Merge remote-tracking branch 'msm8998/lineage-20' into lineage-20

Change-Id: I126075a330f305c85f8fe1b8c9d408f368be95d1

1 files changed, 14 insertions, 0 deletions

diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c
index b02ab78684fb..6dc8289ffce1 100644
--- a/sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c
+++ b/sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c
@@ -1,4 +1,5 @@
 /* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -644,6 +645,12 @@ static int hpcm_start_vocpcm(char *pcm_id, struct hpcm_drv *prtd,
 		}
 	}
 
+	if (*no_of_tp != no_of_tp_req && *no_of_tp > 2) {
+		pr_err("%s:: Invalid hpcm start request\n", __func__);
+		memset(&prtd->start_cmd, 0, sizeof(struct start_cmd));
+		return -EINVAL;
+	}
+
 	if ((prtd->mixer_conf.tx.enable || prtd->mixer_conf.rx.enable) &&
 	    *no_of_tp == no_of_tp_req) {
 		voc_send_cvp_start_vocpcm(voc_get_session_id(sess_name),
@@ -743,6 +750,13 @@ void hpcm_notify_evt_processing(uint8_t *data, char *session,
 		return;
 	}
 
+	if (prtd->mixer_conf.sess_indx < VOICE_INDEX ||
+		prtd->mixer_conf.sess_indx >= MAX_SESSION) {
+		pr_err("%s:: Invalid session idx %d\n",
+			__func__, prtd->mixer_conf.sess_indx);
+		return;
+	}
+
 	if (notify_evt->tap_point == VSS_IVPCM_TAP_POINT_TX_DEFAULT) {
 		tp = &prtd->session[prtd->mixer_conf.sess_indx].tx_tap_point;
 		tmd = &prtd->mixer_conf.tx;