dsp: asm: validate ADSP data size before access
Check the size of ADSP payload before accessing it. Validate buffer index obtained from ADSP token before using it. CRs-Fixed: 2372302 Change-Id: I3f5e1b6f515935a10a8c59c324452be0a71f9473 Signed-off-by: Vignesh Kulothungan <vigneshk@codeaurora.org>
This commit is contained in:
parent
8766446f90
commit
52b8722a94
25
dsp/q6asm.c
25
dsp/q6asm.c
@ -1950,9 +1950,10 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
|
||||
data->dest_port);
|
||||
if ((data->opcode != ASM_DATA_EVENT_RENDERED_EOS) &&
|
||||
(data->opcode != ASM_DATA_EVENT_EOS) &&
|
||||
(data->opcode != ASM_SESSION_EVENTX_OVERFLOW) &&
|
||||
(data->opcode != ASM_SESSION_EVENT_RX_UNDERFLOW)) {
|
||||
if (payload == NULL) {
|
||||
pr_err("%s: payload is null\n", __func__);
|
||||
if (payload == NULL || (data->payload_size < (2 * sizeof(uint32_t)))) {
|
||||
pr_err("%s: payload is null or invalid size[%d]\n", __func__, data->payload_size);
|
||||
spin_unlock_irqrestore(
|
||||
&(session[session_id].session_lock), flags);
|
||||
return -EINVAL;
|
||||
@ -2165,6 +2166,16 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
|
||||
}
|
||||
spin_lock_irqsave(&port->dsp_lock, dsp_flags);
|
||||
buf_index = asm_token._token.buf_index;
|
||||
if (buf_index < 0 || buf_index >= port->max_buf_cnt) {
|
||||
pr_debug("%s: Invalid buffer index %u\n",
|
||||
__func__, buf_index);
|
||||
spin_unlock_irqrestore(&port->dsp_lock,
|
||||
dsp_flags);
|
||||
spin_unlock_irqrestore(
|
||||
&(session[session_id].session_lock),
|
||||
flags);
|
||||
return -EINVAL;
|
||||
}
|
||||
if ( data->payload_size >= 2 * sizeof(uint32_t) &&
|
||||
(lower_32_bits(port->buf[buf_index].phys) !=
|
||||
payload[0] ||
|
||||
@ -2267,6 +2278,16 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
|
||||
}
|
||||
spin_lock_irqsave(&port->dsp_lock, dsp_flags);
|
||||
buf_index = asm_token._token.buf_index;
|
||||
if (buf_index < 0 || buf_index >= port->max_buf_cnt) {
|
||||
pr_debug("%s: Invalid buffer index %u\n",
|
||||
__func__, buf_index);
|
||||
spin_unlock_irqrestore(&port->dsp_lock,
|
||||
dsp_flags);
|
||||
spin_unlock_irqrestore(
|
||||
&(session[session_id].session_lock),
|
||||
flags);
|
||||
return -EINVAL;
|
||||
}
|
||||
port->buf[buf_index].used = 0;
|
||||
if (lower_32_bits(port->buf[buf_index].phys) !=
|
||||
payload[READDONE_IDX_BUFADD_LSW] ||
|
||||
|
Loading…
Reference in New Issue
Block a user