A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 21:59:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

dsp: fix dangling pointer access

Browse source 
Assign the circular buffer address to port buffer only after ION
allocation is succesful to fix dangling pointer access.
Also, lock the circular buffer memory allocation in order to
avoid multiple allocations for a port.

CRs-Fixed: 2096407
Change-Id: I22c1d55ea611ac59cdca51924787f6831bad8c2b
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
This commit is contained in:
Aditya Bavanari 2017-09-13 11:37:53 +05:30
commit a8aea17ddd
1 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

22
dsp/q6asm.c
View file

@ -3350,6 +3350,15 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac,
int bytes_to_alloc, rc;
size_t len;
mutex_lock(&ac->cmd_lock);
if (ac->port[dir].buf) {
pr_err("%s: Buffer already allocated\n", __func__);
rc = -EINVAL;
mutex_unlock(&ac->cmd_lock);
goto done;
}
buf_circ = kzalloc(sizeof(struct audio_buffer), GFP_KERNEL);
if (!buf_circ) {
@ -3357,10 +3366,6 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac,
goto done;
}
mutex_lock(&ac->cmd_lock);
ac->port[dir].buf = buf_circ;
bytes_to_alloc = bufsz * bufcnt;
bytes_to_alloc = PAGE_ALIGN(bytes_to_alloc);
@ -3372,11 +3377,12 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac,
if (rc) {
pr_err("%s: Audio ION alloc is failed, rc = %d\n", __func__,
rc);
mutex_unlock(&ac->cmd_lock);
kfree(buf_circ);
mutex_unlock(&ac->cmd_lock);
goto done;
}
ac->port[dir].buf = buf_circ;
buf_circ->used = dir ^ 1;
buf_circ->size = bytes_to_alloc;
buf_circ->actual_size = bytes_to_alloc;
@ -3541,12 +3547,6 @@ int q6asm_open_shared_io(struct audio_client *ac,
goto done;
}
if (ac->port[dir].buf) {
pr_err("%s: Buffer already allocated\n", __func__);
rc = -EINVAL;
goto done;
}
rc = q6asm_set_shared_circ_buff(ac, open, bufsz, bufcnt, dir);
if (rc)