summaryrefslogtreecommitdiff
path: root/sound
diff options
context:
space:
mode:
Diffstat (limited to 'sound')
-rw-r--r--sound/core/rawmidi.c32
-rw-r--r--sound/core/sound_oss.c13
-rw-r--r--sound/soc/codecs/wcd-mbhc-v2.c3
-rw-r--r--sound/soc/codecs/wcd9xxx-mbhc.c3
-rw-r--r--sound/soc/codecs/wcd_cpe_services.c5
-rw-r--r--sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c14
-rw-r--r--sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c12
-rw-r--r--sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c5
-rw-r--r--sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c32
-rw-r--r--sound/soc/msm/qdsp6v2/q6afe.c7
-rw-r--r--sound/soc/msm/qdsp6v2/q6asm.c19
-rw-r--r--sound/soc/msm/qdsp6v2/q6core.c3
-rw-r--r--sound/soc/msm/qdsp6v2/q6lsm.c9
-rw-r--r--sound/soc/msm/qdsp6v2/q6voice.c7
14 files changed, 124 insertions, 40 deletions
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 11fdc1d9797e..a7a1b1c4cad9 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -108,17 +108,6 @@ static void snd_rawmidi_input_event_work(struct work_struct *work)
runtime->event(runtime->substream);
}
-/* buffer refcount management: call with runtime->lock held */
-static inline void snd_rawmidi_buffer_ref(struct snd_rawmidi_runtime *runtime)
-{
- runtime->buffer_ref++;
-}
-
-static inline void snd_rawmidi_buffer_unref(struct snd_rawmidi_runtime *runtime)
-{
- runtime->buffer_ref--;
-}
-
static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream)
{
struct snd_rawmidi_runtime *runtime;
@@ -676,6 +665,7 @@ int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream,
runtime->buffer = newbuf;
runtime->buffer_size = params->buffer_size;
runtime->avail = runtime->buffer_size;
+ runtime->appl_ptr = runtime->hw_ptr = 0;
spin_unlock_irqrestore(&runtime->lock, flags);
if (oldbuf != newbuf)
kfree(oldbuf);
@@ -714,6 +704,7 @@ int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream,
oldbuf = runtime->buffer;
runtime->buffer = newbuf;
runtime->buffer_size = params->buffer_size;
+ runtime->appl_ptr = runtime->hw_ptr = 0;
spin_unlock_irqrestore(&runtime->lock, flags);
if (oldbuf != newbuf)
kfree(oldbuf);
@@ -988,12 +979,10 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream,
long result = 0, count1;
struct snd_rawmidi_runtime *runtime = substream->runtime;
unsigned long appl_ptr;
- int err = 0;
if (userbuf)
mutex_lock(&runtime->realloc_mutex);
spin_lock_irqsave(&runtime->lock, flags);
- snd_rawmidi_buffer_ref(runtime);
while (count > 0 && runtime->avail) {
count1 = runtime->buffer_size - runtime->appl_ptr;
if (count1 > count)
@@ -1012,21 +1001,20 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream,
if (userbuf) {
spin_unlock_irqrestore(&runtime->lock, flags);
if (copy_to_user(userbuf + result,
- runtime->buffer + appl_ptr, count1))
- err = -EFAULT;
+ runtime->buffer + appl_ptr, count1)) {
+ mutex_unlock(&runtime->realloc_mutex);
+ return result > 0 ? result : -EFAULT;
+ }
+
spin_lock_irqsave(&runtime->lock, flags);
- if (err)
- goto out;
}
result += count1;
count -= count1;
}
- out:
- snd_rawmidi_buffer_unref(runtime);
spin_unlock_irqrestore(&runtime->lock, flags);
if (userbuf)
mutex_unlock(&runtime->realloc_mutex);
- return result > 0 ? result : err;
+ return result;
}
long snd_rawmidi_kernel_read(struct snd_rawmidi_substream *substream,
@@ -1301,7 +1289,6 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
return -EAGAIN;
}
}
- snd_rawmidi_buffer_ref(runtime);
while (count > 0 && runtime->avail > 0) {
count1 = runtime->buffer_size - runtime->appl_ptr;
if (count1 > count)
@@ -1333,7 +1320,6 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
}
__end:
count1 = runtime->avail < runtime->buffer_size;
- snd_rawmidi_buffer_unref(runtime);
spin_unlock_irqrestore(&runtime->lock, flags);
if (userbuf)
mutex_unlock(&runtime->realloc_mutex);
@@ -1653,10 +1639,8 @@ static int snd_rawmidi_free(struct snd_rawmidi *rmidi)
snd_info_free_entry(rmidi->proc_entry);
rmidi->proc_entry = NULL;
- mutex_lock(&register_mutex);
if (rmidi->ops && rmidi->ops->dev_unregister)
rmidi->ops->dev_unregister(rmidi);
- mutex_unlock(&register_mutex);
snd_rawmidi_free_substreams(&rmidi->streams[SNDRV_RAWMIDI_STREAM_INPUT]);
snd_rawmidi_free_substreams(&rmidi->streams[SNDRV_RAWMIDI_STREAM_OUTPUT]);
diff --git a/sound/core/sound_oss.c b/sound/core/sound_oss.c
index 0ca9d72b2273..6c3dca831fd0 100644
--- a/sound/core/sound_oss.c
+++ b/sound/core/sound_oss.c
@@ -179,7 +179,6 @@ int snd_unregister_oss_device(int type, struct snd_card *card, int dev)
mutex_unlock(&sound_oss_mutex);
return -ENOENT;
}
- unregister_sound_special(minor);
switch (SNDRV_MINOR_OSS_DEVICE(minor)) {
case SNDRV_MINOR_OSS_PCM:
track2 = SNDRV_MINOR_OSS(cidx, SNDRV_MINOR_OSS_AUDIO);
@@ -191,12 +190,18 @@ int snd_unregister_oss_device(int type, struct snd_card *card, int dev)
track2 = SNDRV_MINOR_OSS(cidx, SNDRV_MINOR_OSS_DMMIDI1);
break;
}
- if (track2 >= 0) {
- unregister_sound_special(track2);
+ if (track2 >= 0)
snd_oss_minors[track2] = NULL;
- }
snd_oss_minors[minor] = NULL;
mutex_unlock(&sound_oss_mutex);
+
+ /* call unregister_sound_special() outside sound_oss_mutex;
+ * otherwise may deadlock, as it can trigger the release of a card
+ */
+ unregister_sound_special(minor);
+ if (track2 >= 0)
+ unregister_sound_special(track2);
+
kfree(mptr);
return 0;
}
diff --git a/sound/soc/codecs/wcd-mbhc-v2.c b/sound/soc/codecs/wcd-mbhc-v2.c
index 04f1c7b1276c..69b4c0ecd83f 100644
--- a/sound/soc/codecs/wcd-mbhc-v2.c
+++ b/sound/soc/codecs/wcd-mbhc-v2.c
@@ -2899,9 +2899,6 @@ int wcd_mbhc_init(struct wcd_mbhc *mbhc, struct snd_soc_codec *codec,
return ret;
}
- set_bit(INPUT_PROP_NO_DUMMY_RELEASE,
- mbhc->button_jack.jack->input_dev->propbit);
-
INIT_DELAYED_WORK(&mbhc->mbhc_firmware_dwork,
wcd_mbhc_fw_read);
INIT_DELAYED_WORK(&mbhc->mbhc_btn_dwork, wcd_btn_lpress_fn);
diff --git a/sound/soc/codecs/wcd9xxx-mbhc.c b/sound/soc/codecs/wcd9xxx-mbhc.c
index 2012e4617ee1..b6a50742f501 100644
--- a/sound/soc/codecs/wcd9xxx-mbhc.c
+++ b/sound/soc/codecs/wcd9xxx-mbhc.c
@@ -5503,9 +5503,6 @@ int wcd9xxx_mbhc_init(struct wcd9xxx_mbhc *mbhc, struct wcd9xxx_resmgr *resmgr,
return ret;
}
- set_bit(INPUT_PROP_NO_DUMMY_RELEASE,
- mbhc->button_jack.jack->input_dev->propbit);
-
INIT_DELAYED_WORK(&mbhc->mbhc_firmware_dwork,
wcd9xxx_mbhc_fw_read);
INIT_DELAYED_WORK(&mbhc->mbhc_btn_dwork, wcd9xxx_btn_lpress_fn);
diff --git a/sound/soc/codecs/wcd_cpe_services.c b/sound/soc/codecs/wcd_cpe_services.c
index 18cd44d3d9c7..142dafe8490c 100644
--- a/sound/soc/codecs/wcd_cpe_services.c
+++ b/sound/soc/codecs/wcd_cpe_services.c
@@ -664,7 +664,7 @@ static void cpe_notify_cmi_client(struct cpe_info *t_info, u8 *payload,
service = CMI_HDR_GET_SERVICE(hdr);
notif.event = (enum cmi_api_event)CPE_SVC_CMI_MSG;
- notif.result = result;
+ notif.result = (enum cmi_api_result)result;
notif.message = payload;
CPE_SVC_GRAB_LOCK(&cpe_d.cpe_svc_lock, "cpe_svc");
@@ -1355,7 +1355,8 @@ static enum cpe_process_result cpe_mt_process_cmd(
cpe_change_state(t_info, CPE_STATE_SENDING_MSG,
CPE_SS_MSG_SEND_INBOX);
- rc = cpe_send_msg_to_inbox(t_info, 0, m);
+ rc = (enum cpe_process_result)cpe_send_msg_to_inbox(t_info, 0,
+ m);
break;
case CPE_CMD_SEND_MSG_COMPLETE:
diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c
index b02ab78684fb..6dc8289ffce1 100644
--- a/sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c
+++ b/sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c
@@ -1,4 +1,5 @@
/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -644,6 +645,12 @@ static int hpcm_start_vocpcm(char *pcm_id, struct hpcm_drv *prtd,
}
}
+ if (*no_of_tp != no_of_tp_req && *no_of_tp > 2) {
+ pr_err("%s:: Invalid hpcm start request\n", __func__);
+ memset(&prtd->start_cmd, 0, sizeof(struct start_cmd));
+ return -EINVAL;
+ }
+
if ((prtd->mixer_conf.tx.enable || prtd->mixer_conf.rx.enable) &&
*no_of_tp == no_of_tp_req) {
voc_send_cvp_start_vocpcm(voc_get_session_id(sess_name),
@@ -743,6 +750,13 @@ void hpcm_notify_evt_processing(uint8_t *data, char *session,
return;
}
+ if (prtd->mixer_conf.sess_indx < VOICE_INDEX ||
+ prtd->mixer_conf.sess_indx >= MAX_SESSION) {
+ pr_err("%s:: Invalid session idx %d\n",
+ __func__, prtd->mixer_conf.sess_indx);
+ return;
+ }
+
if (notify_evt->tap_point == VSS_IVPCM_TAP_POINT_TX_DEFAULT) {
tp = &prtd->session[prtd->mixer_conf.sess_indx].tx_tap_point;
tmd = &prtd->mixer_conf.tx;
diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c
index 5f4225e675ad..bf2620c999b1 100644
--- a/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c
+++ b/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c
@@ -1,5 +1,5 @@
-/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
- * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -1004,6 +1004,14 @@ static int msm_pcm_capture_copy(struct snd_pcm_substream *substream,
goto fail;
}
+ if ((size == 0 || size < prtd->pcm_count) && ((offset + size) < prtd->pcm_count)) {
+ memset(bufptr + offset + size, 0, prtd->pcm_count - size);
+ if (fbytes > prtd->pcm_count)
+ size = xfer = prtd->pcm_count;
+ else
+ size = xfer = fbytes;
+ }
+
if (copy_to_user(buf, bufptr+offset, xfer)) {
pr_err("Failed to copy buf to user\n");
ret = -EFAULT;
diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c
index 27f90c270e13..96c59cad19c3 100644
--- a/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c
+++ b/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c
@@ -2072,6 +2072,11 @@ static void msm_pcm_routing_process_voice(u16 reg, u16 val, int set)
session_id = msm_pcm_routing_get_voc_sessionid(val);
+ if (!session_id) {
+ pr_err("%s: Invalid session_id %x\n", __func__, session_id);
+ return;
+ }
+
pr_debug("%s: FE DAI 0x%x session_id 0x%x\n",
__func__, val, session_id);
diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c
index b2387a746f61..38aaa6cb8d30 100644
--- a/sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c
+++ b/sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c
@@ -1,5 +1,6 @@
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
*
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
* only version 2 as published by the Free Software Foundation.
@@ -371,6 +372,13 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt,
switch (prtd->mode) {
case MODE_AMR_WB:
case MODE_AMR: {
+ if (pkt_len <= DSP_FRAME_HDR_LEN) {
+ pr_err("%s: pkt_len %d is < required len\n",
+ __func__, pkt_len);
+ spin_unlock_irqrestore(&prtd->dsp_ul_lock,
+ dsp_flags);
+ return;
+ }
/* Remove the DSP frame info header. Header format:
* Bits 0-3: Frame rate
* Bits 4-7: Frame type
@@ -391,6 +399,13 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt,
case MODE_4GV_NB:
case MODE_4GV_WB:
case MODE_4GV_NW: {
+ if (pkt_len <= DSP_FRAME_HDR_LEN) {
+ pr_err("%s: pkt_len %d is < required len\n",
+ __func__, pkt_len);
+ spin_unlock_irqrestore(&prtd->dsp_ul_lock,
+ dsp_flags);
+ return;
+ }
/* Remove the DSP frame info header.
* Header format:
* Bits 0-3: frame rate
@@ -428,6 +443,14 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt,
buf_node->frame.frm_hdr.timestamp = timestamp;
voc_pkt = voc_pkt + DSP_FRAME_HDR_LEN;
+ if (pkt_len <= 2 * DSP_FRAME_HDR_LEN) {
+ pr_err("%s: pkt_len %d is < required len\n",
+ __func__, pkt_len);
+ spin_unlock_irqrestore(&prtd->dsp_ul_lock,
+ dsp_flags);
+ return;
+ }
+
/* There are two frames in the buffer. Length of the
* first frame:
*/
@@ -463,6 +486,15 @@ static void voip_process_ul_pkt(uint8_t *voc_pkt,
buf_node->frame.frm_hdr.timestamp = timestamp;
voc_pkt = voc_pkt + DSP_FRAME_HDR_LEN;
+ if (pkt_len <= 2 * DSP_FRAME_HDR_LEN) {
+ pr_err(
+ "%s: pkt_len %d is < required len\n",
+ __func__, pkt_len);
+ spin_unlock_irqrestore(
+ &prtd->dsp_ul_lock,
+ dsp_flags);
+ return;
+ }
/* There are two frames in the buffer. Length
* of the second frame:
*/
diff --git a/sound/soc/msm/qdsp6v2/q6afe.c b/sound/soc/msm/qdsp6v2/q6afe.c
index 610604fcfe15..21370dbadb5b 100644
--- a/sound/soc/msm/qdsp6v2/q6afe.c
+++ b/sound/soc/msm/qdsp6v2/q6afe.c
@@ -5475,6 +5475,13 @@ static int afe_sidetone_iir(u16 tx_port_id)
pr_debug("%s: adding 2 to size:%d\n", __func__, size);
size = size + 2;
}
+
+ if (size > MAX_SIDETONE_IIR_DATA_SIZE) {
+ pr_err("%s: iir_config size is out of bounds:%d\n", __func__, size);
+ mutex_unlock(&this_afe.cal_data[cal_index]->lock);
+ ret = -EINVAL;
+ goto done;
+ }
memcpy(&filter_data.iir_config, &st_iir_cal_info->iir_config, size);
mutex_unlock(&this_afe.cal_data[cal_index]->lock);
diff --git a/sound/soc/msm/qdsp6v2/q6asm.c b/sound/soc/msm/qdsp6v2/q6asm.c
index 2f8c1e80ce32..70ae79f5f6d1 100644
--- a/sound/soc/msm/qdsp6v2/q6asm.c
+++ b/sound/soc/msm/qdsp6v2/q6asm.c
@@ -1,5 +1,6 @@
/*
* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
* Author: Brian Swetland <swetland@google.com>
*
* This software is licensed under the terms of the GNU General Public
@@ -11,6 +12,7 @@
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
+ * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/fs.h>
#include <linux/mutex.h>
@@ -2274,6 +2276,15 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
config_debug_fs_read_cb();
+ if (data->payload_size != (READDONE_IDX_SEQ_ID + 1) * sizeof(uint32_t)) {
+ pr_err("%s: payload size of %d is less than expected size\n",
+ __func__, data->payload_size);
+ spin_unlock_irqrestore(
+ &(session[session_id].session_lock),
+ flags);
+ return -EINVAL;
+ }
+
dev_vdbg(ac->dev, "%s: ReadDone: status=%d buff_add=0x%x act_size=%d offset=%d\n",
__func__, payload[READDONE_IDX_STATUS],
payload[READDONE_IDX_BUFADD_LSW],
@@ -2380,6 +2391,14 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv)
__func__, data->payload_size);
break;
case ASM_SESSION_CMDRSP_GET_MTMX_STRTR_PARAMS_V2:
+ payload_size = sizeof(struct asm_mtmx_strtr_get_params_cmdrsp);
+ if (data->payload_size < payload_size) {
+ pr_err("%s: insufficient payload size = %d\n",
+ __func__, data->payload_size);
+ spin_unlock_irqrestore(
+ &(session[session_id].session_lock), flags);
+ return -EINVAL;
+ }
q6asm_process_mtmx_get_param_rsp(ac, (void *) payload);
break;
case ASM_STREAM_PP_EVENT:
diff --git a/sound/soc/msm/qdsp6v2/q6core.c b/sound/soc/msm/qdsp6v2/q6core.c
index 417c5d0a12d1..8e1cb3a8b43b 100644
--- a/sound/soc/msm/qdsp6v2/q6core.c
+++ b/sound/soc/msm/qdsp6v2/q6core.c
@@ -1,4 +1,5 @@
/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -87,7 +88,7 @@ static struct generic_get_data_ *generic_get_data;
static int parse_fwk_version_info(uint32_t *payload, uint16_t payload_size)
{
size_t ver_size;
- int num_services;
+ uint16_t num_services;
pr_debug("%s: Payload info num services %d\n",
__func__, payload[4]);
diff --git a/sound/soc/msm/qdsp6v2/q6lsm.c b/sound/soc/msm/qdsp6v2/q6lsm.c
index 90822aada3b6..807a4df9a2ba 100644
--- a/sound/soc/msm/qdsp6v2/q6lsm.c
+++ b/sound/soc/msm/qdsp6v2/q6lsm.c
@@ -1,5 +1,6 @@
/*
* Copyright (c) 2013-2020, Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -338,6 +339,10 @@ static int q6lsm_apr_send_pkt(struct lsm_client *client, void *handle,
struct apr_hdr *msg_hdr = (struct apr_hdr *) data;
pr_debug("%s: enter wait %d\n", __func__, wait);
+ if (mmap_handle_p) {
+ pr_err("%s: Invalid mmap_handle\n", __func__);
+ return -EINVAL;
+ }
if (wait)
mutex_lock(&lsm_common.apr_lock);
if (mmap_p) {
@@ -381,6 +386,7 @@ static int q6lsm_apr_send_pkt(struct lsm_client *client, void *handle,
if (wait)
mutex_unlock(&lsm_common.apr_lock);
+ mmap_handle_p = NULL;
pr_debug("%s: leave ret %d\n", __func__, ret);
return ret;
}
@@ -1395,7 +1401,8 @@ static int q6lsm_mmapcallback(struct apr_client_data *data, void *priv)
case LSM_SESSION_CMDRSP_SHARED_MEM_MAP_REGIONS:
if (atomic_read(&client->cmd_state) == CMD_STATE_WAIT_RESP) {
spin_lock_irqsave(&mmap_lock, flags);
- *mmap_handle_p = command;
+ if (mmap_handle_p)
+ *mmap_handle_p = command;
/* spin_unlock_irqrestore implies barrier */
spin_unlock_irqrestore(&mmap_lock, flags);
atomic_set(&client->cmd_state, CMD_STATE_CLEARED);
diff --git a/sound/soc/msm/qdsp6v2/q6voice.c b/sound/soc/msm/qdsp6v2/q6voice.c
index e437a1c7985f..996567ff3a0e 100644
--- a/sound/soc/msm/qdsp6v2/q6voice.c
+++ b/sound/soc/msm/qdsp6v2/q6voice.c
@@ -2545,6 +2545,13 @@ static int voice_send_cvs_register_cal_cmd(struct voice_data *v)
goto unlock;
}
+ if (col_data->cal_data.size > MAX_COL_INFO_SIZE) {
+ pr_err("%s: Invalid cal data size %zu!\n",
+ __func__, col_data->cal_data.size);
+ ret = -EINVAL;
+ goto unlock;
+ }
+
memcpy(&cvs_reg_cal_cmd.cvs_cal_data.column_info[0],
(void *) &((struct audio_cal_info_voc_col *)
col_data->cal_info)->data,
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-22 03:00:05 +0000