Commit 3ecc1a5c authored Nov 21, 2019 by Pratham Pratap

sound: usb: Don't bail out if qmi_send_indication fails



Consider a scenario where ADSP SSR happened and USB headset
gets disconnected before ADSP is up then in uaudio_disconnect_cb,
qmi_send_indication will fail leading to return from the function.
Now the uaudio_qmi_bye_cb will get called since all clients from
the node are gone which in turn will call uaudio_qmi_disconnect_work.
This can lead to NULL pointer derefernce since snd_usb_audio got
freed and was accessed in uaudio_qmi_disconnect_work.

Fix this by not bailing out if qmi_send_indication which will
ensure that uaudio_qmi_disconnect_work will wait to be queued
until in_use is false.

Change-Id: Ie22fd0a8f4aa0e33b9aaf092b658476b8c47c199
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>

parent cf2cbb63

sound/usb/usb_audio_qmi_svc.c

+2 −4

Original line number	Diff line number	Diff line
		@@ -887,10 +887,8 @@ static void uaudio_disconnect_cb(struct snd_usb_audio *chip)
		QMI_UAUDIO_STREAM_IND_MSG_V01_MAX_MSG_LEN,
		qmi_uaudio_stream_ind_msg_v01_ei,
		&disconnect_ind);
		if (ret < 0) {
		uaudio_err("qmi send failed wiht err: %d\n", ret);
		return;
		}
		if (ret < 0)
		uaudio_err("qmi send failed with err: %d\n", ret);

		ret = wait_event_interruptible(dev->disconnect_wq,
		!atomic_read(&dev->in_use));