samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dsp: fix dangling pointer access

Browse Source 
Assign the circular buffer address to port buffer only after ION
allocation is succesful to fix dangling pointer access.
Also, lock the circular buffer memory allocation in order to
avoid multiple allocations for a port.

CRs-Fixed: 2096407
Change-Id: I22c1d55ea611ac59cdca51924787f6831bad8c2b
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
This commit is contained in:
Aditya Bavanari
2017-09-13 11:37:53 +05:30
parent 8f7ccc2e6f
commit a8aea17ddd
1 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
dsp/q6asm.c
View File

@@ -3350,6 +3350,15 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac,
int bytes_to_alloc, rc; int bytes_to_alloc, rc;
size_t len; size_t len;
mutex_lock(&ac->cmd_lock);
if (ac->port[dir].buf) {
pr_err("%s: Buffer already allocated\n", __func__);
rc = -EINVAL;
mutex_unlock(&ac->cmd_lock);
goto done;
}
buf_circ = kzalloc(sizeof(struct audio_buffer), GFP_KERNEL); buf_circ = kzalloc(sizeof(struct audio_buffer), GFP_KERNEL);
if (!buf_circ) { if (!buf_circ) {
@@ -3357,10 +3366,6 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac,
goto done; goto done;
} }
mutex_lock(&ac->cmd_lock);
ac->port[dir].buf = buf_circ;
bytes_to_alloc = bufsz * bufcnt; bytes_to_alloc = bufsz * bufcnt;
bytes_to_alloc = PAGE_ALIGN(bytes_to_alloc); bytes_to_alloc = PAGE_ALIGN(bytes_to_alloc);
@@ -3372,11 +3377,12 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac,
if (rc) { if (rc) {
pr_err("%s: Audio ION alloc is failed, rc = %d\n", __func__, pr_err("%s: Audio ION alloc is failed, rc = %d\n", __func__,
rc); rc);
mutex_unlock(&ac->cmd_lock);
kfree(buf_circ); kfree(buf_circ);
mutex_unlock(&ac->cmd_lock);
goto done; goto done;
} }
ac->port[dir].buf = buf_circ;
buf_circ->used = dir ^ 1; buf_circ->used = dir ^ 1;
buf_circ->size = bytes_to_alloc; buf_circ->size = bytes_to_alloc;
buf_circ->actual_size = bytes_to_alloc; buf_circ->actual_size = bytes_to_alloc;
@@ -3541,12 +3547,6 @@ int q6asm_open_shared_io(struct audio_client *ac,
goto done; goto done;
} }
if (ac->port[dir].buf) {
pr_err("%s: Buffer already allocated\n", __func__);
rc = -EINVAL;
goto done;
}
rc = q6asm_set_shared_circ_buff(ac, open, bufsz, bufcnt, dir); rc = q6asm_set_shared_circ_buff(ac, open, bufsz, bufcnt, dir);
if (rc) if (rc)