From a69e001b34dab9ac3731014666d463aa5917cfc5 Mon Sep 17 00:00:00 2001 From: Soumya Managoli Date: Mon, 24 Jul 2023 14:40:11 +0530 Subject: [PATCH] ASoC: Resolve use after free in listen sound client Updated get_param_payload buffer ptr to NULL after free to avoid use after free issue. Change-Id: I86da8c12a0bdccce690f67b037198b67640e339b Signed-off-by: Soumya Managoli --- asoc/msm-lsm-client.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/asoc/msm-lsm-client.c b/asoc/msm-lsm-client.c index aa38e8c71490..d65d6d652d06 100644 --- a/asoc/msm-lsm-client.c +++ b/asoc/msm-lsm-client.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2013-2020, The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include #include @@ -2325,6 +2325,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, case SNDRV_LSM_GET_MODULE_PARAMS_32: { struct lsm_params_get_info_32 p_info_32, *param_info_rsp = NULL; struct lsm_params_get_info *p_info = NULL; + prtd->lsm_client->get_param_payload = NULL; memset(&p_info_32, 0 , sizeof(p_info_32)); if (!prtd->lsm_client->use_topology) { @@ -2375,6 +2376,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, __func__, err); kfree(p_info); kfree(prtd->lsm_client->get_param_payload); + prtd->lsm_client->get_param_payload = NULL; goto done; } @@ -2385,6 +2387,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, err = -ENOMEM; kfree(p_info); kfree(prtd->lsm_client->get_param_payload); + prtd->lsm_client->get_param_payload = NULL; goto done; } @@ -2409,6 +2412,7 @@ free: kfree(p_info); kfree(param_info_rsp); kfree(prtd->lsm_client->get_param_payload); + prtd->lsm_client->get_param_payload = NULL; break; } case SNDRV_LSM_REG_SND_MODEL_V2: @@ -2635,6 +2639,7 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, case SNDRV_LSM_GET_MODULE_PARAMS: { struct lsm_params_get_info temp_p_info, *p_info = NULL; + prtd->lsm_client->get_param_payload = NULL; memset(&temp_p_info, 0, sizeof(temp_p_info)); if (!prtd->lsm_client->use_topology) { @@ -2706,6 +2711,7 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, free: kfree(p_info); kfree(prtd->lsm_client->get_param_payload); + prtd->lsm_client->get_param_payload = NULL; break; } case SNDRV_LSM_EVENT_STATUS: