diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-01-12 22:39:16 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-01-12 22:39:15 -0800 |
| commit | 9bf671bc1e4d69355b7795b57fb561837e8c0984 (patch) | |
| tree | 3947d87327e7d7767bcb052f1d95b777d5d0e723 /sound | |
| parent | e85386ee66f79116b94addadf63eaf7792b47300 (diff) | |
| parent | 145c630b36e8420dd4fa80e174ab95d07afe2b48 (diff) | |
Merge "ASoC: msm: qdsp6v2: Fix out-of-bounds access in put functions"
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c index 03994225edcf..dbe61b252cb9 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c @@ -1860,6 +1860,11 @@ static int msm_routing_lsm_mux_put(struct snd_kcontrol *kcontrol, int lsm_port = AFE_PORT_ID_SLIMBUS_MULTI_CHAN_5_TX; struct snd_soc_dapm_update *update = NULL; + if (mux >= e->items) { + pr_err("%s: Invalid mux value %d\n", __func__, mux); + return -EINVAL; + } + pr_debug("%s: LSM enable %ld\n", __func__, ucontrol->value.integer.value[0]); switch (ucontrol->value.integer.value[0]) { @@ -2183,6 +2188,11 @@ static int msm_routing_ec_ref_rx_put(struct snd_kcontrol *kcontrol, struct soc_enum *e = (struct soc_enum *)kcontrol->private_value; struct snd_soc_dapm_update *update = NULL; + if (mux >= e->items) { + pr_err("%s: Invalid mux value %d\n", __func__, mux); + return -EINVAL; + } + mutex_lock(&routing_lock); switch (ucontrol->value.integer.value[0]) { case 0: @@ -2379,6 +2389,11 @@ static int msm_routing_ext_ec_put(struct snd_kcontrol *kcontrol, uint16_t ext_ec_ref_port_id; struct snd_soc_dapm_update *update = NULL; + if (mux >= e->items) { + pr_err("%s: Invalid mux value %d\n", __func__, mux); + return -EINVAL; + } + mutex_lock(&routing_lock); msm_route_ext_ec_ref = ucontrol->value.integer.value[0]; |