msm: 8660: audio: Fix check for out of bound exception
Fix upper limit check for out of bound exceptions
Signed-off-by: Vasudeva Rao Thumati <vthuma@codeaurora.org>
Signed-off-by: Deepa Madiregama <dmadireg@codeaurora.org>
diff --git a/arch/arm/mach-msm/qdsp6v2/aac_in.c b/arch/arm/mach-msm/qdsp6v2/aac_in.c
index ff25d32..7140601 100644
--- a/arch/arm/mach-msm/qdsp6v2/aac_in.c
+++ b/arch/arm/mach-msm/qdsp6v2/aac_in.c
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2010, Code Aurora Forum. All rights reserved.
+ * Copyright (c) 2010-2011, Code Aurora Forum. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -280,8 +280,8 @@
audio = kzalloc(sizeof(struct q6audio_in), GFP_KERNEL);
if (audio == NULL) {
- pr_err("%s:session id %d: Could not allocate memory for aac\
- driver\n", __func__, audio->ac->session);
+ pr_err("%s: Could not allocate memory for aac\
+ driver\n", __func__);
return -ENOMEM;
}
/* Allocate memory for encoder config param */
@@ -338,8 +338,8 @@
(void *)audio);
if (!audio->ac) {
- pr_err("%s:session id %d: Could not allocate memory for\
- audio client\n", __func__, audio->ac->session);
+ pr_err("%s: Could not allocate memory for\
+ audio client\n", __func__);
kfree(audio->enc_cfg);
kfree(audio->codec_cfg);
kfree(audio);
diff --git a/arch/arm/mach-msm/qdsp6v2/amrnb_in.c b/arch/arm/mach-msm/qdsp6v2/amrnb_in.c
index ece44fd..6a70428 100644
--- a/arch/arm/mach-msm/qdsp6v2/amrnb_in.c
+++ b/arch/arm/mach-msm/qdsp6v2/amrnb_in.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2010, Code Aurora Forum. All rights reserved.
+/* Copyright (c) 2010-2011, Code Aurora Forum. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -196,8 +196,8 @@
audio = kzalloc(sizeof(struct q6audio_in), GFP_KERNEL);
if (audio == NULL) {
- pr_err("%s:session id %d: Could not allocate memory for amrnb\
- driver\n", __func__, audio->ac->session);
+ pr_err("%s Could not allocate memory for amrnb\
+ driver\n", __func__);
return -ENOMEM;
}
/* Allocate memory for encoder config param */
@@ -238,8 +238,8 @@
(void *)audio);
if (!audio->ac) {
- pr_err("%s:session id %d: Could not allocate memory for audio\
- client\n", __func__, audio->ac->session);
+ pr_err("%s: Could not allocate memory for audio\
+ client\n", __func__);
kfree(audio->enc_cfg);
kfree(audio);
return -ENOMEM;
diff --git a/arch/arm/mach-msm/qdsp6v2/apr.c b/arch/arm/mach-msm/qdsp6v2/apr.c
index f405457..ee73c0d 100644
--- a/arch/arm/mach-msm/qdsp6v2/apr.c
+++ b/arch/arm/mach-msm/qdsp6v2/apr.c
@@ -396,7 +396,7 @@
if (src_port != 0xFFFFFFFF) {
temp_port = ((src_port >> 8) * 8) + (src_port & 0xFF);
pr_debug("port = %d t_port = %d\n", src_port, temp_port);
- if (temp_port > APR_MAX_PORTS || temp_port < 0) {
+ if (temp_port >= APR_MAX_PORTS || temp_port < 0) {
pr_err("APR: temp_port out of bounds\n");
mutex_unlock(&svc->m_lock);
return NULL;
diff --git a/arch/arm/mach-msm/qdsp6v2/audio_acdb.c b/arch/arm/mach-msm/qdsp6v2/audio_acdb.c
index 7be28a7..cc2b2ce 100644
--- a/arch/arm/mach-msm/qdsp6v2/audio_acdb.c
+++ b/arch/arm/mach-msm/qdsp6v2/audio_acdb.c
@@ -373,7 +373,7 @@
pr_err("ACDB=> NULL pointer sent to %s\n", __func__);
goto done;
}
- if (path > MAX_AUDPROC_TYPES || path < 0) {
+ if (path >= MAX_AUDPROC_TYPES || path < 0) {
pr_err("ACDB=> Bad path sent to %s, path: %d\n",
__func__, path);
goto done;
diff --git a/arch/arm/mach-msm/qdsp6v2/audio_lpa.c b/arch/arm/mach-msm/qdsp6v2/audio_lpa.c
index 52434bf..2165953 100644
--- a/arch/arm/mach-msm/qdsp6v2/audio_lpa.c
+++ b/arch/arm/mach-msm/qdsp6v2/audio_lpa.c
@@ -418,8 +418,8 @@
rc = -1;
spin_unlock(&audio->event_queue_lock);
- if (drv_evt->event_type == AUDIO_EVENT_WRITE_DONE ||
- drv_evt->event_type == AUDIO_EVENT_READ_DONE) {
+ if (drv_evt && (drv_evt->event_type == AUDIO_EVENT_WRITE_DONE ||
+ drv_evt->event_type == AUDIO_EVENT_READ_DONE)) {
pr_debug("%s: AUDIO_EVENT_WRITE_DONE completing\n", __func__);
mutex_lock(&audio->lock);
audlpa_pmem_fixup(audio, drv_evt->payload.aio_buf.buf_addr,
@@ -630,6 +630,7 @@
audlpa_async_send_data(audio, 0, 0);
} else {
/* read */
+ kfree(buf_node);
}
return 0;
}
diff --git a/arch/arm/mach-msm/qdsp6v2/evrc_in.c b/arch/arm/mach-msm/qdsp6v2/evrc_in.c
index 0f56620..ffe10bc 100644
--- a/arch/arm/mach-msm/qdsp6v2/evrc_in.c
+++ b/arch/arm/mach-msm/qdsp6v2/evrc_in.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2010, Code Aurora Forum. All rights reserved.
+/* Copyright (c) 2010-2011, Code Aurora Forum. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -204,8 +204,8 @@
audio = kzalloc(sizeof(struct q6audio_in), GFP_KERNEL);
if (audio == NULL) {
- pr_err("%s:session id %d: Could not allocate memory for evrc\
- driver\n", __func__, audio->ac->session);
+ pr_err("%s: Could not allocate memory for evrc\
+ driver\n", __func__);
return -ENOMEM;
}
/* Allocate memory for encoder config param */
@@ -245,8 +245,8 @@
(void *)audio);
if (!audio->ac) {
- pr_err("%s:session id %d: Could not allocate memory for audio\
- client\n", __func__, audio->ac->session);
+ pr_err("%s: Could not allocate memory for audio\
+ client\n", __func__);
kfree(audio->enc_cfg);
kfree(audio);
return -ENOMEM;
diff --git a/arch/arm/mach-msm/qdsp6v2/qcelp_in.c b/arch/arm/mach-msm/qdsp6v2/qcelp_in.c
index 894f1ed..3cf4e25 100644
--- a/arch/arm/mach-msm/qdsp6v2/qcelp_in.c
+++ b/arch/arm/mach-msm/qdsp6v2/qcelp_in.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2010, Code Aurora Forum. All rights reserved.
+/* Copyright (c) 2010-2011, Code Aurora Forum. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -201,8 +201,8 @@
audio = kzalloc(sizeof(struct q6audio_in), GFP_KERNEL);
if (audio == NULL) {
- pr_err("%s:session id %d: Could not allocate memory for qcelp\
- driver\n", __func__, audio->ac->session);
+ pr_err("%s: Could not allocate memory for qcelp\
+ driver\n", __func__);
return -ENOMEM;
}
/* Allocate memory for encoder config param */
@@ -243,8 +243,8 @@
(void *)audio);
if (!audio->ac) {
- pr_err("%s:session id %d: Could not allocate memory for audio\
- client\n", __func__, audio->ac->session);
+ pr_err("%s: Could not allocate memory for audio\
+ client\n", __func__);
kfree(audio->enc_cfg);
kfree(audio);
return -ENOMEM;
diff --git a/sound/soc/msm/qdsp6/q6asm.c b/sound/soc/msm/qdsp6/q6asm.c
index ab09342..c4fc588 100644
--- a/sound/soc/msm/qdsp6/q6asm.c
+++ b/sound/soc/msm/qdsp6/q6asm.c
@@ -1741,6 +1741,11 @@
+ sizeof(struct asm_memory_map_regions) * bufcnt;
mmap_region_cmd = kzalloc(cmd_size, GFP_KERNEL);
+ if (mmap_region_cmd == NULL) {
+ pr_err("%s: Mem alloc failed\n", __func__);
+ rc = -EINVAL;
+ return rc;
+ }
mmap_regions = (struct asm_stream_cmd_memory_map_regions *)
mmap_region_cmd;
q6asm_add_mmaphdr(&mmap_regions->hdr, cmd_size, TRUE);
@@ -1804,6 +1809,11 @@
sizeof(struct asm_memory_unmap_regions) * bufcnt;
unmap_region_cmd = kzalloc(cmd_size, GFP_KERNEL);
+ if (unmap_region_cmd == NULL) {
+ pr_err("%s: Mem alloc failed\n", __func__);
+ rc = -EINVAL;
+ return rc;
+ }
unmap_regions = (struct asm_stream_cmd_memory_unmap_regions *)
unmap_region_cmd;
q6asm_add_mmaphdr(&unmap_regions->hdr, cmd_size, TRUE);