A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 08:07:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge changes I367f8a41,I54709831 into audio-drivers.lnx.5.0.r8-rel

Browse source 
* changes:
  dsp: q6lsm: Address use after free for mmap handle
  dsp: q6lsm: Add check for payload buffer
This commit is contained in:
Linux Build Service Account 2023-08-17 02:47:49 -07:00 • committed by Gerrit - the friendly Code Review server
commit 06a107fbb1
1 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
dsp/q6lsm.c
View file

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2013-2021, Linux Foundation. All rights reserved.
* Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/fs.h>
#include <linux/mutex.h>
@ -241,6 +242,11 @@ static int q6lsm_callback(struct apr_client_data *data, void *priv)
goto done;
}
if (!client->get_param_payload) {
pr_err("%s: invalid get_param_payload buffer ptr\n", __func__);
ret = -EINVAL;
goto done;
}
memcpy((u8 *)client->get_param_payload,
(u8 *)payload + payload_min_size_expected, param_size);
done:
@ -478,6 +484,10 @@ static int q6lsm_apr_send_pkt(struct lsm_client *client, void *handle,
}
pr_debug("%s: enter wait %d\n", __func__, wait);
if (mmap_handle_p) {
pr_debug("%s: Invalid mmap_handle\n", __func__);
return -EINVAL;
}
if (wait)
mutex_lock(&lsm_common.apr_lock);
if (mmap_p) {
@ -530,6 +540,7 @@ static int q6lsm_apr_send_pkt(struct lsm_client *client, void *handle,
if (mmap_p && *mmap_p == 0)
ret = -ENOMEM;
mmap_handle_p = NULL;
pr_debug("%s: leave ret %d\n", __func__, ret);
return ret;
}
@ -2134,7 +2145,8 @@ static int q6lsm_mmapcallback(struct apr_client_data *data, void *priv)
case LSM_SESSION_CMDRSP_SHARED_MEM_MAP_REGIONS:
if (atomic_read(&client->cmd_state) == CMD_STATE_WAIT_RESP) {
spin_lock_irqsave(&mmap_lock, flags);
*mmap_handle_p = command;
if (mmap_handle_p)
*mmap_handle_p = command;
/* spin_unlock_irqrestore implies barrier */
spin_unlock_irqrestore(&mmap_lock, flags);
atomic_set(&client->cmd_state, CMD_STATE_CLEARED);