From e3971c3e31692d75c8d9ceff33a4342e485d07c1 Mon Sep 17 00:00:00 2001 From: Soumya Managoli Date: Fri, 23 Jun 2023 12:57:51 +0530 Subject: [PATCH] ASoC: dsp: q6core: Avoid use after free Add check for AVCS_CMD_RSP_LOAD_MODULE response payload to avoid its access after free. Change-Id: I3023e6676a27fe33d2cc0f44a49813f0ed0ebe3b Signed-off-by: Soumya Managoli --- dsp/q6core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dsp/q6core.c b/dsp/q6core.c index 6684b2a7d0df..df72815babc9 100644 --- a/dsp/q6core.c +++ b/dsp/q6core.c @@ -475,6 +475,8 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv) case AVCS_CMD_RSP_LOAD_MODULES: pr_debug("%s: Received AVCS_CMD_RSP_LOAD_MODULES\n", __func__); + if (!rsp_payload) + return -EINVAL; if (data->payload_size != ((sizeof(struct avcs_load_unload_modules_sec_payload) * rsp_payload->num_modules) + sizeof(uint32_t))) { pr_err("%s: payload size greater than expected size %d\n", @@ -1099,6 +1101,7 @@ int32_t q6core_avcs_load_unload_modules(struct avcs_load_unload_modules_payload done: kfree(mod); kfree(rsp_payload); + rsp_payload = NULL; mutex_unlock(&(q6core_lcl.cmd_lock)); return ret; }