diff options
Diffstat (limited to 'techpack/audio')
| -rw-r--r-- | techpack/audio/4.0/dsp/q6afe.c | 6 | ||||
| -rw-r--r-- | techpack/audio/asoc/msm-pcm-routing-v2.c | 15 | ||||
| -rw-r--r-- | techpack/audio/dsp/q6afe.c | 6 |
3 files changed, 21 insertions, 6 deletions
diff --git a/techpack/audio/4.0/dsp/q6afe.c b/techpack/audio/4.0/dsp/q6afe.c index e3d75ccc5727..cc6288da8956 100644 --- a/techpack/audio/4.0/dsp/q6afe.c +++ b/techpack/audio/4.0/dsp/q6afe.c @@ -1,5 +1,5 @@ // SPDX-License-Identifier: GPL-2.0-only -/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved. */ #include <linux/slab.h> #include <linux/debugfs.h> @@ -8829,6 +8829,7 @@ static int afe_get_cal_sp_th_vi_param(int32_t cal_type, size_t data_size, if (cal_data == NULL || data_size > sizeof(*cal_data) || + data_size < sizeof(cal_data->cal_hdr) || this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL) return 0; @@ -8855,7 +8856,8 @@ static int afe_get_cal_sp_ex_vi_ftm_param(int32_t cal_type, size_t data_size, pr_debug("%s: cal_type = %d\n", __func__, cal_type); if (this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL] == NULL || cal_data == NULL || - data_size != sizeof(*cal_data)) + data_size > sizeof(*cal_data) || + data_size < sizeof(cal_data->cal_hdr)) goto done; mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL]->lock); diff --git a/techpack/audio/asoc/msm-pcm-routing-v2.c b/techpack/audio/asoc/msm-pcm-routing-v2.c index 4518c0416496..9bdb4069ea57 100644 --- a/techpack/audio/asoc/msm-pcm-routing-v2.c +++ b/techpack/audio/asoc/msm-pcm-routing-v2.c @@ -1554,6 +1554,11 @@ static int msm_pcm_routing_channel_mixer(int fe_id, bool perf_mode, for (i = 0; i < ADM_MAX_CHANNELS && channel_input[fe_id][i] > 0; ++i) { be_id = channel_input[fe_id][i] - 1; + if (be_id < 0 || be_id >= MSM_BACKEND_DAI_MAX) { + pr_err("%s: Received out of bounds be_id %d\n", + __func__, be_id); + return -EINVAL; + } channel_mixer[fe_id].input_channels[i] = msm_bedais[be_id].channel; @@ -3100,10 +3105,10 @@ static int msm_pcm_get_out_chs(struct snd_kcontrol *kcontrol, static int msm_pcm_put_out_chs(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) { - u16 fe_id = 0; - + u16 fe_id = 0, out_ch = 0; fe_id = ((struct soc_multi_mixer_control *) kcontrol->private_value)->shift; + out_ch = ucontrol->value.integer.value[0]; if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) { pr_err("%s: invalid FE %d\n", __func__, fe_id); return -EINVAL; @@ -3112,6 +3117,12 @@ static int msm_pcm_put_out_chs(struct snd_kcontrol *kcontrol, pr_debug("%s: fe_id is %d, output channels = %d\n", __func__, fe_id, (unsigned int)(ucontrol->value.integer.value[0])); + if (out_ch < 0 || + out_ch > ADM_MAX_CHANNELS) { + pr_err("%s: invalid output channel %d\n", __func__, + out_ch); + return -EINVAL; + } channel_mixer[fe_id].output_channel = (unsigned int)(ucontrol->value.integer.value[0]); diff --git a/techpack/audio/dsp/q6afe.c b/techpack/audio/dsp/q6afe.c index cef80bb4e906..9975240112c6 100644 --- a/techpack/audio/dsp/q6afe.c +++ b/techpack/audio/dsp/q6afe.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved. * Copyright (C) 2021 XiaoMi, Inc. * * This program is free software; you can redistribute it and/or modify @@ -8176,6 +8176,7 @@ static int afe_get_cal_sp_th_vi_param(int32_t cal_type, size_t data_size, if (cal_data == NULL || data_size > sizeof(*cal_data) || + data_size < sizeof(cal_data->cal_hdr) || this_afe.cal_data[AFE_FB_SPKR_PROT_TH_VI_CAL] == NULL) return 0; @@ -8202,7 +8203,8 @@ static int afe_get_cal_sp_ex_vi_ftm_param(int32_t cal_type, size_t data_size, pr_debug("%s: cal_type = %d\n", __func__, cal_type); if (this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL] == NULL || cal_data == NULL || - data_size != sizeof(*cal_data)) + data_size > sizeof(*cal_data) || + data_size < sizeof(cal_data->cal_hdr)) goto done; mutex_lock(&this_afe.cal_data[AFE_FB_SPKR_PROT_EX_VI_CAL]->lock); |