A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 12:58:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

dsp: q6voice: Adds checks for an integer overflow

Browse source 
there is no check for cvs_voc_pkt[2],when recieves
0xffffffff from ADSP which results in an integer overflow
Fix is to address this.

Change-Id: Ie935dd8823981ec260d77f5117f4ef0b0fc08f60
Signed-off-by: Ramireddy KrishnaKanth Reddy <quic_ramikris@quicinc.com>
(cherry picked from commit 4c2ad8cb15)
This commit is contained in:
sumap 2024-05-24 16:39:50 +05:30
commit a2c6b2bcf1
1 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
dsp/q6voice.c
View file

@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
* Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/slab.h>
#include <linux/kthread.h>
@ -8093,7 +8093,7 @@ static int32_t qdsp_cvs_callback(struct apr_client_data *data, void *priv)
VSS_ISTREAM_EVT_OOB_NOTIFY_ENC_BUFFER_READY) {
int ret = 0;
u16 cvs_handle;
uint32_t *cvs_voc_pkt;
uint32_t *cvs_voc_pkt, tot_buf_sz;
struct cvs_enc_buffer_consumed_cmd send_enc_buf_consumed_cmd;
void *apr_cvs;
@ -8122,9 +8122,14 @@ static int32_t qdsp_cvs_callback(struct apr_client_data *data, void *priv)
VSS_ISTREAM_EVT_OOB_NOTIFY_ENC_BUFFER_CONSUMED;
cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data;
if (__builtin_add_overflow(cvs_voc_pkt[2], 3 * sizeof(uint32_t), &tot_buf_sz)) {
pr_err("%s: integer overflow detected\n", __func__);
return -EINVAL;
}
if (cvs_voc_pkt != NULL && common.mvs_info.ul_cb != NULL) {
if (v->shmem_info.sh_buf.buf[1].size <
((3 * sizeof(uint32_t)) + cvs_voc_pkt[2])) {
if (v->shmem_info.sh_buf.buf[1].size < tot_buf_sz) {
pr_err("%s: invalid voc pkt size\n", __func__);
return -EINVAL;
}