		return -EINVAL;









@@ -3469,6 +3479,12 @@ static int msm_pcm_put_out_chs(struct snd_kcontrol *kcontrol,













	pr_debug("%s: fe_id is %d, output channels = %d\n", __func__,















			fe_id,















			(unsigned int)(ucontrol->value.integer.value[0]));













	if (out_ch < 0 ||













		out_ch > ADM_MAX_CHANNELS) {













		pr_err("%s: invalid output channel %d\n", __func__,













				out_ch);













		return -EINVAL;













	}















	channel_mixer[fe_id].output_channel =















			(unsigned int)(ucontrol->value.integer.value[0]);







































4.0/dsp/q6asm.c



+7
−1






























Original line number
Diff line number
Diff line















/*













 * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.













 * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.















 * Author: Brian Swetland <swetland@google.com>















 *















 * This software is licensed under the terms of the GNU General Public










@@ -8404,6 +8404,7 @@ int q6asm_memory_unmap(struct audio_client *ac, phys_addr_t buf_add, int dir)













		if (buf_node->buf_phys_addr == buf_add) {















			list_del(&buf_node->list);















			kfree(buf_node);













			buf_node = NULL;















			break;















		}















	}










@@ -8486,6 +8487,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,













	if (mmap_region_cmd == NULL) {















		rc = -EINVAL;















		kfree(buffer_node);













		buffer_node = NULL;















		return rc;















	}















	mmap_regions = (struct avs_cmd_shared_mem_map_regions *)










@@ -8522,6 +8524,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,













					mmap_regions->hdr.opcode, rc);















		rc = -EINVAL;















		kfree(buffer_node);













		buffer_node = NULL;















		goto fail_cmd;















	}

























@@ -8533,6 +8536,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,













		pr_err("%s: timeout. waited for memory_map\n", __func__);















		rc = -ETIMEDOUT;















		kfree(buffer_node);













		buffer_node = NULL;















		goto fail_cmd;















	}















	if (atomic_read(&ac->mem_state) > 0) {









@@ -8542,6 +8546,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,













		rc = adsp_err_get_lnx_err_code(















			atomic_read(&ac->mem_state));















		kfree(buffer_node);













		buffer_node = NULL;















		goto fail_cmd;















	}















	mutex_lock(&ac->cmd_lock);









@@ -8561,6 +8566,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,













	rc = 0;















fail_cmd:















	kfree(mmap_region_cmd);













	mmap_region_cmd = NULL;















	return rc;















}















EXPORT_SYMBOL(q6asm_memory_map_regions);