A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 16:16:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

dsp: afe: Add check for num_spks

Browse source 
- Check for valid num_spks before accessing.

Change-Id: Idec0edb1f2e6b37d75b007586f65f18c505772f9
Signed-off-by: Yanhong Wu <quic_yanhwu@quicinc.com>
This commit is contained in:
Yanhong Wu 2024-01-16 14:55:45 +08:00
commit 93604dbb19
1 changed files with 44 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

52
dsp/q6afe.c
View file

@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
* Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/slab.h>
#include <linux/debugfs.h>
@ -785,8 +785,14 @@ static int32_t sp_make_afe_callback(uint32_t opcode, uint32_t *payload,
switch (param_hdr.param_id) {
case AFE_PARAM_ID_CALIB_RES_CFG_V2:
num_ch = data_start[0];
expected_size += sizeof(struct asm_calib_res_cfg);
if (param_hdr.param_size != sizeof(struct asm_calib_res_cfg)) {
if (num_ch > SP_V2_NUM_MAX_SPKRS) {
pr_err("%s: Error: num_ch %d is greater than expected\n",
__func__,num_ch);
return -EINVAL;
}
if (param_hdr.param_size != (sizeof(struct asm_calib_res_cfg) - ((2 - num_ch) * 4))) {
pr_err("%s: Error: param_size %d is greater than expected\n",
__func__,param_hdr.param_size);
return -EINVAL;
@ -794,8 +800,14 @@ static int32_t sp_make_afe_callback(uint32_t opcode, uint32_t *payload,
data_dest = (u32 *) &this_afe.calib_data;
break;
case AFE_PARAM_ID_SP_V2_TH_VI_FTM_PARAMS:
num_ch = data_start[0];
expected_size += sizeof(struct afe_sp_th_vi_ftm_params);
if (param_hdr.param_size != sizeof(struct afe_sp_th_vi_ftm_params)) {
if (num_ch > SP_V2_NUM_MAX_SPKRS) {
pr_err("%s: Error: num_ch %d is greater than expected\n",
__func__,num_ch);
return -EINVAL;
}
if (param_hdr.param_size != (sizeof(struct afe_sp_th_vi_ftm_params) - ((2 - num_ch) * 4 * 3))) {
pr_err("%s: Error: param_size %d is greater than expected\n",
__func__,param_hdr.param_size);
return -EINVAL;
@ -803,8 +815,14 @@ static int32_t sp_make_afe_callback(uint32_t opcode, uint32_t *payload,
data_dest = (u32 *) &this_afe.th_vi_resp;
break;
case AFE_PARAM_ID_SP_V2_TH_VI_V_VALI_PARAMS:
num_ch = data_start[0];
expected_size += sizeof(struct afe_sp_th_vi_v_vali_params);
if (param_hdr.param_size != sizeof(struct afe_sp_th_vi_v_vali_params)) {
if (num_ch > SP_V2_NUM_MAX_SPKRS) {
pr_err("%s: Error: num_ch %d is greater than expected\n",
__func__,num_ch);
return -EINVAL;
}
if (param_hdr.param_size != (sizeof(struct afe_sp_th_vi_v_vali_params) - ((2 - num_ch) * 4 * 2))) {
pr_err("%s: Error: param_size %d is greater than expected\n",
__func__,param_hdr.param_size);
return -EINVAL;
@ -812,8 +830,14 @@ static int32_t sp_make_afe_callback(uint32_t opcode, uint32_t *payload,
data_dest = (u32 *) &this_afe.th_vi_v_vali_resp;
break;
case AFE_PARAM_ID_SP_V2_EX_VI_FTM_PARAMS:
num_ch = data_start[0];
expected_size += sizeof(struct afe_sp_ex_vi_ftm_params);
if (param_hdr.param_size != sizeof(struct afe_sp_ex_vi_ftm_params)) {
if (num_ch > SP_V2_NUM_MAX_SPKRS) {
pr_err("%s: Error: num_ch %d is greater than expected\n",
__func__,num_ch);
return -EINVAL;
}
if (param_hdr.param_size != (sizeof(struct afe_sp_ex_vi_ftm_params) - ((2 - num_ch) * 4 * 4))) {
pr_err("%s: Error: param_size %d is greater than expected\n",
__func__,param_hdr.param_size);
return -EINVAL;
@ -821,9 +845,15 @@ static int32_t sp_make_afe_callback(uint32_t opcode, uint32_t *payload,
data_dest = (u32 *) &this_afe.ex_vi_resp;
break;
case AFE_PARAM_ID_SP_RX_TMAX_XMAX_LOGGING:
num_ch = data_start[0];
expected_size += sizeof(
struct afe_sp_rx_tmax_xmax_logging_param);
if (param_hdr.param_size != sizeof(struct afe_sp_rx_tmax_xmax_logging_param)) {
if (num_ch > SP_V2_NUM_MAX_SPKRS) {
pr_err("%s: Error: num_ch %d is greater than expected\n",
__func__,num_ch);
return -EINVAL;
}
if (param_hdr.param_size != (num_ch * sizeof(struct afe_sp_rx_tmax_xmax_logging_param))) {
pr_err("%s: Error: param_size %d is greater than expected\n",
__func__,param_hdr.param_size);
return -EINVAL;
@ -831,10 +861,16 @@ static int32_t sp_make_afe_callback(uint32_t opcode, uint32_t *payload,
data_dest = (u32 *) &this_afe.xt_logging_resp;
break;
case AFE_PARAM_ID_SP_V4_CALIB_RES_CFG:
num_ch = data_start[0];
expected_size += sizeof(
struct afe_sp_v4_param_th_vi_calib_res_cfg);
if (param_hdr.param_size != sizeof(
struct afe_sp_v4_param_th_vi_calib_res_cfg)) {
if (num_ch > SP_V2_NUM_MAX_SPKRS) {
pr_err("%s: Error: num_ch %d is greater than expected\n",
__func__,num_ch);
return -EINVAL;
}
if (param_hdr.param_size != (sizeof(
struct afe_sp_v4_param_th_vi_calib_res_cfg) - (2 - num_ch) * 4)) {
pr_err("%s: Error: param_size %d is greater than expected\n",
__func__,param_hdr.param_size);
return -EINVAL;