Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d85e6f33 authored by Tanya Dixit's avatar Tanya Dixit
Browse files

asoc: sm6150: Add proper checks for ch_num 



Check the value of ch_num and return if
less than zero to avoid out of bound access
in cdc_dma_cfg arrays.

Change-Id: Ie59f5e7ed063d65a61033a142acd2bcf2287c39b
Signed-off-by: default avatarTanya Dixit <tdixit@codeaurora.org>
parent c223ed77

asoc/sm6150.c

+52 −4
Original line number Original line Diff line number Diff line
@@ -1250,8 +1250,10 @@ static int cdc_dma_rx_ch_get(struct snd_kcontrol *kcontrol, 
{

{

	int ch_num = cdc_dma_get_port_idx(kcontrol);

	int ch_num = cdc_dma_get_port_idx(kcontrol);





	if (ch_num < 0)

	if (ch_num < 0) {

		pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num);

		return ch_num;

		return ch_num;

	}





	pr_debug("%s: cdc_dma_rx_ch  = %d\n", __func__,

	pr_debug("%s: cdc_dma_rx_ch  = %d\n", __func__,

		 cdc_dma_rx_cfg[ch_num].channels - 1);

		 cdc_dma_rx_cfg[ch_num].channels - 1);
@@ -1264,8 +1266,10 @@ static int cdc_dma_rx_ch_put(struct snd_kcontrol *kcontrol, 
{

{

	int ch_num = cdc_dma_get_port_idx(kcontrol);

	int ch_num = cdc_dma_get_port_idx(kcontrol);





	if (ch_num < 0)

	if (ch_num < 0) {

		pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num);

		return ch_num;

		return ch_num;

	}





	cdc_dma_rx_cfg[ch_num].channels = ucontrol->value.integer.value[0] + 1;

	cdc_dma_rx_cfg[ch_num].channels = ucontrol->value.integer.value[0] + 1;
@@ -1279,6 +1283,11 @@ static int cdc_dma_rx_format_get(struct snd_kcontrol *kcontrol, 
{

{

	int ch_num = cdc_dma_get_port_idx(kcontrol);

	int ch_num = cdc_dma_get_port_idx(kcontrol);





	if (ch_num < 0) {

		pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num);

		return ch_num;

	}



	switch (cdc_dma_rx_cfg[ch_num].bit_format) {

	switch (cdc_dma_rx_cfg[ch_num].bit_format) {

	case SNDRV_PCM_FORMAT_S32_LE:

	case SNDRV_PCM_FORMAT_S32_LE:

		ucontrol->value.integer.value[0] = 3;

		ucontrol->value.integer.value[0] = 3;
@@ -1307,6 +1316,11 @@ static int cdc_dma_rx_format_put(struct snd_kcontrol *kcontrol, 
	int rc = 0;

	int rc = 0;

	int ch_num = cdc_dma_get_port_idx(kcontrol);

	int ch_num = cdc_dma_get_port_idx(kcontrol);





	if (ch_num < 0) {

		pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num);

		return ch_num;

	}



	switch (ucontrol->value.integer.value[0]) {

	switch (ucontrol->value.integer.value[0]) {

	case 3:

	case 3:

		cdc_dma_rx_cfg[ch_num].bit_format = SNDRV_PCM_FORMAT_S32_LE;

		cdc_dma_rx_cfg[ch_num].bit_format = SNDRV_PCM_FORMAT_S32_LE;
@@ -1437,8 +1451,10 @@ static int cdc_dma_rx_sample_rate_get(struct snd_kcontrol *kcontrol, 
{

{

	int ch_num = cdc_dma_get_port_idx(kcontrol);

	int ch_num = cdc_dma_get_port_idx(kcontrol);





	if (ch_num < 0)

	if (ch_num < 0) {

		pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num);

		return ch_num;

		return ch_num;

	}





	ucontrol->value.enumerated.item[0] =

	ucontrol->value.enumerated.item[0] =

		cdc_dma_get_sample_rate_val(cdc_dma_rx_cfg[ch_num].sample_rate);

		cdc_dma_get_sample_rate_val(cdc_dma_rx_cfg[ch_num].sample_rate);
@@ -1453,8 +1469,10 @@ static int cdc_dma_rx_sample_rate_put(struct snd_kcontrol *kcontrol, 
{

{

	int ch_num = cdc_dma_get_port_idx(kcontrol);

	int ch_num = cdc_dma_get_port_idx(kcontrol);





	if (ch_num < 0)

	if (ch_num < 0) {

		pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num);

		return ch_num;

		return ch_num;

	}





	cdc_dma_rx_cfg[ch_num].sample_rate =

	cdc_dma_rx_cfg[ch_num].sample_rate =

		cdc_dma_get_sample_rate(ucontrol->value.enumerated.item[0]);

		cdc_dma_get_sample_rate(ucontrol->value.enumerated.item[0]);
@@ -1471,6 +1489,11 @@ static int cdc_dma_tx_ch_get(struct snd_kcontrol *kcontrol, 
{

{

	int ch_num = cdc_dma_get_port_idx(kcontrol);

	int ch_num = cdc_dma_get_port_idx(kcontrol);





	if (ch_num < 0) {

		pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num);

		return ch_num;

	}



	pr_debug("%s: cdc_dma_tx_ch  = %d\n", __func__,

	pr_debug("%s: cdc_dma_tx_ch  = %d\n", __func__,

		 cdc_dma_tx_cfg[ch_num].channels);

		 cdc_dma_tx_cfg[ch_num].channels);

	ucontrol->value.integer.value[0] = cdc_dma_tx_cfg[ch_num].channels - 1;

	ucontrol->value.integer.value[0] = cdc_dma_tx_cfg[ch_num].channels - 1;
@@ -1482,6 +1505,11 @@ static int cdc_dma_tx_ch_put(struct snd_kcontrol *kcontrol, 
{

{

	int ch_num = cdc_dma_get_port_idx(kcontrol);

	int ch_num = cdc_dma_get_port_idx(kcontrol);





	if (ch_num < 0) {

		pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num);

		return ch_num;

	}



	cdc_dma_tx_cfg[ch_num].channels = ucontrol->value.integer.value[0] + 1;

	cdc_dma_tx_cfg[ch_num].channels = ucontrol->value.integer.value[0] + 1;





	pr_debug("%s: cdc_dma_tx_ch = %d\n", __func__,

	pr_debug("%s: cdc_dma_tx_ch = %d\n", __func__,
@@ -1495,6 +1523,11 @@ static int cdc_dma_tx_sample_rate_get(struct snd_kcontrol *kcontrol, 
	int sample_rate_val;

	int sample_rate_val;

	int ch_num = cdc_dma_get_port_idx(kcontrol);

	int ch_num = cdc_dma_get_port_idx(kcontrol);





	if (ch_num < 0) {

		pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num);

		return ch_num;

	}



	switch (cdc_dma_tx_cfg[ch_num].sample_rate) {

	switch (cdc_dma_tx_cfg[ch_num].sample_rate) {

	case SAMPLING_RATE_384KHZ:

	case SAMPLING_RATE_384KHZ:

		sample_rate_val = 12;

		sample_rate_val = 12;
@@ -1551,6 +1584,11 @@ static int cdc_dma_tx_sample_rate_put(struct snd_kcontrol *kcontrol, 
{

{

	int ch_num = cdc_dma_get_port_idx(kcontrol);

	int ch_num = cdc_dma_get_port_idx(kcontrol);





	if (ch_num < 0) {

		pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num);

		return ch_num;

	}



	switch (ucontrol->value.integer.value[0]) {

	switch (ucontrol->value.integer.value[0]) {

	case 12:

	case 12:

		cdc_dma_tx_cfg[ch_num].sample_rate = SAMPLING_RATE_384KHZ;

		cdc_dma_tx_cfg[ch_num].sample_rate = SAMPLING_RATE_384KHZ;
@@ -1607,6 +1645,11 @@ static int cdc_dma_tx_format_get(struct snd_kcontrol *kcontrol, 
{

{

	int ch_num = cdc_dma_get_port_idx(kcontrol);

	int ch_num = cdc_dma_get_port_idx(kcontrol);





	if (ch_num < 0) {

		pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num);

		return ch_num;

	}



	switch (cdc_dma_tx_cfg[ch_num].bit_format) {

	switch (cdc_dma_tx_cfg[ch_num].bit_format) {

	case SNDRV_PCM_FORMAT_S32_LE:

	case SNDRV_PCM_FORMAT_S32_LE:

		ucontrol->value.integer.value[0] = 3;

		ucontrol->value.integer.value[0] = 3;
@@ -1635,6 +1678,11 @@ static int cdc_dma_tx_format_put(struct snd_kcontrol *kcontrol, 
	int rc = 0;

	int rc = 0;

	int ch_num = cdc_dma_get_port_idx(kcontrol);

	int ch_num = cdc_dma_get_port_idx(kcontrol);





	if (ch_num < 0) {

		pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num);

		return ch_num;

	}



	switch (ucontrol->value.integer.value[0]) {

	switch (ucontrol->value.integer.value[0]) {

	case 3:

	case 3:

		cdc_dma_tx_cfg[ch_num].bit_format = SNDRV_PCM_FORMAT_S32_LE;

		cdc_dma_tx_cfg[ch_num].bit_format = SNDRV_PCM_FORMAT_S32_LE;