A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge tag 'LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel into android13-5.4-lahaina

Browse source 
"LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0"

* tag 'LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
  dsp: q6voice: Add buf size check for cvp cal data
  asoc: msm-lsm-client: check for param size before copying

Change-Id: Ia786a33ae66c307d1af54b84796178928cf6ca01
This commit is contained in:
Michael Bestas 2024-10-01 11:18:40 +03:00 • committed by Alexander Winkowski
commit d600185073
No known key found for this signature in database
GPG key ID: 72762A66704CDE44
2 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
techpack/audio/asoc/msm-lsm-client.c
View file

@ -830,6 +830,13 @@ static int msm_lsm_reg_model(struct snd_pcm_substream *substream,
q6lsm_sm_set_param_data(client, p_info, &offset, sm);
if ((sm->size - offset) < p_info->param_size) {
dev_err(rtd->dev, "%s: user buff size is greater than expected\n",
__func__);
rc = -EINVAL;
goto err_copy;
}
/*
* For set_param, advance the sound model data with the
* number of bytes required by param_data.

14
techpack/audio/dsp/q6voice.c
View file

@ -3322,6 +3322,13 @@ static int voice_send_cvp_register_cal_cmd(struct voice_data *v)
voc_get_session_name(v->session_id), v->dev_tx.dev_id,
v->dev_rx.dev_id);
if (col_data->cal_data.size >= MAX_COL_INFO_SIZE) {
pr_err("%s: Invalid cal data size %d!\n",
__func__, col_data->cal_data.size);
ret = -EINVAL;
goto unlock;
}
memcpy(&cvp_reg_cal_cmd.cvp_cal_data.column_info[0],
(void *) &((struct audio_cal_info_voc_col *)
col_data->cal_info)->data,
@ -3519,6 +3526,13 @@ static int voice_send_cvp_register_vol_cal_cmd(struct voice_data *v)
goto unlock;
}
if (col_data->cal_data.size >= MAX_COL_INFO_SIZE) {
pr_err("%s: Invalid cal data size %d!\n",
__func__, col_data->cal_data.size);
ret = -EINVAL;
goto unlock;
}
memcpy(&cvp_reg_vol_cal_cmd.cvp_vol_cal_data.column_info[0],
(void *) &((struct audio_cal_info_voc_col *)
col_data->cal_info)->data,