There is no check for voip pkt pkt_len,if it contains the
min required data. This can lead to integer underflow.
Add check for the same.
Change-Id: I4f57eb125967d52ad8da60d21a440af1f81d2579
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
There is no check for the copy data size of the
ADSP returned payload. Add check for the max
hpcm_buf_node size before copy to avoid
buffer out of bounds issue.
Change-Id: Id647888430ce302359a857ef54d321bee99889bf
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
"num_services", a signed integer when compared
with constant results in conversion of signed integer
to max possible unsigned int value when "num_services"
is a negative value. This can lead to OOB read.
Fix is to handle this case.
Change-Id: Id6a8f150d9019c972a87f789e4c626337a97bfff
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
Check for the max size of cvs command register
calibration data that can be copied else will
result in buffer overflow.
Change-Id: Id7a4c5a9795143798b68dfde779f17fb450e3848
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
There is no error check for case when hpcm_start
is called for the same RX or TX tap points multiple times.
This can result in OOB access of struct vss_ivpcm_tap_point.
Handle this scenario with appropriate no_of_tp check.
Change-Id: Ib384d21c9bf372f3e5d78f64b5c056e836728399
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
Conversion of negative "num_modules" var value
will result in max possible unsigned int value
and hence can cause mem corruption when accessed.
Resolve this by assigning the same data type
to "num_modules" var as used in the calling fn.
Change-Id: I4c9d7215b9c7345637e1eb3a1992a41fef71c5cb
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
Due to incorrect check for buffer size calculation during partial buffer size check,
which is part of code for gapless playback support in GKI mode,
partial buffers are missed from sending to DSP causing buffer handling issues.
Change-Id: Ic6f5a3ce6958ddc94dc7bb7e92ebb778aa13cb64
Signed-off-by: Shalini Manjunatha <quic_c_shalma@quicinc.com>
There is a possibility where an access
to /dev/msm_audio_cal from third party
could pass negative size which would
lead to crash.
Avoid this by negative value size check.
Change-Id: Id36c5f10dccbd7d0ee85aa3310badec6815237a2
Signed-off-by: Sujin Panicker <quic_spanic@quicinc.com>
Update proper description to explain
the usage of endpoint ID 2.
Change-Id: I45a52ef43c3fcd42f97de37e7bb80517dfe09db3
Signed-off-by: Manoj Kumar N D <quic_mnd@quicinc.com>
Mark the used cal block as stale so that it is not reused.
Change-Id: I142d21d6d32a1b5ad24c3a2708b1df023d70947e
Signed-off-by: Manoj Kumar N D <quic_mnd@quicinc.com>
Hdmi-in used QUAD-I2S to input, need configure I2S
to slave mode.
Change-Id: I1d27d51c766538bb8f61cd74c5dcb6cc18954e81
Signed-off-by: ronghuiz <quic_ronghuiz@quicinc.com>
Check if pm_qos_req is active before removal.
Change-Id: I0076a73ffa6310dbb4cb207ca7a651aa1d3fdf04
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
Current logic copies user buf size of data
from the avail dsp buf at a given offset.
If this offset returned from DSP in READ_DONE event
goes out of bounds or is corrupted, then it can lead to
out of bounds DSP buffer access, resulting in memory fault.
Fix is to add check for this buf offset, if it is within
the buf size range.
Change-Id: I7753cc6db394704dbb959477150141d42b836bef
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
After freeing up the memory assign null to the pointer
that had the address.
Change-Id: I242a936c434dc449ec9fd19b0c34e843c3cf0913
Signed-off-by: Manoj Kumar N D <quic_mnd@quicinc.com>
Channel mixer has to sent while the sound devices are rerouted
as capture/playback prepare will not be called during rerouting.
Change-Id: I8473d89c7aff9f5f2a1dd2f3f4a8fa5d387b2429
Signed-off-by: Manoj Kumar N D <quic_mnd@quicinc.com>
When wcd is disabled, due to incorrect swr port map
being set, crash is seen. Hence set correct default
port map for SWR through corresponding bolero macro.
Change-Id: Ib17642832f98fb47c9e571cf7763f38a191bdfba
Signed-off-by: Shalini Manjunatha <quic_c_shalma@quicinc.com>
Whenever MBHC is disabled through kernel config file,
particular vaiable of mbhc is not guarded for NULL
pointer check causing kernel panic,
Hence add NULL check for that pointer variable.
Change-Id: Iae4950ceb076239a130b4f033cb2f08cd65a92a9
Signed-off-by: Shalini Manjunatha <quic_c_shalma@quicinc.com>
Enable the mclk after the ssr for audio bring up in 6155.
Change-Id: I87d5bb2d16a24fd9618eae08e4be75f116ae1a5b
Signed-off-by: Manoj Kumar N D <quic_mnd@quicinc.com>
Added support for "ADM_CMD_REGISTER_EVENT" and "ADM_PP_EVENT"
events.
Signed-off-by: Srinivasa Reddy M N <quic_c_mullan@quicinc.com>
Change-Id: I80d8dc6d9fccdac67ea616d19415aa2133a3f370
voice_map_cal_memory is already under
locked context of common_lock from fn
voc_register_vocproc_vol_table from where
it is invoked.
Remove locking the same lock again in
voice_map_cal_memory to avoid deadlock.
Change-Id: Ibd6c7169377418c7bda3310a0e422279fd4e7295
Amic2 recording is failing due to missing of mixer controls.
Change is to add support of ADC and DMIC control for swr master
channel map.
Change-Id: I0377ec84a49d2eaa390872a29e2d8cf8909794b1
Signed-off-by: Hari Krishna Chowdary Yennana <quic_hyennnan@quicinc.com>
