From 48f5d8b079143c99aa40b923414be0ce9742bd00 Mon Sep 17 00:00:00 2001 From: Soumya Managoli Date: Thu, 3 Aug 2023 14:57:16 +0530 Subject: [PATCH] dsp: q6afe: Add check for fbsp state Added check for fbsp state in get_calib_data functions to avoid OOB read issues. Change-Id: I6e818892a6b76497aa41241db3849802f394160a Signed-off-by: Soumya Managoli --- dsp/q6afe.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/dsp/q6afe.c b/dsp/q6afe.c index ed856382ece3..3ab1499c8e32 100644 --- a/dsp/q6afe.c +++ b/dsp/q6afe.c @@ -10855,6 +10855,7 @@ static int afe_spv4_get_calib_data( struct param_hdr_v3 param_hdr; int port = SLIMBUS_4_TX; int ret = -EINVAL; + uint32_t th_vi_ca_state; if (!calib_resp) { pr_err("%s: Invalid params\n", __func__); @@ -10876,6 +10877,12 @@ static int afe_spv4_get_calib_data( __func__, port, param_hdr.param_id, ret); goto get_params_fail; } + th_vi_ca_state = this_afe.spv4_calib_data.res_cfg.th_vi_ca_state; + if (th_vi_ca_state < FBSP_INCORRECT_OP_MODE || + th_vi_ca_state > MAX_FBSP_STATE) { + pr_err("%s: invalid fbsp state %d\n", __func__, th_vi_ca_state); + goto get_params_fail; + } memcpy(&calib_resp->res_cfg, &this_afe.spv4_calib_data.res_cfg, sizeof(this_afe.calib_data.res_cfg)); pr_info("%s: state %s resistance %d %d\n", __func__, @@ -10894,6 +10901,7 @@ int afe_spk_prot_get_calib_data(struct afe_spkr_prot_get_vi_calib *calib_resp) struct param_hdr_v3 param_hdr; int port = SLIMBUS_4_TX; int ret = -EINVAL; + uint32_t th_vi_ca_state; if (!calib_resp) { pr_err("%s: Invalid params\n", __func__); @@ -10915,6 +10923,12 @@ int afe_spk_prot_get_calib_data(struct afe_spkr_prot_get_vi_calib *calib_resp) __func__, port, param_hdr.param_id, ret); goto get_params_fail; } + th_vi_ca_state = this_afe.calib_data.res_cfg.th_vi_ca_state; + if (th_vi_ca_state < FBSP_INCORRECT_OP_MODE || + th_vi_ca_state > MAX_FBSP_STATE) { + pr_err("%s: invalid fbsp state %d\n", __func__, th_vi_ca_state); + goto get_params_fail; + } memcpy(&calib_resp->res_cfg, &this_afe.calib_data.res_cfg, sizeof(this_afe.calib_data.res_cfg)); pr_info("%s: state %s resistance %d %d\n", __func__,