diff options
| author | Karthik Reddy Katta <a_katta@codeaurora.org> | 2016-05-17 17:29:33 +0530 |
|---|---|---|
| committer | Kyle Yan <kyan@codeaurora.org> | 2016-06-17 15:15:17 -0700 |
| commit | 1438b8b5dd2e5b324c7d7f7a868e28789e4d79be (patch) | |
| tree | d6bb79b27c6c9d50f97f475c40ad92e0e0787bf1 | |
| parent | c72e42a4432b362fa453e86a5aa5ec73e687ad60 (diff) | |
ASoC: msm: qdsp6v2: Fix unmap memory command failure
Add pointer validation checks to prevent sending
invalid handles to ADSP as part of unmap memory
regions command.
CRs-Fixed: 1018367
Change-Id: I0dfb2fccb4414ed82ee10d73576fda66a273043d
Signed-off-by: Karthik Reddy Katta <a_katta@codeaurora.org>
| -rw-r--r-- | sound/soc/msm/qdsp6v2/audio_cal_utils.c | 18 | ||||
| -rw-r--r-- | sound/soc/msm/qdsp6v2/q6adm.c | 12 | ||||
| -rw-r--r-- | sound/soc/msm/qdsp6v2/q6afe.c | 11 |
3 files changed, 31 insertions, 10 deletions
diff --git a/sound/soc/msm/qdsp6v2/audio_cal_utils.c b/sound/soc/msm/qdsp6v2/audio_cal_utils.c index ea58987455bf..9b76b4892eb1 100644 --- a/sound/soc/msm/qdsp6v2/audio_cal_utils.c +++ b/sound/soc/msm/qdsp6v2/audio_cal_utils.c @@ -18,6 +18,8 @@ #include <linux/mutex.h> #include <sound/audio_cal_utils.h> +static int unmap_memory(struct cal_type_data *cal_type, + struct cal_block_data *cal_block); size_t get_cal_info_size(int32_t cal_type) { @@ -445,16 +447,12 @@ static void destroy_all_cal_blocks(struct cal_type_data *cal_type) cal_block = list_entry(ptr, struct cal_block_data, list); - if (cal_type->info.cal_util_callbacks.unmap_cal != NULL) { - ret = cal_type->info.cal_util_callbacks. - unmap_cal(cal_type->info.reg.cal_type, - cal_block); - if (ret < 0) { - pr_err("%s: unmap_cal failed, cal type %d, ret = %d!\n", - __func__, - cal_type->info.reg.cal_type, - ret); - } + ret = unmap_memory(cal_type, cal_block); + if (ret < 0) { + pr_err("%s: unmap_memory failed, cal type %d, ret = %d!\n", + __func__, + cal_type->info.reg.cal_type, + ret); } delete_cal_block(cal_block); cal_block = NULL; diff --git a/sound/soc/msm/qdsp6v2/q6adm.c b/sound/soc/msm/qdsp6v2/q6adm.c index 6877985ca05e..1866b9e328d9 100644 --- a/sound/soc/msm/qdsp6v2/q6adm.c +++ b/sound/soc/msm/qdsp6v2/q6adm.c @@ -3183,6 +3183,18 @@ static int adm_unmap_cal_data(int32_t cal_type, goto done; } + if (cal_block == NULL) { + pr_err("%s: Cal block is NULL!\n", + __func__); + goto done; + } + + if (cal_block->map_data.q6map_handle == 0) { + pr_err("%s: Map handle is NULL, nothing to unmap\n", + __func__); + goto done; + } + atomic_set(&this_adm.mem_map_handles[cal_index], cal_block->map_data.q6map_handle); atomic_set(&this_adm.mem_map_index, cal_index); diff --git a/sound/soc/msm/qdsp6v2/q6afe.c b/sound/soc/msm/qdsp6v2/q6afe.c index 820ef080326d..8efa04c3807e 100644 --- a/sound/soc/msm/qdsp6v2/q6afe.c +++ b/sound/soc/msm/qdsp6v2/q6afe.c @@ -6154,6 +6154,17 @@ static int afe_unmap_cal_data(int32_t cal_type, goto done; } + if (cal_block == NULL) { + pr_err("%s: Cal block is NULL!\n", + __func__); + goto done; + } + + if (cal_block->map_data.q6map_handle == 0) { + pr_err("%s: Map handle is NULL, nothing to unmap\n", + __func__); + goto done; + } atomic_set(&this_afe.mem_map_cal_handles[cal_index], cal_block->map_data.q6map_handle); |