A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 14:19:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "dsp: q6core: validate payload size before memory copy"

Browse source
This commit is contained in:
qctecmdr 2019-04-10 22:29:30 -07:00 • committed by Gerrit - the friendly Code Review server
commit d14c2dc368
1 changed files with 39 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

41
dsp/q6core.c
View file

@ -194,7 +194,7 @@ int q6core_send_uevent(struct audio_uevent_data *uevent_data, char *event)
}
EXPORT_SYMBOL(q6core_send_uevent);
static int parse_fwk_version_info(uint32_t *payload)
static int parse_fwk_version_info(uint32_t *payload, uint16_t payload_size)
{
size_t ver_size;
int num_services;
@ -207,6 +207,11 @@ static int parse_fwk_version_info(uint32_t *payload)
* Based on this info, we copy the payload into core
* avcs version info structure.
*/
if (payload_size < 5 * sizeof(uint32_t)) {
pr_err("%s: payload has invalid size %d\n",
__func__, payload_size);
return -EINVAL;
}
num_services = payload[4];
if (num_services > VSS_MAX_AVCS_NUM_SERVICES) {
pr_err("%s: num_services: %d greater than max services: %d\n",
@ -221,6 +226,12 @@ static int parse_fwk_version_info(uint32_t *payload)
ver_size = sizeof(struct avcs_get_fwk_version) +
num_services * sizeof(struct avs_svc_api_info);
if (payload_size < ver_size) {
pr_err("%s: payload has invalid size %d, expected size %zu\n",
__func__, payload_size, ver_size);
return -EINVAL;
}
q6core_lcl.q6core_avcs_ver_info.ver_info =
kzalloc(ver_size, GFP_ATOMIC);
if (q6core_lcl.q6core_avcs_ver_info.ver_info == NULL)
@ -257,6 +268,12 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
payload1 = data->payload;
if (data->payload_size < 2 * sizeof(uint32_t)) {
pr_err("%s: payload has invalid size %d\n",
__func__, data->payload_size);
return -EINVAL;
}
switch (payload1[0]) {
case AVCS_CMD_SHARED_MEM_UNMAP_REGIONS:
@ -347,6 +364,11 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
break;
}
case AVCS_CMDRSP_SHARED_MEM_MAP_REGIONS:
if (data->payload_size < sizeof(uint32_t)) {
pr_err("%s: payload has invalid size %d\n",
__func__, data->payload_size);
return -EINVAL;
}
payload1 = data->payload;
pr_debug("%s: AVCS_CMDRSP_SHARED_MEM_MAP_REGIONS handle %d\n",
__func__, payload1[0]);
@ -361,6 +383,11 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
}
break;
case AVCS_CMDRSP_CREATE_LPASS_NPA_CLIENT:
if (data->payload_size < 2 * sizeof(uint32_t)) {
pr_err("%s: payload has invalid size %d\n",
__func__, data->payload_size);
return -EINVAL;
}
payload1 = data->payload;
pr_debug("%s: AVCS_CMDRSP_CREATE_LPASS_NPA_CLIENT handle %d\n",
__func__, payload1[1]);
@ -370,6 +397,11 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
wake_up(&q6core_lcl.lpass_npa_rsc_wait);
break;
case AVCS_CMDRSP_ADSP_EVENT_GET_STATE:
if (data->payload_size < sizeof(uint32_t)) {
pr_err("%s: payload has invalid size %d\n",
__func__, data->payload_size);
return -EINVAL;
}
payload1 = data->payload;
q6core_lcl.param = payload1[0];
pr_debug("%s: Received ADSP get state response 0x%x\n",
@ -380,6 +412,11 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
wake_up(&q6core_lcl.bus_bw_req_wait);
break;
case AVCS_CMDRSP_GET_LICENSE_VALIDATION_RESULT:
if (data->payload_size < sizeof(uint32_t)) {
pr_err("%s: payload has invalid size %d\n",
__func__, data->payload_size);
return -EINVAL;
}
payload1 = data->payload;
pr_debug("%s: cmd = LICENSE_VALIDATION_RESULT, result = 0x%x\n",
__func__, payload1[0]);
@ -392,7 +429,7 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
pr_debug("%s: Received AVCS_CMDRSP_GET_FWK_VERSION\n",
__func__);
payload1 = data->payload;
ret = parse_fwk_version_info(payload1);
ret = parse_fwk_version_info(payload1, data->payload_size);
if (ret < 0) {
q6core_lcl.adsp_status = ret;
pr_err("%s: Failed to parse payload:%d\n",