Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "ASoC: msm: check payload size before memory allocation"

Browse source
This commit is contained in:
Linux Build Service Account 2018-04-04 01:12:21 -07:00 • committed by Gerrit - the friendly Code Review server
commit a8902668e9
5 changed files with 17 additions and 9 deletions

4
asoc/msm-compress-q6-v2.c
View file

@ -3681,8 +3681,8 @@ static int msm_compr_adsp_stream_cmd_put(struct snd_kcontrol *kcontrol,
goto done;
}
if ((sizeof(struct msm_adsp_event_data) + event_data->payload_len) >=
sizeof(ucontrol->value.bytes.data)) {
if (event_data->payload_len > sizeof(ucontrol->value.bytes.data)
- sizeof(struct msm_adsp_event_data)) {
pr_err("%s param length=%d exceeds limit",
__func__, event_data->payload_len);
ret = -EINVAL;

4
asoc/msm-pcm-q6-v2.c
View file

@ -1138,8 +1138,8 @@ static int msm_pcm_adsp_stream_cmd_put(struct snd_kcontrol *kcontrol,
goto done;
}
if ((sizeof(struct msm_adsp_event_data) + event_data->payload_len) >=
sizeof(ucontrol->value.bytes.data)) {
if (event_data->payload_len > sizeof(ucontrol->value.bytes.data)
- sizeof(struct msm_adsp_event_data)) {
pr_err("%s param length=%d exceeds limit",
__func__, event_data->payload_len);
ret = -EINVAL;

5
asoc/msm-qti-pp-config.c
View file

@ -1025,8 +1025,9 @@ int msm_adsp_inform_mixer_ctl(struct snd_soc_pcm_runtime *rtd,
event_data = (struct msm_adsp_event_data *)payload;
kctl->info(kctl, &kctl_info);
if (sizeof(struct msm_adsp_event_data)
+ event_data->payload_len > kctl_info.count) {
if (event_data->payload_len >
kctl_info.count - sizeof(struct msm_adsp_event_data)) {
pr_err("%s: payload length exceeds limit of %u bytes.\n",
__func__, kctl_info.count);
ret = -EINVAL;

6
asoc/msm-transcode-loopback-q6-v2.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -539,8 +539,8 @@ static int msm_transcode_stream_cmd_put(struct snd_kcontrol *kcontrol,
goto done;
}
if ((sizeof(struct msm_adsp_event_data) + event_data->payload_len) >=
sizeof(ucontrol->value.bytes.data)) {
if (event_data->payload_len > sizeof(ucontrol->value.bytes.data)
- sizeof(struct msm_adsp_event_data)) {
pr_err("%s param length=%d exceeds limit",
__func__, event_data->payload_len);
ret = -EINVAL;

7
dsp/q6asm.c
View file

@ -2230,6 +2230,13 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
* package is composed of event type + size + actual payload
*/
payload_size = data->payload_size;
if (payload_size > UINT_MAX - sizeof(struct msm_adsp_event_data)) {
pr_err("%s: payload size = %d exceeds limit.\n",
__func__, payload_size);
spin_unlock(&(session[session_id].session_lock));
return -EINVAL;
}
pp_event_package = kzalloc(payload_size
+ sizeof(struct msm_adsp_event_data),
GFP_ATOMIC);