Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 154ac2f8 authored by Saurav Kumar's avatar Saurav Kumar Committed by Gerrit - the friendly Code Review server
Browse files

dsp: add change to fix use-after-free issue 

Add change to properly handle the pointers by setting them to
NULL after free and adding some null checks before dereferencing.

Change-Id: Ic2f3ef5631d0f4e4191bf772eb0b3f0b825044a6
parent 5bdb6c33

dsp/msm_audio_ion_vm.c

+9 −1
Original line number Diff line number Diff line
@@ -124,7 +124,7 @@ static int msm_audio_ion_dma_buf_map(struct dma_buf *dma_buf, 
				 dma_addr_t *addr, size_t *len)

{



	struct msm_audio_alloc_data *alloc_data;

	struct msm_audio_alloc_data *alloc_data = NULL;

	struct device *cb_dev;

	unsigned long ionflag = 0;

	int rc = 0;
@@ -189,6 +189,7 @@ static int msm_audio_ion_dma_buf_map(struct dma_buf *dma_buf, 
	dma_buf_detach(dma_buf, alloc_data->attach);

free_alloc_data:

	kfree(alloc_data);

	alloc_data = NULL;



	return rc;

}
@@ -262,6 +263,7 @@ static int msm_audio_dma_buf_unmap(void *handle) 


				list_del(&(alloc_data->list));

				kfree(alloc_data);

				alloc_data = NULL;

				break;

			}

		} else {
@@ -278,6 +280,7 @@ static int msm_audio_dma_buf_unmap(void *handle) 


				list_del(&(alloc_data->list));

				kfree(alloc_data);

				alloc_data = NULL;

				break;

			}

		}
@@ -541,6 +544,11 @@ static int msm_audio_ion_map_buf(void *handle, dma_addr_t *paddr, 
{

	int rc = 0;



	if (!handle || !paddr || !vaddr || !plen) {

		pr_err("%s: Invalid params\n", __func__);

		return -EINVAL;

	}



	rc = msm_audio_ion_get_phys((struct dma_buf*) handle, paddr, plen);

	if (rc) {

		pr_err("%s: ION Get Physical for AUDIO failed, rc = %d\n",