Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d40d3f62 authored by Karthikeyan Mani's avatar Karthikeyan Mani Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: qdsp6v2: Fix out-of-bounds access in put functions 



Add out of bounds check in routing put functions
for the mux value before accessing the texts
pointer of soc_enum struct with mux as index.

CRs-fixed: 1097569
Change-Id: Ib9ef8d398f0765754b0f79666963fac043b66077
Signed-off-by: default avatarKarthikeyan Mani <kmani@codeaurora.org>
parent 547c5e2f

sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c

+12 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -1749,8 +1749,14 @@ static int msm_routing_ec_ref_rx_put(struct snd_kcontrol *kcontrol, 
	int ec_ref_port_id;

	struct snd_soc_dapm_widget_list *wlist = snd_kcontrol_chip(kcontrol);

	struct snd_soc_dapm_widget *widget = wlist->widgets[0];

	int mux = ucontrol->value.enumerated.item[0];

	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;



	if (mux >= e->max) {

		pr_err("%s: Invalid mux value %d\n", __func__, mux);

		return -EINVAL;

	}



	mutex_lock(&routing_lock);

	switch (ucontrol->value.integer.value[0]) {

	case 0:
@@ -1867,6 +1873,11 @@ static int msm_routing_ext_ec_put(struct snd_kcontrol *kcontrol, 
		 __func__, msm_route_ext_ec_ref,

		 ucontrol->value.integer.value[0]);



	if (mux >= e->max) {

		pr_err("%s: Invalid mux value %d\n", __func__, mux);

		return -EINVAL;

	}



	mutex_lock(&routing_lock);

	switch (ucontrol->value.integer.value[0]) {

	case EC_PORT_ID_PRIMARY_MI2S_TX: