Merge "dsp: asm: Add check for num_channels before calling q6asm_map_channels"
diff --git a/asoc/msm-qti-pp-config.c b/asoc/msm-qti-pp-config.c
index ee31848..ab64e47 100644
--- a/asoc/msm-qti-pp-config.c
+++ b/asoc/msm-qti-pp-config.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -998,6 +998,13 @@
}
event_data = (struct msm_adsp_event_data *)payload;
+ if (event_data->payload_len < sizeof(struct msm_adsp_event_data)) {
+ pr_err("%s: event_data size of %x is less than expected.\n",
+ __func__, event_data->payload_len);
+ ret = -EINVAL;
+ goto done;
+ }
+
kctl->info(kctl, &kctl_info);
if (event_data->payload_len >
diff --git a/dsp/q6afe.c b/dsp/q6afe.c
index ce67a19..4ecceff 100644
--- a/dsp/q6afe.c
+++ b/dsp/q6afe.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -300,6 +300,15 @@
return 0;
}
+static bool afe_token_is_valid(uint32_t token)
+{
+ if (token >= AFE_MAX_PORTS) {
+ pr_err("%s: token %d is invalid.\n", __func__, token);
+ return false;
+ }
+ return true;
+}
+
static int32_t afe_callback(struct apr_client_data *data, void *priv)
{
if (!data) {
@@ -374,7 +383,10 @@
data->payload_size))
return -EINVAL;
}
- wake_up(&this_afe.wait[data->token]);
+ if (afe_token_is_valid(data->token))
+ wake_up(&this_afe.wait[data->token]);
+ else
+ return -EINVAL;
} else if (data->payload_size) {
uint32_t *payload;
uint16_t port_id = 0;
@@ -405,7 +417,10 @@
case AFE_PORTS_CMD_DTMF_CTL:
case AFE_SVC_CMD_SET_PARAM:
atomic_set(&this_afe.state, 0);
- wake_up(&this_afe.wait[data->token]);
+ if (afe_token_is_valid(data->token))
+ wake_up(&this_afe.wait[data->token]);
+ else
+ return -EINVAL;
break;
case AFE_SERVICE_CMD_REGISTER_RT_PORT_DRIVER:
break;
@@ -417,7 +432,10 @@
break;
case AFE_CMD_ADD_TOPOLOGIES:
atomic_set(&this_afe.state, 0);
- wake_up(&this_afe.wait[data->token]);
+ if (afe_token_is_valid(data->token))
+ wake_up(&this_afe.wait[data->token]);
+ else
+ return -EINVAL;
pr_debug("%s: AFE_CMD_ADD_TOPOLOGIES cmd 0x%x\n",
__func__, payload[1]);
break;
@@ -439,7 +457,10 @@
else
this_afe.mmap_handle = payload[0];
atomic_set(&this_afe.state, 0);
- wake_up(&this_afe.wait[data->token]);
+ if (afe_token_is_valid(data->token))
+ wake_up(&this_afe.wait[data->token]);
+ else
+ return -EINVAL;
} else if (data->opcode == AFE_EVENT_RT_PROXY_PORT_STATUS) {
port_id = (uint16_t)(0x0000FFFF & payload[0]);
}