A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 21:59:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

ASoC: dsp: q6core: Avoid use after free

Browse source 
Add check for AVCS_CMD_RSP_LOAD_MODULE response payload
to avoid its access after free.

Change-Id: I3023e6676a27fe33d2cc0f44a49813f0ed0ebe3b
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
This commit is contained in:
Soumya Managoli 2023-06-23 12:57:51 +05:30 • committed by Gerrit - the friendly Code Review server
commit e3971c3e31
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
dsp/q6core.c
View file

@ -475,6 +475,8 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
case AVCS_CMD_RSP_LOAD_MODULES:
pr_debug("%s: Received AVCS_CMD_RSP_LOAD_MODULES\n",
__func__);
if (!rsp_payload)
return -EINVAL;
if (data->payload_size != ((sizeof(struct avcs_load_unload_modules_sec_payload)
* rsp_payload->num_modules) + sizeof(uint32_t))) {
pr_err("%s: payload size greater than expected size %d\n",
@ -1099,6 +1101,7 @@ int32_t q6core_avcs_load_unload_modules(struct avcs_load_unload_modules_payload
done:
kfree(mod);
kfree(rsp_payload);
rsp_payload = NULL;
mutex_unlock(&(q6core_lcl.cmd_lock));
return ret;
}