From 3552462ec524404fcbbfa85aa5d17e334bbb7805 Mon Sep 17 00:00:00 2001 From: Vignesh Kulothungan Date: Tue, 22 Jan 2019 11:13:09 -0800 Subject: [PATCH] dsp: adm: validate ADSP payload size before access Check the size of ADSP payload before accessing it. CRs-Fixed: 2380694 Change-Id: Ib0c0f0bf6c7f7cf659df0eb70a3f66cee580cb66 Signed-off-by: Vignesh Kulothungan --- dsp/q6adm.c | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/dsp/q6adm.c b/dsp/q6adm.c index 688012f727d9..7cc8e9b4cf0e 100644 --- a/dsp/q6adm.c +++ b/dsp/q6adm.c @@ -1317,12 +1317,22 @@ static int adm_process_get_param_response(u32 opcode, u32 idx, u32 *payload, switch (opcode) { case ADM_CMDRSP_GET_PP_PARAMS_V5: struct_size = sizeof(struct adm_cmd_rsp_get_pp_params_v5); + if (payload_size < struct_size) { + pr_err("%s: payload size %d < expected size %d\n", + __func__, payload_size, struct_size); + break; + } v5_rsp = (struct adm_cmd_rsp_get_pp_params_v5 *) payload; data_size = v5_rsp->param_hdr.param_size; param_data = v5_rsp->param_data; break; case ADM_CMDRSP_GET_PP_PARAMS_V6: struct_size = sizeof(struct adm_cmd_rsp_get_pp_params_v6); + if (payload_size < struct_size) { + pr_err("%s: payload size %d < expected size %d\n", + __func__, payload_size, struct_size); + break; + } v6_rsp = (struct adm_cmd_rsp_get_pp_params_v6 *) payload; data_size = v6_rsp->param_hdr.param_size; param_data = v6_rsp->param_data; @@ -1518,6 +1528,11 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv) return 0; } if (data->opcode == APR_BASIC_RSP_RESULT) { + if (data->payload_size < (2 * sizeof(uint32_t))) { + pr_err("%s: Invalid payload size %d\n", __func__, + data->payload_size); + return 0; + } pr_debug("%s: APR_BASIC_RSP_RESULT id 0x%x\n", __func__, payload[0]); if (payload[1] != 0) { @@ -1644,9 +1659,14 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv) case ADM_CMDRSP_DEVICE_OPEN_V5: case ADM_CMDRSP_DEVICE_OPEN_V6: case ADM_CMDRSP_DEVICE_OPEN_V8: { - struct adm_cmd_rsp_device_open_v5 *open = - (struct adm_cmd_rsp_device_open_v5 *)data->payload; - + struct adm_cmd_rsp_device_open_v5 *open = NULL; + if (data->payload_size < + sizeof(struct adm_cmd_rsp_device_open_v5)) { + pr_err("%s: Invalid payload size %d\n", __func__, + data->payload_size); + return 0; + } + open = (struct adm_cmd_rsp_device_open_v5 *)data->payload; if (open->copp_id == INVALID_COPP_ID) { pr_err("%s: invalid coppid rxed %d\n", __func__, open->copp_id);