Merge "ASoC: Resolve use after free in listen sound client" into audio-drivers.lnx.4.0.r3 (4561ac47) · Commits · e / devices / android_kernel_fairphone_FP4

asoc/msm-lsm-client.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -2112,6 +2112,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream,
		case SNDRV_LSM_GET_MODULE_PARAMS_32: {
		struct lsm_params_get_info_32 p_info_32, *param_info_rsp = NULL;
		struct lsm_params_get_info *p_info = NULL;
		prtd->lsm_client->get_param_payload = NULL;

		memset(&p_info_32, 0 , sizeof(p_info_32));
		if (!prtd->lsm_client->use_topology) {
		@@ -2162,6 +2163,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream,
		__func__, err);
		kfree(p_info);
		kfree(prtd->lsm_client->get_param_payload);
		prtd->lsm_client->get_param_payload = NULL;
		goto done;
		}

		@@ -2172,6 +2174,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream,
		err = -ENOMEM;
		kfree(p_info);
		kfree(prtd->lsm_client->get_param_payload);
		prtd->lsm_client->get_param_payload = NULL;
		goto done;
		}

		@@ -2196,6 +2199,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream,
		kfree(p_info);
		kfree(param_info_rsp);
		kfree(prtd->lsm_client->get_param_payload);
		prtd->lsm_client->get_param_payload = NULL;
		break;
		}
		case SNDRV_LSM_REG_SND_MODEL_V2:
		@@ -2407,6 +2411,7 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream,

		case SNDRV_LSM_GET_MODULE_PARAMS: {
		struct lsm_params_get_info temp_p_info, *p_info = NULL;
		prtd->lsm_client->get_param_payload = NULL;

		memset(&temp_p_info, 0, sizeof(temp_p_info));
		if (!prtd->lsm_client->use_topology) {
		@@ -2478,6 +2483,7 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream,
		free:
		kfree(p_info);
		kfree(prtd->lsm_client->get_param_payload);
		prtd->lsm_client->get_param_payload = NULL;
		break;
		}
		case SNDRV_LSM_EVENT_STATUS: