From d85e6f3384b02ba77355fef4be6a24ab73172034 Mon Sep 17 00:00:00 2001 From: Tanya Dixit Date: Fri, 14 Sep 2018 16:06:20 +0530 Subject: [PATCH] asoc: sm6150: Add proper checks for ch_num Check the value of ch_num and return if less than zero to avoid out of bound access in cdc_dma_cfg arrays. Change-Id: Ie59f5e7ed063d65a61033a142acd2bcf2287c39b Signed-off-by: Tanya Dixit --- asoc/sm6150.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 52 insertions(+), 4 deletions(-) diff --git a/asoc/sm6150.c b/asoc/sm6150.c index 72181221ea1f..f62c39ec0fc5 100644 --- a/asoc/sm6150.c +++ b/asoc/sm6150.c @@ -1250,8 +1250,10 @@ static int cdc_dma_rx_ch_get(struct snd_kcontrol *kcontrol, { int ch_num = cdc_dma_get_port_idx(kcontrol); - if (ch_num < 0) + if (ch_num < 0) { + pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num); return ch_num; + } pr_debug("%s: cdc_dma_rx_ch = %d\n", __func__, cdc_dma_rx_cfg[ch_num].channels - 1); @@ -1264,8 +1266,10 @@ static int cdc_dma_rx_ch_put(struct snd_kcontrol *kcontrol, { int ch_num = cdc_dma_get_port_idx(kcontrol); - if (ch_num < 0) + if (ch_num < 0) { + pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num); return ch_num; + } cdc_dma_rx_cfg[ch_num].channels = ucontrol->value.integer.value[0] + 1; @@ -1279,6 +1283,11 @@ static int cdc_dma_rx_format_get(struct snd_kcontrol *kcontrol, { int ch_num = cdc_dma_get_port_idx(kcontrol); + if (ch_num < 0) { + pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num); + return ch_num; + } + switch (cdc_dma_rx_cfg[ch_num].bit_format) { case SNDRV_PCM_FORMAT_S32_LE: ucontrol->value.integer.value[0] = 3; @@ -1307,6 +1316,11 @@ static int cdc_dma_rx_format_put(struct snd_kcontrol *kcontrol, int rc = 0; int ch_num = cdc_dma_get_port_idx(kcontrol); + if (ch_num < 0) { + pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num); + return ch_num; + } + switch (ucontrol->value.integer.value[0]) { case 3: cdc_dma_rx_cfg[ch_num].bit_format = SNDRV_PCM_FORMAT_S32_LE; @@ -1437,8 +1451,10 @@ static int cdc_dma_rx_sample_rate_get(struct snd_kcontrol *kcontrol, { int ch_num = cdc_dma_get_port_idx(kcontrol); - if (ch_num < 0) + if (ch_num < 0) { + pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num); return ch_num; + } ucontrol->value.enumerated.item[0] = cdc_dma_get_sample_rate_val(cdc_dma_rx_cfg[ch_num].sample_rate); @@ -1453,8 +1469,10 @@ static int cdc_dma_rx_sample_rate_put(struct snd_kcontrol *kcontrol, { int ch_num = cdc_dma_get_port_idx(kcontrol); - if (ch_num < 0) + if (ch_num < 0) { + pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num); return ch_num; + } cdc_dma_rx_cfg[ch_num].sample_rate = cdc_dma_get_sample_rate(ucontrol->value.enumerated.item[0]); @@ -1471,6 +1489,11 @@ static int cdc_dma_tx_ch_get(struct snd_kcontrol *kcontrol, { int ch_num = cdc_dma_get_port_idx(kcontrol); + if (ch_num < 0) { + pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num); + return ch_num; + } + pr_debug("%s: cdc_dma_tx_ch = %d\n", __func__, cdc_dma_tx_cfg[ch_num].channels); ucontrol->value.integer.value[0] = cdc_dma_tx_cfg[ch_num].channels - 1; @@ -1482,6 +1505,11 @@ static int cdc_dma_tx_ch_put(struct snd_kcontrol *kcontrol, { int ch_num = cdc_dma_get_port_idx(kcontrol); + if (ch_num < 0) { + pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num); + return ch_num; + } + cdc_dma_tx_cfg[ch_num].channels = ucontrol->value.integer.value[0] + 1; pr_debug("%s: cdc_dma_tx_ch = %d\n", __func__, @@ -1495,6 +1523,11 @@ static int cdc_dma_tx_sample_rate_get(struct snd_kcontrol *kcontrol, int sample_rate_val; int ch_num = cdc_dma_get_port_idx(kcontrol); + if (ch_num < 0) { + pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num); + return ch_num; + } + switch (cdc_dma_tx_cfg[ch_num].sample_rate) { case SAMPLING_RATE_384KHZ: sample_rate_val = 12; @@ -1551,6 +1584,11 @@ static int cdc_dma_tx_sample_rate_put(struct snd_kcontrol *kcontrol, { int ch_num = cdc_dma_get_port_idx(kcontrol); + if (ch_num < 0) { + pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num); + return ch_num; + } + switch (ucontrol->value.integer.value[0]) { case 12: cdc_dma_tx_cfg[ch_num].sample_rate = SAMPLING_RATE_384KHZ; @@ -1607,6 +1645,11 @@ static int cdc_dma_tx_format_get(struct snd_kcontrol *kcontrol, { int ch_num = cdc_dma_get_port_idx(kcontrol); + if (ch_num < 0) { + pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num); + return ch_num; + } + switch (cdc_dma_tx_cfg[ch_num].bit_format) { case SNDRV_PCM_FORMAT_S32_LE: ucontrol->value.integer.value[0] = 3; @@ -1635,6 +1678,11 @@ static int cdc_dma_tx_format_put(struct snd_kcontrol *kcontrol, int rc = 0; int ch_num = cdc_dma_get_port_idx(kcontrol); + if (ch_num < 0) { + pr_err("%s: ch_num: %d is invalid\n", __func__, ch_num); + return ch_num; + } + switch (ucontrol->value.integer.value[0]) { case 3: cdc_dma_tx_cfg[ch_num].bit_format = SNDRV_PCM_FORMAT_S32_LE;