From 1467eda53b2c3a603b3ea99fd6a1ba05987785d3 Mon Sep 17 00:00:00 2001 From: Shalini Manjunatha Date: Mon, 11 Jul 2022 16:24:15 +0530 Subject: [PATCH 01/10] soc: swr-mstr: Store and compare dev_addr along with dev_num -> If enumeration is changed runtime, dev_num gets changed -> so it might result in different dev_num for same device -> between swrm_connect_port and swr_disconnect_port while powering up and down of widget -> This results in not emptying the port_req list, hence swrm not going to suspend state -> This results into adsp not going to sleep state Change-Id: I80326a35f0cac7f7be30cbbee119a8ba247a0f76 --- include/soc/soundwire.h | 3 +++ soc/soundwire.c | 5 +++++ soc/swr-mstr-ctrl.c | 10 ++++++---- 3 files changed, 14 insertions(+), 4 deletions(-) diff --git a/include/soc/soundwire.h b/include/soc/soundwire.h index 3e61da12b1dd..7b69d1a896fe 100644 --- a/include/soc/soundwire.h +++ b/include/soc/soundwire.h @@ -1,6 +1,7 @@ /* SPDX-License-Identifier: GPL-2.0-only */ /* * Copyright (c) 2015-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. */ #ifndef _LINUX_SOUNDWIRE_H @@ -83,6 +84,7 @@ struct swr_port_info { u8 req_ch; u8 num_ch; u32 ch_rate; + u64 dev_addr; }; /* @@ -107,6 +109,7 @@ struct swr_params { u32 ch_rate[SWR_MAX_DEV_PORT_NUM]; u8 ch_en[SWR_MAX_DEV_PORT_NUM]; u8 port_type[SWR_MAX_DEV_PORT_NUM]; + u64 dev_addr; }; /* diff --git a/soc/soundwire.c b/soc/soundwire.c index 2aa3ba4bdae0..f3688b0158b7 100644 --- a/soc/soundwire.c +++ b/soc/soundwire.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2015-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -363,6 +364,8 @@ int swr_connect_port(struct swr_device *dev, u8 *port_id, u8 num_port, txn->tid = i; txn->dev_num = dev->dev_num; + //assign device addr also, as dev_num can dynamically change during device enumeration + txn->dev_addr = dev->addr; txn->num_port = num_port; for (i = 0; i < num_port; i++) { txn->port_id[i] = port_id[i]; @@ -442,6 +445,8 @@ int swr_disconnect_port(struct swr_device *dev, u8 *port_id, u8 num_port, txn->tid = i; txn->dev_num = dev->dev_num; + //assign device address as dev_num can change dynamically during device enumeration + txn->dev_addr = dev->addr; txn->num_port = num_port; for (i = 0; i < num_port; i++) { txn->port_id[i] = port_id[i]; diff --git a/soc/swr-mstr-ctrl.c b/soc/swr-mstr-ctrl.c index 4cdb3f500cfc..09d382a125e7 100644 --- a/soc/swr-mstr-ctrl.c +++ b/soc/swr-mstr-ctrl.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -1098,14 +1099,14 @@ static void swrm_switch_frame_shape(struct swr_mstr_ctrl *swrm, int mclk_freq) } static struct swr_port_info *swrm_get_port_req(struct swrm_mports *mport, - u8 slv_port, u8 dev_num) + u8 slv_port, u8 dev_num, u64 dev_addr) { struct swr_port_info *port_req = NULL; list_for_each_entry(port_req, &mport->port_req_list, list) { /* Store dev_id instead of dev_num if enumeration is changed run_time */ if ((port_req->slave_port_id == slv_port) - && (port_req->dev_num == dev_num)) + && ((port_req->dev_num == dev_num) || (port_req->dev_addr == dev_addr))) return port_req; } return NULL; @@ -1631,7 +1632,7 @@ static int swrm_connect_port(struct swr_master *master, mport = &(swrm->mport_cfg[mstr_port_id]); /* get port req */ port_req = swrm_get_port_req(mport, portinfo->port_id[i], - portinfo->dev_num); + portinfo->dev_num, portinfo->dev_addr); if (!port_req) { dev_dbg(&master->dev, "%s: new req:port id %d dev %d\n", __func__, portinfo->port_id[i], @@ -1643,6 +1644,7 @@ static int swrm_connect_port(struct swr_master *master, goto mem_fail; } port_req->dev_num = portinfo->dev_num; + port_req->dev_addr = portinfo->dev_addr; port_req->slave_port_id = portinfo->port_id[i]; port_req->num_ch = portinfo->num_ch[i]; port_req->ch_rate = portinfo->ch_rate[i]; @@ -1719,7 +1721,7 @@ static int swrm_disconnect_port(struct swr_master *master, mport = &(swrm->mport_cfg[mstr_port_id]); /* get port req */ port_req = swrm_get_port_req(mport, portinfo->port_id[i], - portinfo->dev_num); + portinfo->dev_num, portinfo->dev_addr); if (!port_req) { dev_err(&master->dev, "%s:port not enabled : port %d\n", From 8adb07db5cd865ff2c49acca8b5251951fbb4f30 Mon Sep 17 00:00:00 2001 From: Soumya Managoli Date: Mon, 17 Apr 2023 17:02:59 +0530 Subject: [PATCH 02/10] ASoC: msm-pcm-voip: Avoid interger underflow There is no check for voip pkt pkt_len,if it contains the minimum required data. This can lead to integer underflow. Add check for the same. Change-Id: I4f57eb125967d52ad8da60d21a440af1f81d2579 Signed-off-by: Soumya Managoli --- asoc/msm-pcm-voip-v2.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/asoc/msm-pcm-voip-v2.c b/asoc/msm-pcm-voip-v2.c index e2ad13b4cc6c..d2f4e0b654d7 100644 --- a/asoc/msm-pcm-voip-v2.c +++ b/asoc/msm-pcm-voip-v2.c @@ -1,5 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved. + * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -365,6 +366,13 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt, switch (prtd->mode) { case MODE_AMR_WB: case MODE_AMR: { + if (pkt_len <= DSP_FRAME_HDR_LEN) { + pr_err("%s: pkt_len %d is < required len\n", + __func__, pkt_len); + spin_unlock_irqrestore(&prtd->dsp_ul_lock, + dsp_flags); + return; + } /* Remove the DSP frame info header. Header format: * Bits 0-3: Frame rate * Bits 4-7: Frame type @@ -385,6 +393,13 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt, case MODE_4GV_NB: case MODE_4GV_WB: case MODE_4GV_NW: { + if (pkt_len <= DSP_FRAME_HDR_LEN) { + pr_err("%s: pkt_len %d is < required len\n", + __func__, pkt_len); + spin_unlock_irqrestore(&prtd->dsp_ul_lock, + dsp_flags); + return; + } /* Remove the DSP frame info header. * Header format: * Bits 0-3: frame rate @@ -422,6 +437,13 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt, buf_node->frame.frm_hdr.timestamp = timestamp; voc_pkt = voc_pkt + DSP_FRAME_HDR_LEN; + if (pkt_len <= 2 * DSP_FRAME_HDR_LEN) { + pr_err("%s: pkt_len %d is < required len\n", + __func__, pkt_len); + spin_unlock_irqrestore(&prtd->dsp_ul_lock, + dsp_flags); + return; + } /* There are two frames in the buffer. Length of the * first frame: */ @@ -457,6 +479,13 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt, buf_node->frame.frm_hdr.timestamp = timestamp; voc_pkt = voc_pkt + DSP_FRAME_HDR_LEN; + if (pkt_len <= 2 * DSP_FRAME_HDR_LEN) { + pr_err("%s: pkt_len %d is < required len\n", + __func__, pkt_len); + spin_unlock_irqrestore(&prtd->dsp_ul_lock, + dsp_flags); + return; + } /* There are two frames in the buffer. Length * of the second frame: */ From b151cf06fd19ff57e2b6cc2e75ff3de227eb3c6d Mon Sep 17 00:00:00 2001 From: Soumya Managoli Date: Mon, 24 Jul 2023 16:14:09 +0530 Subject: [PATCH 03/10] dsp: q6lsm: Add check for payload buffer Check get_param_payload buffer ptr before accessing. Change-Id: I5470983188dffeec14965a5cdec30747b98735e7 Signed-off-by: Soumya Managoli (cherry picked from commit df9a245be1438e93602f12db26bc3f1164beaf56) --- dsp/q6lsm.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/dsp/q6lsm.c b/dsp/q6lsm.c index 3ebf79336afc..5d56d0c2d629 100644 --- a/dsp/q6lsm.c +++ b/dsp/q6lsm.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2013-2020, Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include #include @@ -235,6 +236,11 @@ static int q6lsm_callback(struct apr_client_data *data, void *priv) goto done; } + if (!client->get_param_payload) { + pr_err("%s: invalid get_param_payload buffer ptr\n", __func__); + ret = -EINVAL; + goto done; + } memcpy((u8 *)client->get_param_payload, (u8 *)payload + payload_min_size_expected, param_size); done: From ee7a233b113838c54a62056f6385bacf605d5f04 Mon Sep 17 00:00:00 2001 From: Soumya Managoli Date: Mon, 24 Jul 2023 14:40:11 +0530 Subject: [PATCH 04/10] ASoC: Resolve use after free in listen sound client Updated get_param_payload buffer ptr to NULL after free to avoid use after free issue. Change-Id: I86da8c12a0bdccce690f67b037198b67640e339b Signed-off-by: Soumya Managoli (cherry picked from commit f10c5fa0b84902deee22fcbf54a5f6b56055fd4f) --- asoc/msm-lsm-client.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/asoc/msm-lsm-client.c b/asoc/msm-lsm-client.c index 77b25de138c1..43b8dab7cda5 100644 --- a/asoc/msm-lsm-client.c +++ b/asoc/msm-lsm-client.c @@ -2112,6 +2112,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, case SNDRV_LSM_GET_MODULE_PARAMS_32: { struct lsm_params_get_info_32 p_info_32, *param_info_rsp = NULL; struct lsm_params_get_info *p_info = NULL; + prtd->lsm_client->get_param_payload = NULL; memset(&p_info_32, 0 , sizeof(p_info_32)); if (!prtd->lsm_client->use_topology) { @@ -2162,6 +2163,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, __func__, err); kfree(p_info); kfree(prtd->lsm_client->get_param_payload); + prtd->lsm_client->get_param_payload = NULL; goto done; } @@ -2172,6 +2174,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, err = -ENOMEM; kfree(p_info); kfree(prtd->lsm_client->get_param_payload); + prtd->lsm_client->get_param_payload = NULL; goto done; } @@ -2196,6 +2199,7 @@ free: kfree(p_info); kfree(param_info_rsp); kfree(prtd->lsm_client->get_param_payload); + prtd->lsm_client->get_param_payload = NULL; break; } case SNDRV_LSM_REG_SND_MODEL_V2: @@ -2407,6 +2411,7 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, case SNDRV_LSM_GET_MODULE_PARAMS: { struct lsm_params_get_info temp_p_info, *p_info = NULL; + prtd->lsm_client->get_param_payload = NULL; memset(&temp_p_info, 0, sizeof(temp_p_info)); if (!prtd->lsm_client->use_topology) { @@ -2478,6 +2483,7 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, free: kfree(p_info); kfree(prtd->lsm_client->get_param_payload); + prtd->lsm_client->get_param_payload = NULL; break; } case SNDRV_LSM_EVENT_STATUS: From 00f847b20aefa53fb21ff127a1a34156597b0b16 Mon Sep 17 00:00:00 2001 From: Raza Kamal Date: Mon, 4 Dec 2023 15:33:09 +0530 Subject: [PATCH 05/10] Audio legacy: Integer overflow in msm_lsm_ioctl_compat during audio playback usecase. size = sizeof(p_info_32) + p_info_32.param_size; This overflow issue may result heap overflow during copying the data: memcpy(param_info_rsp, &p_info_32, sizeof(p_info_32)); The validation check is added so that heap overflow can be avoided. Change-Id: I11dcbe7ebb33e349dfd9f347f3ef25bc781075fc Signed-off-by: Raza Kamal (cherry picked from commit 94d98318711f926bdeff0474d5970c18ee90f1a4) --- asoc/msm-lsm-client.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/asoc/msm-lsm-client.c b/asoc/msm-lsm-client.c index f4a8dbdce4fd..409edb3b1d5e 100644 --- a/asoc/msm-lsm-client.c +++ b/asoc/msm-lsm-client.c @@ -2167,8 +2167,13 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, prtd->lsm_client->get_param_payload = NULL; goto done; } + if (__builtin_uadd_overflow(sizeof(p_info_32), p_info_32.param_size, &size)) { + pr_err("%s: param size exceeds limit of %u bytes.\n", + __func__, UINT_MAX); + err = -EINVAL; + goto done; + } - size = sizeof(p_info_32) + p_info_32.param_size; param_info_rsp = kzalloc(size, GFP_KERNEL); if (!param_info_rsp) { From 13cc6ff432fa70c7341492bbe8abe7e7ac1bea7d Mon Sep 17 00:00:00 2001 From: Kumar Anurag Singh Date: Thu, 4 Apr 2024 21:27:36 -0700 Subject: [PATCH 06/10] Fix for OOB access issue Added payload size check to avoid OOB read issues. Change-Id: I4f15bdfdcf15e388ebc49dd0e8cf7a99ed03d0d5 Signed-off-by: Kumar Anurag Singh (cherry picked from commit fb09ec8587ea689fc274c0e1b9d096b55cea36c8) --- dsp/q6adm.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/dsp/q6adm.c b/dsp/q6adm.c index e63547d85738..b5c7f4852f40 100644 --- a/dsp/q6adm.c +++ b/dsp/q6adm.c @@ -1592,16 +1592,11 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv) if (data->opcode == APR_BASIC_RSP_RESULT) { pr_debug("%s: APR_BASIC_RSP_RESULT id 0x%x\n", __func__, payload[0]); - - if (!((client_id != ADM_CLIENT_ID_SOURCE_TRACKING) && - ((payload[0] == ADM_CMD_SET_PP_PARAMS_V5) || - (payload[0] == ADM_CMD_SET_PP_PARAMS_V6)))) { - if (data->payload_size < - (2 * sizeof(uint32_t))) { - pr_err("%s: Invalid payload size %d\n", - __func__, data->payload_size); - return 0; - } + if (data->payload_size < + (2 * sizeof(uint32_t))) { + pr_err("%s: Invalid payload size %d\n", + __func__, data->payload_size); + return 0; } if (payload[1] != 0) { From 023e84c3b070726843cf28f7ad4b777fbb388037 Mon Sep 17 00:00:00 2001 From: Kumar Anurag Singh Date: Mon, 15 Apr 2024 00:50:50 -0700 Subject: [PATCH 07/10] dsp: q6lsm: Check size of payload before access check size of payload before access in q6lsm_mmapcallback. Change-Id: I6a755ca4cf54078f0d00f38e303f1b1da29b244c Signed-off-by: Kumar Anurag Singh --- dsp/q6lsm.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/dsp/q6lsm.c b/dsp/q6lsm.c index 5d56d0c2d629..109b03426ce0 100644 --- a/dsp/q6lsm.c +++ b/dsp/q6lsm.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2013-2020, Linux Foundation. All rights reserved. - * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved. */ #include #include @@ -2036,6 +2036,12 @@ static int q6lsm_mmapcallback(struct apr_client_data *data, void *priv) return 0; } + if (data->payload_size < (2 * sizeof(uint32_t))) { + pr_err("%s: payload has invalid size[%d]\n", __func__, + data->payload_size); + return -EINVAL; + } + command = payload[0]; retcode = payload[1]; sid = (data->token >> 8) & 0x0F; From 5a053fff75f65dd32aa0aa225c9a1b6c4c5dd15a Mon Sep 17 00:00:00 2001 From: Ramireddy KrishnaKanth Reddy Date: Wed, 1 May 2024 09:51:35 +0530 Subject: [PATCH 08/10] dsp: q6voice: Adds checks for an integer overflow there is no check for cvs_voc_pkt[2],when recieves 0xffffffff from ADSP which results in an integer overflow Fix is to address this. Change-Id: Ie935dd8823981ec260d77f5117f4ef0b0fc08f60 Signed-off-by: Ramireddy KrishnaKanth Reddy --- dsp/q6voice.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/dsp/q6voice.c b/dsp/q6voice.c index ee16121c15a1..d53b556e5d32 100644 --- a/dsp/q6voice.c +++ b/dsp/q6voice.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2012-2019, The Linux Foundation. All rights reserved. + * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved. */ #include #include @@ -7917,7 +7918,7 @@ static int32_t qdsp_cvs_callback(struct apr_client_data *data, void *priv) VSS_ISTREAM_EVT_OOB_NOTIFY_ENC_BUFFER_READY) { int ret = 0; u16 cvs_handle; - uint32_t *cvs_voc_pkt; + uint32_t *cvs_voc_pkt, tot_buf_sz; struct cvs_enc_buffer_consumed_cmd send_enc_buf_consumed_cmd; void *apr_cvs; @@ -7946,9 +7947,14 @@ static int32_t qdsp_cvs_callback(struct apr_client_data *data, void *priv) VSS_ISTREAM_EVT_OOB_NOTIFY_ENC_BUFFER_CONSUMED; cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data; + + if (__builtin_add_overflow(cvs_voc_pkt[2], 3 * sizeof(uint32_t), &tot_buf_sz)) { + pr_err("%s: integer overflow detected\n", __func__); + return -EINVAL; + } + if (cvs_voc_pkt != NULL && common.mvs_info.ul_cb != NULL) { - if (v->shmem_info.sh_buf.buf[1].size < - ((3 * sizeof(uint32_t)) + cvs_voc_pkt[2])) { + if (v->shmem_info.sh_buf.buf[1].size < tot_buf_sz) { pr_err("%s: invalid voc pkt size\n", __func__); return -EINVAL; } From 4057fed18811ad7b9e28b5019503798d3a2e3ac6 Mon Sep 17 00:00:00 2001 From: Abinath S Date: Fri, 10 May 2024 12:17:37 +0530 Subject: [PATCH 09/10] asoc: Fix out-of-bound write Modified check to avoid out-of-bound write. Change-Id: Ife5454d8de74b603291d3c129f03f1b901c6de8b Signed-off-by: Abinath S --- asoc/msm-compress-q6-v2.c | 5 +++-- asoc/msm-pcm-routing-v2.c | 6 +++--- asoc/msm-qti-pp-config.c | 3 ++- 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/asoc/msm-compress-q6-v2.c b/asoc/msm-compress-q6-v2.c index b34202cb1d13..fb490a0f30cc 100644 --- a/asoc/msm-compress-q6-v2.c +++ b/asoc/msm-compress-q6-v2.c @@ -1,5 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. */ @@ -3949,7 +3950,7 @@ static int msm_compr_channel_map_put(struct snd_kcontrol *kcontrol, pr_debug("%s: fe_id- %llu\n", __func__, fe_id); - if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) { + if (fe_id >= MSM_FRONTEND_DAI_MAX) { pr_err("%s Received out of bounds fe_id %llu\n", __func__, fe_id); rc = -EINVAL; @@ -3991,7 +3992,7 @@ static int msm_compr_channel_map_get(struct snd_kcontrol *kcontrol, int rc = 0, i; pr_debug("%s: fe_id- %llu\n", __func__, fe_id); - if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) { + if (fe_id >= MSM_FRONTEND_DAI_MAX) { pr_err("%s: Received out of bounds fe_id %llu\n", __func__, fe_id); rc = -EINVAL; diff --git a/asoc/msm-pcm-routing-v2.c b/asoc/msm-pcm-routing-v2.c index 868e254c97a0..cda94df2f156 100644 --- a/asoc/msm-pcm-routing-v2.c +++ b/asoc/msm-pcm-routing-v2.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022,2024 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -1649,7 +1649,7 @@ static int msm_pcm_routing_channel_mixer_v2(int fe_id, bool perf_mode, int j = 0, be_id = 0; int ret = 0; - if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) { + if (fe_id >= MSM_FRONTEND_DAI_MAX) { pr_err("%s: invalid FE %d\n", __func__, fe_id); return 0; } @@ -1716,7 +1716,7 @@ static int msm_pcm_routing_channel_mixer(int fe_id, bool perf_mode, return ret; } - if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) { + if (fe_id >= MSM_FRONTEND_DAI_MAX) { pr_err("%s: invalid FE %d\n", __func__, fe_id); return 0; } diff --git a/asoc/msm-qti-pp-config.c b/asoc/msm-qti-pp-config.c index 1bafb20275b1..2682e9eff9a2 100644 --- a/asoc/msm-qti-pp-config.c +++ b/asoc/msm-qti-pp-config.c @@ -1,5 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -179,7 +180,7 @@ static int msm_qti_pp_put_dtmf_module_enable fe_id = ((struct soc_multi_mixer_control *) kcontrol->private_value)->shift; - if (fe_id >= MSM_FRONTEND_DAI_MM_SIZE) { + if (fe_id >= MSM_FRONTEND_DAI_MAX) { pr_err("%s: invalid FE %d\n", __func__, fe_id); return -EINVAL; } From c9070e358540883fb5e22c376f04393cb2aa1161 Mon Sep 17 00:00:00 2001 From: Ramireddy KrishnaKanth Reddy Date: Wed, 1 May 2024 09:51:35 +0530 Subject: [PATCH 10/10] dsp: q6voice: Adds checks for an integer overflow there is no check for cvs_voc_pkt[2],when recieves 0xffffffff from ADSP which results in an integer overflow Fix is to address this. Change-Id: Ie935dd8823981ec260d77f5117f4ef0b0fc08f60 Signed-off-by: Ramireddy KrishnaKanth Reddy (cherry picked from commit 5a053fff75f65dd32aa0aa225c9a1b6c4c5dd15a) --- dsp/q6voice.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/dsp/q6voice.c b/dsp/q6voice.c index ee16121c15a1..d53b556e5d32 100644 --- a/dsp/q6voice.c +++ b/dsp/q6voice.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2012-2019, The Linux Foundation. All rights reserved. + * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved. */ #include #include @@ -7917,7 +7918,7 @@ static int32_t qdsp_cvs_callback(struct apr_client_data *data, void *priv) VSS_ISTREAM_EVT_OOB_NOTIFY_ENC_BUFFER_READY) { int ret = 0; u16 cvs_handle; - uint32_t *cvs_voc_pkt; + uint32_t *cvs_voc_pkt, tot_buf_sz; struct cvs_enc_buffer_consumed_cmd send_enc_buf_consumed_cmd; void *apr_cvs; @@ -7946,9 +7947,14 @@ static int32_t qdsp_cvs_callback(struct apr_client_data *data, void *priv) VSS_ISTREAM_EVT_OOB_NOTIFY_ENC_BUFFER_CONSUMED; cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data; + + if (__builtin_add_overflow(cvs_voc_pkt[2], 3 * sizeof(uint32_t), &tot_buf_sz)) { + pr_err("%s: integer overflow detected\n", __func__); + return -EINVAL; + } + if (cvs_voc_pkt != NULL && common.mvs_info.ul_cb != NULL) { - if (v->shmem_info.sh_buf.buf[1].size < - ((3 * sizeof(uint32_t)) + cvs_voc_pkt[2])) { + if (v->shmem_info.sh_buf.buf[1].size < tot_buf_sz) { pr_err("%s: invalid voc pkt size\n", __func__); return -EINVAL; }