samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dsp: add change to fix use-after-free issue

Browse Source 
Add change to properly handle the pointers by setting them to
NULL after free and adding some null checks before dereferencing.

Change-Id: I3e52b9a6885a8d8a91c09f75fe92ba69e3eb555f
Signed-off-by: Saurav Kumar <sauravk@codeaurora.org>
This commit is contained in:
Saurav Kumar
2020-08-18 18:33:35 +05:30
committed by Gerrit - the friendly Code Review server
parent c896ed2237
commit 9ec95bb9c8
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
dsp/msm_audio_ion.c
View File

@@ -69,7 +69,7 @@ static int msm_audio_dma_buf_map(struct dma_buf *dma_buf,
bool cma_mem)
{
struct msm_audio_alloc_data *alloc_data;
struct msm_audio_alloc_data *alloc_data = NULL;
struct device *cb_dev;
unsigned long ionflag = 0;
int rc = 0;
@@ -138,6 +138,7 @@ detach_dma_buf:
alloc_data->attach);
free_alloc_data:
kfree(alloc_data);
alloc_data = NULL;
return rc;
}
@@ -179,6 +180,7 @@ static int msm_audio_dma_buf_unmap(struct dma_buf *dma_buf, bool cma_mem)
list_del(&(alloc_data->list));
kfree(alloc_data);
alloc_data = NULL;
break;
}
}
@@ -321,6 +323,11 @@ static int msm_audio_ion_map_buf(struct dma_buf *dma_buf, dma_addr_t *paddr,
{
int rc = 0;
if (!dma_buf || !paddr || !vaddr || !plen) {
pr_err("%s: Invalid params\n", __func__);
return -EINVAL;
}
rc = msm_audio_ion_get_phys(dma_buf, paddr, plen);
if (rc) {
pr_err("%s: ION Get Physical for AUDIO failed, rc = %d\n",