diff options
| author | Ariel Yin <ayin@google.com> | 2017-02-13 17:47:11 -0800 |
|---|---|---|
| committer | Ariel Yin <ayin@google.com> | 2017-02-13 17:49:27 -0800 |
| commit | 717758791b87f8c0e5b34a1ba2dd7c2e9613d065 (patch) | |
| tree | 0cd86846fa4bdfc8b034f814c94532b5951230a8 | |
| parent | ef0b53de9c4eb885782682fe47dafcfadbe0f346 (diff) | |
ASoC: msm: qdsp6v2: Fix out-of-bounds access in put functions
Add out of bounds check in routing put functions
for the mux value before accessing the texts
pointer of soc_enum struct with mux as index.
CRs-fixed: 1097569
Bug: 33649808
Change-Id: Ib9ef8d398f0765754b0f79666963fac043b66077
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
| -rw-r--r-- | sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c index 9483bd07a6c..67c45bd8913 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1521,6 +1521,11 @@ static int msm_routing_ec_ref_rx_put(struct snd_kcontrol *kcontrol, int mux = ucontrol->value.enumerated.item[0]; struct soc_enum *e = (struct soc_enum *)kcontrol->private_value; + if (mux >= e->max) { + pr_err("%s: Invalid mux value %d\n", __func__, mux); + return -EINVAL; + } + mutex_lock(&routing_lock); switch (ucontrol->value.integer.value[0]) { case 0: @@ -1633,9 +1638,14 @@ static int msm_routing_ext_ec_put(struct snd_kcontrol *kcontrol, int ret = 0; bool state = false; + if (mux >= e->max) { + pr_err("%s: Invalid mux value %d\n", __func__, mux); + return -EINVAL; + } + pr_debug("%s: msm_route_ec_ref_rx = %d value = %ld\n", - __func__, msm_route_ext_ec_ref, - ucontrol->value.integer.value[0]); + __func__, msm_route_ext_ec_ref, + ucontrol->value.integer.value[0]); mutex_lock(&routing_lock); switch (ucontrol->value.integer.value[0]) { |