From 1546c9a1b2974bb3153dfdfd8190e3edf145945b Mon Sep 17 00:00:00 2001 From: Saurav Kumar Date: Fri, 30 Oct 2020 16:03:27 +0530 Subject: [PATCH] dsp: add change to fix use-after-free issue Add change to properly handle the pointers by setting them to NULL after free and adding some null checks before dereferencing. Change-Id: Ic2f3ef5631d0f4e4191bf772eb0b3f0b825044a6 --- dsp/msm_audio_ion_vm.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/dsp/msm_audio_ion_vm.c b/dsp/msm_audio_ion_vm.c index 34bf0a228412..40d11a0e285d 100644 --- a/dsp/msm_audio_ion_vm.c +++ b/dsp/msm_audio_ion_vm.c @@ -93,7 +93,7 @@ static int msm_audio_dma_buf_map(struct dma_buf *dma_buf, bool cma_mem) { - struct msm_audio_alloc_data *alloc_data; + struct msm_audio_alloc_data *alloc_data = NULL; struct device *cb_dev; unsigned long ionflag = 0; int rc = 0; @@ -162,6 +162,7 @@ detach_dma_buf: alloc_data->attach); free_alloc_data: kfree(alloc_data); + alloc_data = NULL; return rc; } @@ -204,6 +205,7 @@ static int msm_audio_dma_buf_unmap(struct dma_buf *dma_buf, bool cma_mem) list_del(&(alloc_data->list)); kfree(alloc_data); + alloc_data = NULL; break; } } @@ -507,6 +509,11 @@ static int msm_audio_ion_map_buf(struct dma_buf *dma_buf, dma_addr_t *paddr, { int rc = 0; + if (!dma_buf || !paddr || !vaddr || !plen) { + pr_err("%s: Invalid params\n", __func__); + return -EINVAL; + } + rc = msm_audio_ion_get_phys(dma_buf, paddr, plen); if (rc) { pr_err("%s: ION Get Physical for AUDIO failed, rc = %d\n",