Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d43ba96b authored by Marco Zhang's avatar Marco Zhang Committed by Lakshman Chaluvaraju
Browse files

Post fix for missing part in 4.0

Asoc: check for invalid voice session id
dsp: adm: add to check output/input channel
dsp: add change to fix use-after-free issue

Change-Id: Ic2fcdb8561ae9de57bd130d0f3f11e675f8e48af
parent 4e179a61
Loading
Loading
Loading
Loading
+18 −2
Original line number Diff line number Diff line
@@ -1721,6 +1721,11 @@ static int msm_pcm_routing_channel_mixer(int fe_id, bool perf_mode,
	for (i = 0; i < ADM_MAX_CHANNELS && channel_input[fe_id][i] > 0;
		++i) {
		be_id = channel_input[fe_id][i] - 1;
		if (be_id < 0 || be_id >= MSM_BACKEND_DAI_MAX) {
			pr_err("%s: Received out of bounds be_id %d\n",
					__func__, be_id);
			return -EINVAL;
		}
		channel_mixer[fe_id].input_channels[i] =
						msm_bedais[be_id].channel;
@@ -2361,6 +2366,11 @@ static void msm_pcm_routing_process_voice(u16 reg, u16 val, int set)
	session_id = msm_pcm_routing_get_voc_sessionid(val);
	if (!session_id) {
		pr_err("%s: Invalid session_id %x\n", __func__, session_id);
		return;
	}
	pr_debug("%s: FE DAI 0x%x session_id 0x%x\n",
		__func__, val, session_id);
@@ -3457,10 +3467,10 @@ static int msm_pcm_get_out_chs(struct snd_kcontrol *kcontrol,
static int msm_pcm_put_out_chs(struct snd_kcontrol *kcontrol,
				struct snd_ctl_elem_value *ucontrol)
{
	u16 fe_id = 0;
	u16 fe_id = 0, out_ch = 0;
	fe_id = ((struct soc_multi_mixer_control *)
			kcontrol->private_value)->shift;
	out_ch = ucontrol->value.integer.value[0];
	if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) {
		pr_err("%s: invalid FE %d\n", __func__, fe_id);
		return -EINVAL;
@@ -3469,6 +3479,12 @@ static int msm_pcm_put_out_chs(struct snd_kcontrol *kcontrol,
	pr_debug("%s: fe_id is %d, output channels = %d\n", __func__,
			fe_id,
			(unsigned int)(ucontrol->value.integer.value[0]));
	if (out_ch < 0 ||
		out_ch > ADM_MAX_CHANNELS) {
		pr_err("%s: invalid output channel %d\n", __func__,
				out_ch);
		return -EINVAL;
	}
	channel_mixer[fe_id].output_channel =
			(unsigned int)(ucontrol->value.integer.value[0]);
+7 −1
Original line number Diff line number Diff line
/*
 * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
 * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
 * Author: Brian Swetland <swetland@google.com>
 *
 * This software is licensed under the terms of the GNU General Public
@@ -8404,6 +8404,7 @@ int q6asm_memory_unmap(struct audio_client *ac, phys_addr_t buf_add, int dir)
		if (buf_node->buf_phys_addr == buf_add) {
			list_del(&buf_node->list);
			kfree(buf_node);
			buf_node = NULL;
			break;
		}
	}
@@ -8486,6 +8487,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
	if (mmap_region_cmd == NULL) {
		rc = -EINVAL;
		kfree(buffer_node);
		buffer_node = NULL;
		return rc;
	}
	mmap_regions = (struct avs_cmd_shared_mem_map_regions *)
@@ -8522,6 +8524,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
					mmap_regions->hdr.opcode, rc);
		rc = -EINVAL;
		kfree(buffer_node);
		buffer_node = NULL;
		goto fail_cmd;
	}

@@ -8533,6 +8536,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
		pr_err("%s: timeout. waited for memory_map\n", __func__);
		rc = -ETIMEDOUT;
		kfree(buffer_node);
		buffer_node = NULL;
		goto fail_cmd;
	}
	if (atomic_read(&ac->mem_state) > 0) {
@@ -8542,6 +8546,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
		rc = adsp_err_get_lnx_err_code(
			atomic_read(&ac->mem_state));
		kfree(buffer_node);
		buffer_node = NULL;
		goto fail_cmd;
	}
	mutex_lock(&ac->cmd_lock);
@@ -8561,6 +8566,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
	rc = 0;
fail_cmd:
	kfree(mmap_region_cmd);
	mmap_region_cmd = NULL;
	return rc;
}
EXPORT_SYMBOL(q6asm_memory_map_regions);