Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 627555e0 authored by Soumya Managoli's avatar Soumya Managoli Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: dsp: q6core: Avoid use after free



Add check for AVCS_CMD_RSP_LOAD_MODULE response payload
to avoid its access after free.

Change-Id: I3023e6676a27fe33d2cc0f44a49813f0ed0ebe3b
Signed-off-by: default avatarSoumya Managoli <quic_c_smanag@quicinc.com>
parent 126fb9ff
Loading
Loading
Loading
Loading
+3 −0
Original line number Diff line number Diff line
@@ -475,6 +475,8 @@ static int32_t aprv2_core_fn_q(struct apr_client_data *data, void *priv)
	case AVCS_CMD_RSP_LOAD_MODULES:
		pr_debug("%s: Received AVCS_CMD_RSP_LOAD_MODULES\n",
			 __func__);
		if (!rsp_payload)
			return -EINVAL;
		if (data->payload_size != ((sizeof(struct avcs_load_unload_modules_sec_payload)
			* rsp_payload->num_modules) + sizeof(uint32_t))) {
			pr_err("%s: payload size greater than expected size %d\n",
@@ -1061,6 +1063,7 @@ int32_t q6core_avcs_load_unload_modules(struct avcs_load_unload_modules_payload
done:
	kfree(mod);
	kfree(rsp_payload);
	rsp_payload = NULL;
	mutex_unlock(&(q6core_lcl.cmd_lock));
	return ret;
}