Merge "dsp: add change to fix use-after-free issue" (aa3648d0) · Commits · e / devices / android_kernel_fairphone_FP4

dsp/msm_audio_ion.c

+9 −2

Original line number	Original line	Diff line number	Diff line
	// SPDX-License-Identifier: GPL-2.0-only		// SPDX-License-Identifier: GPL-2.0-only
	/*		/*
	* Copyright (c) 2013-2019, The Linux Foundation. All rights reserved.		* Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
	*/		*/

	#include <linux/init.h>		#include <linux/init.h>
	@@ -67,7 +67,7 @@ static int msm_audio_dma_buf_map(struct dma_buf *dma_buf,
	dma_addr_t addr, size_t len)		dma_addr_t addr, size_t len)
	{		{

	struct msm_audio_alloc_data *alloc_data;		struct msm_audio_alloc_data *alloc_data = NULL;
	struct device *cb_dev;		struct device *cb_dev;
	unsigned long ionflag = 0;		unsigned long ionflag = 0;
	int rc = 0;		int rc = 0;
	@@ -133,6 +133,7 @@ static int msm_audio_dma_buf_map(struct dma_buf *dma_buf,
	alloc_data->attach);		alloc_data->attach);
	free_alloc_data:		free_alloc_data:
	kfree(alloc_data);		kfree(alloc_data);
			alloc_data = NULL;

	return rc;		return rc;
	}		}
	@@ -170,6 +171,7 @@ static int msm_audio_dma_buf_unmap(struct dma_buf *dma_buf)

	list_del(&(alloc_data->list));		list_del(&(alloc_data->list));
	kfree(alloc_data);		kfree(alloc_data);
			alloc_data = NULL;
	break;		break;
	}		}
	}		}
	@@ -312,6 +314,11 @@ static int msm_audio_ion_map_buf(struct dma_buf dma_buf, dma_addr_t paddr,
	{		{
	int rc = 0;		int rc = 0;

			if (!dma_buf \|\| !paddr \|\| !vaddr \|\| !plen) {
			pr_err("%s: Invalid params\n", __func__);
			return -EINVAL;
			}

	rc = msm_audio_ion_get_phys(dma_buf, paddr, plen);		rc = msm_audio_ion_get_phys(dma_buf, paddr, plen);
	if (rc) {		if (rc) {
	pr_err("%s: ION Get Physical for AUDIO failed, rc = %d\n",		pr_err("%s: ION Get Physical for AUDIO failed, rc = %d\n",

dsp/q6asm.c

+6 −0

Original line number	Original line	Diff line number	Diff line
	@@ -8486,6 +8486,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
	if (mmap_region_cmd == NULL) {		if (mmap_region_cmd == NULL) {
	rc = -EINVAL;		rc = -EINVAL;
	kfree(buffer_node);		kfree(buffer_node);
			buffer_node = NULL;
	return rc;		return rc;
	}		}
	mmap_regions = (struct avs_cmd_shared_mem_map_regions *)		mmap_regions = (struct avs_cmd_shared_mem_map_regions *)
	@@ -8522,6 +8523,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
	mmap_regions->hdr.opcode, rc);		mmap_regions->hdr.opcode, rc);
	rc = -EINVAL;		rc = -EINVAL;
	kfree(buffer_node);		kfree(buffer_node);
			buffer_node = NULL;
	goto fail_cmd;		goto fail_cmd;
	}		}

	@@ -8533,6 +8535,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
	pr_err("%s: timeout. waited for memory_map\n", __func__);		pr_err("%s: timeout. waited for memory_map\n", __func__);
	rc = -ETIMEDOUT;		rc = -ETIMEDOUT;
	kfree(buffer_node);		kfree(buffer_node);
			buffer_node = NULL;
	goto fail_cmd;		goto fail_cmd;
	}		}
	if (atomic_read(&ac->mem_state) > 0) {		if (atomic_read(&ac->mem_state) > 0) {
	@@ -8542,6 +8545,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
	rc = adsp_err_get_lnx_err_code(		rc = adsp_err_get_lnx_err_code(
	atomic_read(&ac->mem_state));		atomic_read(&ac->mem_state));
	kfree(buffer_node);		kfree(buffer_node);
			buffer_node = NULL;
	goto fail_cmd;		goto fail_cmd;
	}		}
	mutex_lock(&ac->cmd_lock);		mutex_lock(&ac->cmd_lock);
	@@ -8561,6 +8565,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir,
	rc = 0;		rc = 0;
	fail_cmd:		fail_cmd:
	kfree(mmap_region_cmd);		kfree(mmap_region_cmd);
			mmap_region_cmd = NULL;
	return rc;		return rc;
	}		}
	EXPORT_SYMBOL(q6asm_memory_map_regions);		EXPORT_SYMBOL(q6asm_memory_map_regions);
	@@ -8656,6 +8661,7 @@ static int q6asm_memory_unmap_regions(struct audio_client *ac, int dir)
	if (buf_node->buf_phys_addr == buf_add) {		if (buf_node->buf_phys_addr == buf_add) {
	list_del(&buf_node->list);		list_del(&buf_node->list);
	kfree(buf_node);		kfree(buf_node);
			buf_node = NULL;
	break;		break;
	}		}
	}		}