From c17bb7ef220993e32459685eaaf1fe216069d3f0 Mon Sep 17 00:00:00 2001 From: Soumya Managoli Date: Fri, 23 Feb 2024 10:04:53 +0530 Subject: [PATCH 1/5] ASoC: msm-pcm-q6-v2: Add size check Check if buf size is valid before comparing with buf offset. Signed-off-by: Soumya Managoli Change-Id: I8336be046c4922ce2f8bb333b58ca867059e9528 --- asoc/msm-pcm-q6-v2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/asoc/msm-pcm-q6-v2.c b/asoc/msm-pcm-q6-v2.c index 2ef5e4c92158..ac78ef98229a 100644 --- a/asoc/msm-pcm-q6-v2.c +++ b/asoc/msm-pcm-q6-v2.c @@ -1329,7 +1329,7 @@ static int msm_pcm_capture_copy(struct snd_pcm_substream *substream, offset = prtd->in_frame_info[idx].offset; pr_debug("Offset value = %d\n", offset); - if (offset >= size) { + if (size && offset >= size) { pr_err("%s: Invalid dsp buf offset\n", __func__); ret = -EFAULT; q6asm_cpu_buf_release(OUT, prtd->audio_client); From 19475bc169d4a3806e3a12d0917d1bc8fc3d8786 Mon Sep 17 00:00:00 2001 From: Jing Wang Date: Fri, 1 Mar 2024 21:08:05 +0800 Subject: [PATCH 2/5] dsp: q6asm increase the locking range Increase the locking range to prevent shared resources from being abnormal modified. Change-Id: Icb7ecfd6110874e6ecfa5bea5c1bd2625127e08d Signed-off-by: Jing Wang (cherry picked from commit ebd90817721f88c9215b6e0511fcaff3125f8138) --- dsp/q6asm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/dsp/q6asm.c b/dsp/q6asm.c index 5ba45f3c775d..3016cf5ff05b 100644 --- a/dsp/q6asm.c +++ b/dsp/q6asm.c @@ -8843,6 +8843,8 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir, } mmap_regions = (struct avs_cmd_shared_mem_map_regions *) mmap_region_cmd; + + mutex_lock(&ac->cmd_lock); q6asm_add_mmaphdr(ac, &mmap_regions->hdr, cmd_size, dir); atomic_set(&ac->mem_state, -1); pr_debug("%s: mmap_region=0x%pK token=0x%x\n", __func__, @@ -8900,7 +8902,6 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir, buffer_node = NULL; goto fail_cmd; } - mutex_lock(&ac->cmd_lock); for (i = 0; i < bufcnt; i++) { ab = &port->buf[i]; @@ -8913,9 +8914,9 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir, buffer_node[i].mmap_hdl); } ac->port[dir].tmp_hdl = 0; - mutex_unlock(&ac->cmd_lock); rc = 0; fail_cmd: + mutex_unlock(&ac->cmd_lock); kfree(mmap_region_cmd); mmap_region_cmd = NULL; return rc; From fb09ec8587ea689fc274c0e1b9d096b55cea36c8 Mon Sep 17 00:00:00 2001 From: Kumar Anurag Singh Date: Thu, 4 Apr 2024 21:27:36 -0700 Subject: [PATCH 3/5] Fix for OOB access issue Added payload size check to avoid OOB read issues. Change-Id: I4f15bdfdcf15e388ebc49dd0e8cf7a99ed03d0d5 Signed-off-by: Kumar Anurag Singh --- dsp/q6adm.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/dsp/q6adm.c b/dsp/q6adm.c index 32a5b29d3a1c..7455252e2f08 100644 --- a/dsp/q6adm.c +++ b/dsp/q6adm.c @@ -1713,16 +1713,11 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv) if (data->opcode == APR_BASIC_RSP_RESULT) { pr_debug("%s: APR_BASIC_RSP_RESULT id 0x%x\n", __func__, payload[0]); - - if (!((client_id != ADM_CLIENT_ID_SOURCE_TRACKING) && - ((payload[0] == ADM_CMD_SET_PP_PARAMS_V5) || - (payload[0] == ADM_CMD_SET_PP_PARAMS_V6)))) { - if (data->payload_size < - (2 * sizeof(uint32_t))) { - pr_err("%s: Invalid payload size %d\n", - __func__, data->payload_size); - return 0; - } + if (data->payload_size < + (2 * sizeof(uint32_t))) { + pr_err("%s: Invalid payload size %d\n", + __func__, data->payload_size); + return 0; } if (payload[1] != 0) { From bbe748c8dfa4de303462edaba96d4ce283c13bc7 Mon Sep 17 00:00:00 2001 From: Kumar Anurag Singh Date: Mon, 15 Apr 2024 00:50:50 -0700 Subject: [PATCH 4/5] dsp: q6lsm: Check size of payload before access check size of payload before access in q6lsm_mmapcallback. Change-Id: I6a755ca4cf54078f0d00f38e303f1b1da29b244c Signed-off-by: Kumar Anurag Singh --- dsp/q6lsm.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/dsp/q6lsm.c b/dsp/q6lsm.c index e1aad637d8be..f79298d0c31d 100644 --- a/dsp/q6lsm.c +++ b/dsp/q6lsm.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2013-2021, Linux Foundation. All rights reserved. - * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved. */ #include #include @@ -2130,6 +2130,12 @@ static int q6lsm_mmapcallback(struct apr_client_data *data, void *priv) return 0; } + if (data->payload_size < (2 * sizeof(uint32_t))) { + pr_err("%s: payload has invalid size[%d]\n", __func__, + data->payload_size); + return -EINVAL; + } + command = payload[0]; retcode = payload[1]; sid = (data->token >> 8) & 0x0F; From 044504518aa566f8b8676aabc93abe89a5a1d388 Mon Sep 17 00:00:00 2001 From: Sandhya Mutha Naga Venkata Date: Tue, 16 Apr 2024 22:16:56 +0530 Subject: [PATCH 5/5] Asoc: dsp: Fix to check the list is empty or not Added change to check the list before access it. Change-Id: Ibbf80f157caf06453daefd3a38607b0460157123 Signed-off-by: Sandhya Mutha Naga Venkata --- asoc/msm-lsm-client.c | 9 ++++++++- dsp/q6lsm.c | 6 ++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/asoc/msm-lsm-client.c b/asoc/msm-lsm-client.c index 443f62e84d01..9b82d8c49a51 100644 --- a/asoc/msm-lsm-client.c +++ b/asoc/msm-lsm-client.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2013-2020, The Linux Foundation. All rights reserved. - * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved. */ #include #include @@ -879,6 +879,13 @@ static int msm_lsm_dereg_model(struct snd_pcm_substream *substream, if (p_info->model_id != 0 && p_info->param_type == LSM_DEREG_MULTI_SND_MODEL) { + + if(list_empty(&client->stage_cfg[p_info->stage_idx].sound_models)) { + pr_err("%s: sound_models list is empty \n", + __func__); + return -EINVAL; + } + list_for_each_entry(sm, &client->stage_cfg[p_info->stage_idx].sound_models, list) { diff --git a/dsp/q6lsm.c b/dsp/q6lsm.c index f79298d0c31d..175c8fcb1a7e 100644 --- a/dsp/q6lsm.c +++ b/dsp/q6lsm.c @@ -2460,6 +2460,12 @@ int q6lsm_set_one_param(struct lsm_client *client, sizeof(struct param_hdr_v2); if (param_type == LSM_REG_MULTI_SND_MODEL) { + if(list_empty(&client->stage_cfg[p_info->stage_idx].sound_models)) { + pr_err("%s: sound_models list is empty \n", + __func__); + return -EINVAL; + } + list_for_each_entry(sm, &client->stage_cfg[p_info->stage_idx].sound_models, list) {