Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e78ec258 authored by Soumya Managoli's avatar Soumya Managoli Committed by Sandhya Mutha Naga Venkata
Browse files

dsp: afe: Add check for sidetone iir config copy size 



Avoid OOB access of sidetone iir config array when
iir_num_biquad_stages returned from cal block is > 10

Change-Id: I45b95e8bdd1a993a526590c94cf2f9a85c12af37
Signed-off-by: default avatarSoumya Managoli <quic_c_smanag@quicinc.com>
parent 0449b260

dsp/q6afe.c

+9 −9
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and

 * only version 2 as published by the Free Software Foundation.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.

 */

#include <linux/slab.h>

#include <linux/debugfs.h>
@@ -6418,6 +6410,14 @@ static int afe_sidetone_iir(u16 tx_port_id) 
		pr_debug("%s: adding 2 to size:%d\n", __func__, size);

		size = size + 2;

	}



	if (size > MAX_SIDETONE_IIR_DATA_SIZE) {

		pr_err("%s: iir_config size is out of bounds:%d\n", __func__, size);

		mutex_unlock(&this_afe.cal_data[cal_index]->lock);

		ret = -EINVAL;

		goto done;

	}



	memcpy(&filter_data.iir_config, &st_iir_cal_info->iir_config, size);

	mutex_unlock(&this_afe.cal_data[cal_index]->lock);