From bfa67ef470ed80c3ec862c8d52d13d04a71eae5d Mon Sep 17 00:00:00 2001
From: kunleiz <kunleiz@codeaurora.org>
Date: Fri, 29 Sep 2017 14:22:38 +0800
Subject: [PATCH] rtac: add size check when reading cal data kvaddr buffer
Add size check to ensure cal data bytes size fits inside
the cal date when copying to user space buffer.
CRs-Fixed: 2110256
Bug: 65172622
Change-Id: I511999984684a9db4aaf1cf2c65eb1495c36980f
Signed-off-by: kunleiz <kunleiz@codeaurora.org>
Signed-off-by: Siqi Lin <siqilin@google.com>
---
sound/soc/msm/qdsp6v2/rtac.c | 32 ++++++++++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/sound/soc/msm/qdsp6v2/rtac.c b/sound/soc/msm/qdsp6v2/rtac.c
index 00c4e900696a..f21918530ca8 100644
--- a/sound/soc/msm/qdsp6v2/rtac.c
+++ b/sound/soc/msm/qdsp6v2/rtac.c
@@ -817,6 +817,14 @@ u32 send_adm_apr(void *buf, u32 opcode)
bytes_returned = ((u32 *)rtac_cal[ADM_RTAC_CAL].cal_data.
kvaddr)[2] + 3 * sizeof(u32);
+ if (bytes_returned > rtac_cal[ADM_RTAC_CAL].
+ map_data.map_size) {
+ pr_err("%s: Invalid data size = %d\n",
+ __func__, bytes_returned);
+ result = -EINVAL;
+ goto err;
+ }
+
if (bytes_returned > user_buf_size) {
pr_err("%s: User buf not big enough, size = 0x%x, returned size = 0x%x\n",
__func__, user_buf_size, bytes_returned);
@@ -1025,6 +1033,14 @@ u32 send_rtac_asm_apr(void *buf, u32 opcode)
bytes_returned = ((u32 *)rtac_cal[ASM_RTAC_CAL].cal_data.
kvaddr)[2] + 3 * sizeof(u32);
+ if (bytes_returned > rtac_cal[ASM_RTAC_CAL].
+ map_data.map_size) {
+ pr_err("%s: Invalid data size = %d\n",
+ __func__, bytes_returned);
+ result = -EINVAL;
+ goto err;
+ }
+
if (bytes_returned > user_buf_size) {
pr_err("%s: User buf not big enough, size = 0x%x, returned size = 0x%x\n",
__func__, user_buf_size, bytes_returned);
@@ -1268,6 +1284,14 @@ static u32 send_rtac_afe_apr(void *buf, uint32_t opcode)
bytes_returned = get_resp->param_size +
sizeof(struct afe_port_param_data_v2);
+ if (bytes_returned > rtac_cal[AFE_RTAC_CAL].
+ map_data.map_size) {
+ pr_err("%s: Invalid data size = %d\n",
+ __func__, bytes_returned);
+ result = -EINVAL;
+ goto err;
+ }
+
if (bytes_returned > user_afe_buf.buf_size) {
pr_err("%s: user size = 0x%x, returned size = 0x%x\n",
__func__, user_afe_buf.buf_size,
@@ -1476,6 +1500,14 @@ u32 send_voice_apr(u32 mode, void *buf, u32 opcode)
bytes_returned = ((u32 *)rtac_cal[VOICE_RTAC_CAL].cal_data.
kvaddr)[2] + 3 * sizeof(u32);
+ if (bytes_returned > rtac_cal[VOICE_RTAC_CAL].
+ map_data.map_size) {
+ pr_err("%s: Invalid data size = %d\n",
+ __func__, bytes_returned);
+ result = -EINVAL;
+ goto err;
+ }
+
if (bytes_returned > user_buf_size) {
pr_err("%s: User buf not big enough, size = 0x%x, returned size = 0x%x\n",
__func__, user_buf_size, bytes_returned);
--
GitLab