nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-22 17:25:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

tegra-alt: adsp: fix coverity defects

Browse Source 
Add validity checks on data from userspace
Fix variable hiding

Coverity ID 31982 31979

Bug 200192147

Change-Id: I7fd6a8f1016aa5fe819c230e8154e3f82971c2d9
Signed-off-by: Viraj Karandikar <vkarandikar@nvidia.com>
Reviewed-on: http://git-master/r/1275950
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Ravindra Lokhande <rlokhande@nvidia.com>
This commit is contained in:
Viraj Karandikar
2016-12-23 11:49:43 +05:30
committed by Sameer Pujar
parent 26caa435c1
commit f16184f16f
1 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
sound/soc/tegra-alt/tegra210_adsp_alt.c
View File

@@ -1070,21 +1070,23 @@ static status_t tegra210_adsp_msg_handler(uint32_t msg, void *data)
} }
break; break;
case apm_cmd_raw_data_ready: { case apm_cmd_raw_data_ready: {
apm_raw_data_msg_t *msg = kzalloc(sizeof(apm_raw_data_msg_t), GFP_ATOMIC); apm_raw_data_msg_t *raw_msg =
if (!msg) { kzalloc(sizeof(apm_raw_data_msg_t), GFP_ATOMIC);
if (!raw_msg) {
ret = -ENOMEM; ret = -ENOMEM;
break; break;
} }
ret = tegra210_adsp_get_raw_data_msg(app->apm, msg); ret = tegra210_adsp_get_raw_data_msg(app->apm, raw_msg);
if (ret < 0) { if (ret < 0) {
pr_err("Dequeue failed %d.", ret); pr_err("Dequeue failed %d.", ret);
kfree(msg); kfree(raw_msg);
break; break;
} }
memcpy(app->read_data.data, msg->msg.fx_raw_data_params.data, memcpy(app->read_data.data,
raw_msg->msg.fx_raw_data_params.data,
sizeof(app->read_data.data)); sizeof(app->read_data.data));
kfree(msg); kfree(raw_msg);
complete(app->msg_complete); complete(app->msg_complete);
} }
break; break;
@@ -3407,6 +3409,13 @@ static int tegra210_adsp_tlv_callback(struct snd_kcontrol *kcontrol,
} }
call_params = (nvfx_call_params_t *)tlv_data; call_params = (nvfx_call_params_t *)tlv_data;
if (call_params->size <= 0 ||
(call_params->size >
sizeof(apm_msg->msg.fx_raw_data_params.data))) {
ret = -EINVAL;
devm_kfree(adsp->dev, apm_msg);
goto end;
}
memcpy(&apm_msg->msg.fx_raw_data_params.data, memcpy(&apm_msg->msg.fx_raw_data_params.data,
call_params, call_params->size); call_params, call_params->size);