lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dsp: add change to fix use-after-free issue

Browse Source 
Add change to properly handle the pointers by setting them to
NULL after free and adding some null checks before dereferencing.

Change-Id: Ic2f3ef5631d0f4e4191bf772eb0b3f0b825044a6
This commit is contained in:
Saurav Kumar 2020-10-30 16:03:27 +05:30 committed by Gerrit - the friendly Code Review server
parent dec796e30a
commit 1546c9a1b2
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
dsp/msm_audio_ion_vm.c
View File

@ -93,7 +93,7 @@ static int msm_audio_dma_buf_map(struct dma_buf *dma_buf,
bool cma_mem)
{
struct msm_audio_alloc_data *alloc_data;
struct msm_audio_alloc_data *alloc_data = NULL;
struct device *cb_dev;
unsigned long ionflag = 0;
int rc = 0;
@ -162,6 +162,7 @@ detach_dma_buf:
alloc_data->attach);
free_alloc_data:
kfree(alloc_data);
alloc_data = NULL;
return rc;
}
@ -204,6 +205,7 @@ static int msm_audio_dma_buf_unmap(struct dma_buf *dma_buf, bool cma_mem)
list_del(&(alloc_data->list));
kfree(alloc_data);
alloc_data = NULL;
break;
}
}
@ -507,6 +509,11 @@ static int msm_audio_ion_map_buf(struct dma_buf *dma_buf, dma_addr_t *paddr,
{
int rc = 0;
if (!dma_buf || !paddr || !vaddr || !plen) {
pr_err("%s: Invalid params\n", __func__);
return -EINVAL;
}
rc = msm_audio_ion_get_phys(dma_buf, paddr, plen);
if (rc) {
pr_err("%s: ION Get Physical for AUDIO failed, rc = %d\n",