From 7af6a8b6a445f3941703a13a4bb9a5167f13f11e Mon Sep 17 00:00:00 2001 From: Shalini Manjunatha Date: Mon, 19 Dec 2022 19:05:22 +0530 Subject: [PATCH 1/5] asoc: wcd938x/wcd937x: add null pointer check for mbhc variable Whenever MBHC is disabled through kernel config file, particular vaiable of mbhc is not guarded for NULL pointer check causing kernel panic, Hence add NULL check for that pointer variable. Change-Id: Iae4950ceb076239a130b4f033cb2f08cd65a92a9 Signed-off-by: Shalini Manjunatha --- asoc/codecs/wcd937x/wcd937x.c | 8 +++++--- asoc/codecs/wcd938x/wcd938x.c | 8 +++++--- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/asoc/codecs/wcd937x/wcd937x.c b/asoc/codecs/wcd937x/wcd937x.c index c002574d26b2..7bec6b399a87 100644 --- a/asoc/codecs/wcd937x/wcd937x.c +++ b/asoc/codecs/wcd937x/wcd937x.c @@ -1734,8 +1734,9 @@ static int wcd937x_event_notify(struct notifier_block *block, case BOLERO_SLV_EVT_SSR_DOWN: wcd937x->mbhc->wcd_mbhc.deinit_in_progress = true; mbhc = &wcd937x->mbhc->wcd_mbhc; - wcd937x->usbc_hs_status = get_usbc_hs_status(component, - mbhc->mbhc_cfg); + if(mbhc->mbhc_cfg) + wcd937x->usbc_hs_status = get_usbc_hs_status(component, + mbhc->mbhc_cfg); wcd937x_mbhc_ssr_down(wcd937x->mbhc, component); wcd937x_reset_low(wcd937x->dev); break; @@ -1755,7 +1756,8 @@ static int wcd937x_event_notify(struct notifier_block *block, dev_err(component->dev, "%s: mbhc initialization failed\n", __func__); } else { - wcd937x_mbhc_hs_detect(component, mbhc->mbhc_cfg); + if(mbhc->mbhc_cfg) + wcd937x_mbhc_hs_detect(component, mbhc->mbhc_cfg); if (wcd937x->usbc_hs_status) mdelay(500); } diff --git a/asoc/codecs/wcd938x/wcd938x.c b/asoc/codecs/wcd938x/wcd938x.c index 1a976b86007d..3448e41f0727 100644 --- a/asoc/codecs/wcd938x/wcd938x.c +++ b/asoc/codecs/wcd938x/wcd938x.c @@ -2161,8 +2161,9 @@ static int wcd938x_event_notify(struct notifier_block *block, NULL); wcd938x->mbhc->wcd_mbhc.deinit_in_progress = true; mbhc = &wcd938x->mbhc->wcd_mbhc; - wcd938x->usbc_hs_status = get_usbc_hs_status(component, - mbhc->mbhc_cfg); + if(mbhc->mbhc_cfg) + wcd938x->usbc_hs_status = get_usbc_hs_status(component, + mbhc->mbhc_cfg); wcd938x_mbhc_ssr_down(wcd938x->mbhc, component); wcd938x_reset_low(wcd938x->dev); break; @@ -2184,7 +2185,8 @@ static int wcd938x_event_notify(struct notifier_block *block, dev_err(component->dev, "%s: mbhc initialization failed\n", __func__); } else { - wcd938x_mbhc_hs_detect(component, mbhc->mbhc_cfg); + if(mbhc->mbhc_cfg) + wcd938x_mbhc_hs_detect(component, mbhc->mbhc_cfg); } wcd938x->mbhc->wcd_mbhc.deinit_in_progress = false; wcd938x->dev_up = true; From 9e949d228f101118550895a92eefcefd60f96281 Mon Sep 17 00:00:00 2001 From: Manoj Kumar N D Date: Mon, 14 Nov 2022 19:14:09 +0530 Subject: [PATCH 2/5] asoc : send chanel mixer while rerouting sound device Channel mixer has to sent while the sound devices are rerouted as capture/playback prepare will not be called during rerouting. Change-Id: I8473d89c7aff9f5f2a1dd2f3f4a8fa5d387b2429 Signed-off-by: Manoj Kumar N D --- asoc/msm-pcm-routing-auto.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/asoc/msm-pcm-routing-auto.c b/asoc/msm-pcm-routing-auto.c index f8e15f51fc24..10e94d74f8f9 100644 --- a/asoc/msm-pcm-routing-auto.c +++ b/asoc/msm-pcm-routing-auto.c @@ -32338,6 +32338,9 @@ static int msm_pcm_routing_prepare(struct snd_pcm_substream *substream) (fdai->passthr_mode == LEGACY_PCM)) msm_pcm_routing_cfg_pp(port_id, copp_idx, topology, channels); + if(msm_pcm_routing_channel_mixer(i, fdai->perf_mode,fdai->strm_id, session_type)){ + pr_err("%s: failed to send channel mixer \n", __func__); + } } } From 7d196f8368cffb9a735f3f58531e7b4a63e820dc Mon Sep 17 00:00:00 2001 From: Manoj Kumar N D Date: Tue, 13 Dec 2022 12:16:31 +0530 Subject: [PATCH 3/5] dsp : assign null to pointer that has freed address After freeing up the memory assign null to the pointer that had the address. Change-Id: I242a936c434dc449ec9fd19b0c34e843c3cf0913 Signed-off-by: Manoj Kumar N D --- dsp/audio_cal_utils.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dsp/audio_cal_utils.c b/dsp/audio_cal_utils.c index 01e9c349142d..1406088b4ea6 100644 --- a/dsp/audio_cal_utils.c +++ b/dsp/audio_cal_utils.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2014-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include #include @@ -458,6 +459,7 @@ static void delete_cal_block(struct cal_block_data *cal_block) cal_block->map_data.dma_buf = NULL; } kfree(cal_block); + cal_block = NULL; done: return; } From 02230ca65b59b3290245dee87acafef0d8943226 Mon Sep 17 00:00:00 2001 From: Soumya Managoli Date: Fri, 6 Jan 2023 14:37:20 +0530 Subject: [PATCH 4/5] ASoC: msm-pcm-q6-v2: Add dsp buf check Current logic copies user buf size of data from the avail dsp buf at a given offset. If this offset returned from DSP in READ_DONE event goes out of bounds or is corrupted, then it can lead to out of bounds DSP buffer access, resulting in memory fault. Fix is to add check for this buf offset, if it is within the buf size range. Change-Id: I7753cc6db394704dbb959477150141d42b836bef Signed-off-by: Soumya Managoli --- asoc/msm-pcm-q6-v2.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/asoc/msm-pcm-q6-v2.c b/asoc/msm-pcm-q6-v2.c index 1dfa857be5ea..b26ae17520c7 100644 --- a/asoc/msm-pcm-q6-v2.c +++ b/asoc/msm-pcm-q6-v2.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. */ /* * Add support for 24 and 32bit format for ASM loopback and playback session. @@ -1328,6 +1328,14 @@ static int msm_pcm_capture_copy(struct snd_pcm_substream *substream, xfer = size; offset = prtd->in_frame_info[idx].offset; pr_debug("Offset value = %d\n", offset); + + if (offset >= size) { + pr_err("%s: Invalid dsp buf offset\n", __func__); + ret = -EFAULT; + q6asm_cpu_buf_release(OUT, prtd->audio_client); + goto fail; + } + if (size == 0 || size < prtd->pcm_count) { memset(bufptr + offset + size, 0, prtd->pcm_count - size); if (fbytes > prtd->pcm_count) From 89e9d61385b76b5f47c9215b82dcec079645e12b Mon Sep 17 00:00:00 2001 From: Soumya Managoli Date: Mon, 12 Dec 2022 12:22:23 +0530 Subject: [PATCH 5/5] ASoC: Add check for pm_qos_req before removal Check if pm_qos_req is active before removal. Change-Id: I0076a73ffa6310dbb4cb207ca7a651aa1d3fdf04 Signed-off-by: Soumya Managoli --- asoc/msm-pcm-hostless.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/asoc/msm-pcm-hostless.c b/asoc/msm-pcm-hostless.c index 63c5db85fe42..aaf714bc9907 100644 --- a/asoc/msm-pcm-hostless.c +++ b/asoc/msm-pcm-hostless.c @@ -1,5 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* Copyright (c) 2011-2014, 2017-2019 The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -18,7 +19,8 @@ static int msm_pcm_hostless_prepare(struct snd_pcm_substream *substream) pr_err("%s: invalid params\n", __func__); return -EINVAL; } - pm_qos_remove_request(&substream->latency_pm_qos_req); + if (pm_qos_request_active(&substream->latency_pm_qos_req)) + pm_qos_remove_request(&substream->latency_pm_qos_req); return 0; }