lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "ASoC: Resolve use after free in listen sound client"

Browse Source
This commit is contained in:
qctecmdr 2023-08-01 05:50:22 -07:00 committed by Gerrit - the friendly Code Review server
commit 3523bb525a
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
asoc/msm-lsm-client.c
View File

@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
* Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
* Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/init.h>
#include <linux/err.h>
@ -2325,6 +2325,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream,
case SNDRV_LSM_GET_MODULE_PARAMS_32: {
struct lsm_params_get_info_32 p_info_32, *param_info_rsp = NULL;
struct lsm_params_get_info *p_info = NULL;
prtd->lsm_client->get_param_payload = NULL;
memset(&p_info_32, 0 , sizeof(p_info_32));
if (!prtd->lsm_client->use_topology) {
@ -2375,6 +2376,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream,
__func__, err);
kfree(p_info);
kfree(prtd->lsm_client->get_param_payload);
prtd->lsm_client->get_param_payload = NULL;
goto done;
}
@ -2385,6 +2387,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream,
err = -ENOMEM;
kfree(p_info);
kfree(prtd->lsm_client->get_param_payload);
prtd->lsm_client->get_param_payload = NULL;
goto done;
}
@ -2409,6 +2412,7 @@ free:
kfree(p_info);
kfree(param_info_rsp);
kfree(prtd->lsm_client->get_param_payload);
prtd->lsm_client->get_param_payload = NULL;
break;
}
case SNDRV_LSM_REG_SND_MODEL_V2:
@ -2635,6 +2639,7 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream,
case SNDRV_LSM_GET_MODULE_PARAMS: {
struct lsm_params_get_info temp_p_info, *p_info = NULL;
prtd->lsm_client->get_param_payload = NULL;
memset(&temp_p_info, 0, sizeof(temp_p_info));
if (!prtd->lsm_client->use_topology) {
@ -2715,6 +2720,7 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream,
free:
kfree(p_info);
kfree(prtd->lsm_client->get_param_payload);
prtd->lsm_client->get_param_payload = NULL;
break;
}
case SNDRV_LSM_EVENT_STATUS: