DigiGoon/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

dsp: q6lsm: Handle payload_size = sizeof(uint32_t) gracefully

Browse source 
q6lsm_mmapcallback: payload has invalid size[4]

Fixes: https://gitlab.com/LineageOS/issues/android/-/issues/7269
Change-Id: Icf54b28b9c47585f9e56bba9e0dc417079856885
This commit is contained in:
LuK1337 2024-06-12 09:26:47 +02:00
parent 0edbb3c4df
commit 2ade12f6b1
No known key found for this signature in database
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
techpack/audio/dsp/q6lsm.c
View file

@ -2130,14 +2130,18 @@ static int q6lsm_mmapcallback(struct apr_client_data *data, void *priv)
return 0;
}
if (data->payload_size < (2 * sizeof(uint32_t))) {
if (data->payload_size >= (2 * sizeof(uint32_t))) {
command = payload[0];
retcode = payload[1];
} else if (data->payload_size >= sizeof(uint32_t)) {
command = payload[0];
retcode = 0;
} else {
pr_err("%s: payload has invalid size[%d]\n", __func__,
data->payload_size);
return -EINVAL;
}
command = payload[0];
retcode = payload[1];
sid = (data->token >> 8) & 0x0F;
pr_debug("%s: opcode 0x%x command 0x%x return code 0x%x SID 0x%x\n",
__func__, data->opcode, command, retcode, sid);