Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 58cab708 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge changes I367f8a41,I54709831 into audio-drivers.lnx.4.0.r22-rel 

* changes:
  dsp: q6lsm: Address use after free for mmap handle
  dsp: q6lsm: Add check for payload buffer
parents 0b85c412 69442ed8

dsp/q6lsm.c

+13 −1
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2013-2020, Linux Foundation. All rights reserved.

 * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.

 */

#include <linux/fs.h>

#include <linux/mutex.h>
@@ -235,6 +236,11 @@ static int q6lsm_callback(struct apr_client_data *data, void *priv) 
			goto done;

		}



		if (!client->get_param_payload) {

			pr_err("%s: invalid get_param_payload buffer ptr\n", __func__);

			ret = -EINVAL;

			goto done;

		}

		memcpy((u8 *)client->get_param_payload,

			(u8 *)payload + payload_min_size_expected, param_size);

done:
@@ -472,6 +478,10 @@ static int q6lsm_apr_send_pkt(struct lsm_client *client, void *handle, 
	}



	pr_debug("%s: enter wait %d\n", __func__, wait);

	if (mmap_handle_p) {

		pr_debug("%s: Invalid mmap_handle\n", __func__);

		return -EINVAL;

	}

	if (wait)

		mutex_lock(&lsm_common.apr_lock);

	if (mmap_p) {
@@ -517,6 +527,7 @@ static int q6lsm_apr_send_pkt(struct lsm_client *client, void *handle, 


	if (mmap_p && *mmap_p == 0)

		ret = -ENOMEM;

	mmap_handle_p = NULL;

	pr_debug("%s: leave ret %d\n", __func__, ret);

	return ret;

}
@@ -2040,6 +2051,7 @@ static int q6lsm_mmapcallback(struct apr_client_data *data, void *priv) 
	case LSM_SESSION_CMDRSP_SHARED_MEM_MAP_REGIONS:

		if (atomic_read(&client->cmd_state) == CMD_STATE_WAIT_RESP) {

			spin_lock_irqsave(&mmap_lock, flags);

			if (mmap_handle_p)

				*mmap_handle_p = command;

			/* spin_unlock_irqrestore implies barrier */

			spin_unlock_irqrestore(&mmap_lock, flags);