A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 15:49:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

dsp: adm: modify adm callback payload size checks

Browse source 
Validate payload size before accessing data from ADSP.
Modify payload size checks to accommodate for variable
payloads, payload size vary from size of one integer to
many based on opcode and other variables.

CRs-Fixed: 2380694
Change-Id: Ic5e0eb72441da8f29cf645968c9df09e7803701a
Signed-off-by: Vignesh Kulothungan <vigneshk@codeaurora.org>
This commit is contained in:
Vignesh Kulothungan 2019-03-16 18:26:22 -07:00
commit 4965b8d670
1 changed files with 34 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

54
dsp/q6adm.c
View file

@ -1510,7 +1510,7 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv)
}
adm_callback_debug_print(data);
if (data->payload_size) {
if (data->payload_size >= sizeof(uint32_t)) {
copp_idx = (data->token) & 0XFF;
port_idx = ((data->token) >> 16) & 0xFF;
client_id = ((data->token) >> 8) & 0xFF;
@ -1530,13 +1530,20 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv)
return 0;
}
if (data->opcode == APR_BASIC_RSP_RESULT) {
if (data->payload_size < (2 * sizeof(uint32_t))) {
pr_err("%s: Invalid payload size %d\n", __func__,
data->payload_size);
return 0;
}
pr_debug("%s: APR_BASIC_RSP_RESULT id 0x%x\n",
__func__, payload[0]);
if (!((client_id != ADM_CLIENT_ID_SOURCE_TRACKING) &&
((payload[0] == ADM_CMD_SET_PP_PARAMS_V5) ||
(payload[0] == ADM_CMD_SET_PP_PARAMS_V6)))) {
if (data->payload_size <
(2 * sizeof(uint32_t))) {
pr_err("%s: Invalid payload size %d\n",
__func__, data->payload_size);
return 0;
}
}
if (payload[1] != 0) {
pr_err("%s: cmd = 0x%x returned error = 0x%x\n",
__func__, payload[0], payload[1]);
@ -1718,21 +1725,28 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv)
case ADM_CMDRSP_GET_PP_TOPO_MODULE_LIST_V2:
pr_debug("%s: ADM_CMDRSP_GET_PP_TOPO_MODULE_LIST\n",
__func__);
num_modules = payload[1];
pr_debug("%s: Num modules %d\n", __func__, num_modules);
if (payload[0]) {
pr_err("%s: ADM_CMDRSP_GET_PP_TOPO_MODULE_LIST, error = %d\n",
__func__, payload[0]);
} else if (num_modules > MAX_MODULES_IN_TOPO) {
pr_err("%s: ADM_CMDRSP_GET_PP_TOPO_MODULE_LIST invalid num modules received, num modules = %d\n",
__func__, num_modules);
if (data->payload_size >= (2 * sizeof(uint32_t))) {
num_modules = payload[1];
pr_debug("%s: Num modules %d\n", __func__,
num_modules);
if (payload[0]) {
pr_err("%s: ADM_CMDRSP_GET_PP_TOPO_MODULE_LIST, error = %d\n",
__func__, payload[0]);
} else if (num_modules > MAX_MODULES_IN_TOPO) {
pr_err("%s: ADM_CMDRSP_GET_PP_TOPO_MODULE_LIST invalid num modules received, num modules = %d\n",
__func__, num_modules);
} else {
ret = adm_process_get_topo_list_response(
data->opcode, copp_idx,
num_modules, payload,
data->payload_size);
if (ret)
pr_err("%s: Failed to process get topo modules list response, error %d\n",
__func__, ret);
}
} else {
ret = adm_process_get_topo_list_response(
data->opcode, copp_idx, num_modules,
payload, data->payload_size);
if (ret)
pr_err("%s: Failed to process get topo modules list response, error %d\n",
__func__, ret);
pr_err("%s: Invalid payload size %d\n",
__func__, data->payload_size);
}
atomic_set(&this_adm.copp.stat[port_idx][copp_idx],
payload[0]);