Merge "ASoC: msm-pcm-voip: Avoid interger underflow" (fd6f1d2a) · Commits · e / devices / android_kernel_xiaomi_nabu

asoc/msm-pcm-voip-v2.c

+32 −0

Original line number	Diff line number	Diff line
		/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
		*
		* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		* only version 2 as published by the Free Software Foundation.
		@@ -371,6 +372,14 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt,
		switch (prtd->mode) {
		case MODE_AMR_WB:
		case MODE_AMR: {
		if (pkt_len <= DSP_FRAME_HDR_LEN) {
		pr_err("%s: pkt_len %d is < required len\n",
		__func__, pkt_len);
		spin_unlock_irqrestore(&prtd->dsp_ul_lock,
		dsp_flags);
		return;
		}

		/* Remove the DSP frame info header. Header format:
		* Bits 0-3: Frame rate
		* Bits 4-7: Frame type
		@@ -391,6 +400,14 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt,
		case MODE_4GV_NB:
		case MODE_4GV_WB:
		case MODE_4GV_NW: {
		if (pkt_len <= DSP_FRAME_HDR_LEN) {
		pr_err("%s: pkt_len %d is < required len\n",
		__func__, pkt_len);
		spin_unlock_irqrestore(&prtd->dsp_ul_lock,
		dsp_flags);
		return;
		}

		/* Remove the DSP frame info header.
		* Header format:
		* Bits 0-3: frame rate
		@@ -428,6 +445,14 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt,
		buf_node->frame.frm_hdr.timestamp = timestamp;
		voc_pkt = voc_pkt + DSP_FRAME_HDR_LEN;

		if (pkt_len <= 2 * DSP_FRAME_HDR_LEN) {
		pr_err("%s: pkt_len %d is < required len\n",
		__func__, pkt_len);
		spin_unlock_irqrestore(&prtd->dsp_ul_lock,
		dsp_flags);
		return;
		}

		/* There are two frames in the buffer. Length of the
		* first frame:
		*/
		@@ -463,6 +488,13 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt,
		buf_node->frame.frm_hdr.timestamp = timestamp;
		voc_pkt = voc_pkt + DSP_FRAME_HDR_LEN;

		if (pkt_len <= 2 * DSP_FRAME_HDR_LEN) {
		pr_err("%s: pkt_len %d is < required len\n",
		__func__, pkt_len);
		spin_unlock_irqrestore(&prtd->dsp_ul_lock,
		dsp_flags);
		return;
		}
		/* There are two frames in the buffer. Length
		* of the second frame:
		*/