Merge "dsp: add change to handle use-after-free in cal_utils_is_cal_stale" (3df4c1d5) · Commits · e / devices / android_kernel_fairphone_FP5

asoc/msm-pcm-routing-v2.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1372,7 +1372,7 @@ static struct cal_block_data *msm_routing_find_topology_by_path(int path,
		cal_block = list_entry(ptr,
		struct cal_block_data, list);

		if (cal_utils_is_cal_stale(cal_block))
		if (cal_utils_is_cal_stale(cal_block, cal_data[cal_index]))
		continue;

		if (((struct audio_cal_info_adm_top *)cal_block
		@@ -1402,7 +1402,7 @@ static struct cal_block_data *msm_routing_find_topology(int path,
		cal_block = list_entry(ptr,
		struct cal_block_data, list);

		if (cal_utils_is_cal_stale(cal_block))
		if (cal_utils_is_cal_stale(cal_block, cal_data[cal_index]))
		continue;

		cal_info = (struct audio_cal_info_adm_top *)

dsp/audio_cal_utils.c

+34 −4

Original line number	Diff line number	Diff line
		@@ -10,6 +10,8 @@
		#include <linux/mutex.h>
		#include <dsp/audio_cal_utils.h>

		spinlock_t cal_lock;

		static int unmap_memory(struct cal_type_data *cal_type,
		struct cal_block_data *cal_block);

		@@ -917,6 +919,7 @@ int cal_utils_dealloc_cal(size_t data_size, void *data,
		int ret = 0;
		struct cal_block_data *cal_block;
		struct audio_cal_type_dealloc *dealloc_data = data;
		unsigned long flags = 0;

		pr_debug("%s\n", __func__);

		@@ -964,7 +967,9 @@ int cal_utils_dealloc_cal(size_t data_size, void *data,
		if (ret < 0)
		goto err;

		spin_lock_irqsave(&cal_lock, flags);
		delete_cal_block(cal_block);
		spin_unlock_irqrestore(&cal_lock, flags);
		err:
		mutex_unlock(&cal_type->lock);
		done:
		@@ -1079,18 +1084,43 @@ void cal_utils_mark_cal_used(struct cal_block_data *cal_block)
		}
		EXPORT_SYMBOL(cal_utils_mark_cal_used);

		int __init cal_utils_init(void)
		{
		spin_lock_init(&cal_lock);
		return 0;
		}
		/**
		* cal_utils_is_cal_stale
		*
		* @cal_block: pointer to cal block
		*
		* @cal_type: pointer to the cal type
		*
		* Returns true if cal block is stale, false otherwise
		*/
		bool cal_utils_is_cal_stale(struct cal_block_data *cal_block)
		bool cal_utils_is_cal_stale(struct cal_block_data cal_block, struct cal_type_data cal_type)
		{
		if ((cal_block) && (cal_block->cal_stale))
		return true;
		bool ret = false;
		unsigned long flags = 0;

		return false;
		if (!cal_type) {
		pr_err("%s: cal_type is Null", __func__);
		goto done;
		}

		spin_lock_irqsave(&cal_lock, flags);
		cal_block = cal_utils_get_only_cal_block(cal_type);
		if (!cal_block) {
		pr_err("%s: cal_block is Null", __func__);
		goto unlock;
		}

		if (cal_block->cal_stale)
		ret = true;

		unlock:
		spin_unlock_irqrestore(&cal_lock, flags);
		done:
		return ret;
		}
		EXPORT_SYMBOL(cal_utils_is_cal_stale);

dsp/audio_calibration.c

+2 −1

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/*
		* Copyright (c) 2014, 2016-2017, The Linux Foundation. All rights reserved.
		* Copyright (c) 2014, 2016-2017, 2020, The Linux Foundation. All rights reserved.
		*/
		#include <linux/slab.h>
		#include <linux/fs.h>
		@@ -591,6 +591,7 @@ int __init audio_cal_init(void)

		pr_debug("%s\n", __func__);

		cal_utils_init();
		memset(&audio_cal, 0, sizeof(audio_cal));
		mutex_init(&audio_cal.common_lock);
		for (; i < MAX_CAL_TYPES; i++) {

dsp/q6adm.c

+6 −5

Original line number	Diff line number	Diff line
		@@ -2038,7 +2038,7 @@ static void send_adm_custom_topology(void)
		this_adm.set_custom_topology = 0;

		cal_block = cal_utils_get_only_cal_block(this_adm.cal_data[cal_index]);
		if (cal_block == NULL \|\| cal_utils_is_cal_stale(cal_block))
		if (cal_block == NULL \|\| cal_utils_is_cal_stale(cal_block, this_adm.cal_data[cal_index]))
		goto unlock;

		pr_debug("%s: Sending cal_index %d\n", __func__, cal_index);
		@@ -2178,7 +2178,7 @@ static struct cal_block_data *adm_find_cal_by_path(int cal_index, int path)
		cal_block = list_entry(ptr,
		struct cal_block_data, list);

		if (cal_utils_is_cal_stale(cal_block))
		if (cal_utils_is_cal_stale(cal_block, this_adm.cal_data[cal_index]))
		continue;

		if (cal_index == ADM_AUDPROC_CAL \|\|
		@@ -2217,7 +2217,7 @@ static struct cal_block_data *adm_find_cal_by_app_type(int cal_index, int path,
		cal_block = list_entry(ptr,
		struct cal_block_data, list);

		if (cal_utils_is_cal_stale(cal_block))
		if (cal_utils_is_cal_stale(cal_block, this_adm.cal_data[cal_index]))
		continue;

		if (cal_index == ADM_AUDPROC_CAL \|\|
		@@ -2259,7 +2259,7 @@ static struct cal_block_data *adm_find_cal(int cal_index, int path,

		cal_block = list_entry(ptr,
		struct cal_block_data, list);
		if (cal_utils_is_cal_stale(cal_block))
		if (cal_utils_is_cal_stale(cal_block, this_adm.cal_data[cal_index]))
		continue;

		if (cal_index == ADM_AUDPROC_CAL \|\|
		@@ -4120,7 +4120,8 @@ int send_rtac_audvol_cal(void)

		cal_block = cal_utils_get_only_cal_block(
		this_adm.cal_data[ADM_RTAC_AUDVOL_CAL]);
		if (cal_block == NULL \|\| cal_utils_is_cal_stale(cal_block)) {
		if (cal_block == NULL \|\| cal_utils_is_cal_stale(cal_block,
		this_adm.cal_data[ADM_RTAC_AUDVOL_CAL])) {
		pr_err("%s: can't find cal block!\n", __func__);
		goto unlock;
		}

dsp/q6afe.c

+6 −6

Original line number	Diff line number	Diff line
		@@ -2179,7 +2179,7 @@ static void afe_send_custom_topology(void)
		goto unlock;
		this_afe.set_custom_topology = 0;
		cal_block = cal_utils_get_only_cal_block(this_afe.cal_data[cal_index]);
		if (cal_block == NULL \|\| cal_utils_is_cal_stale(cal_block)) {
		if (cal_block == NULL \|\| cal_utils_is_cal_stale(cal_block, this_afe.cal_data[cal_index])) {
		pr_err("%s cal_block not found!!\n", __func__);
		goto unlock;
		}
		@@ -3027,7 +3027,7 @@ static struct cal_block_data *afe_find_cal_topo_id_by_port(
		cal_block = list_entry(ptr,
		struct cal_block_data, list);
		/* Skip cal_block if it is already marked stale */
		if (cal_utils_is_cal_stale(cal_block))
		if (cal_utils_is_cal_stale(cal_block, cal_type))
		continue;
		pr_debug("%s: port id: 0x%x, dev_acdb_id: %d\n", __func__,
		port_id, this_afe.dev_acdb_id[afe_port_index]);
		@@ -3602,7 +3602,7 @@ static int send_afe_cal_type(int cal_index, int port_id)
		cal_block = cal_utils_get_only_cal_block(
		this_afe.cal_data[cal_index]);

		if (cal_block == NULL \|\| cal_utils_is_cal_stale(cal_block)) {
		if (cal_block == NULL \|\| cal_utils_is_cal_stale(cal_block, this_afe.cal_data[cal_index])) {
		pr_err_ratelimited("%s cal_block not found!!\n", __func__);
		ret = -EINVAL;
		goto unlock;
		@@ -8131,7 +8131,7 @@ static int afe_sidetone_iir(u16 tx_port_id)
		}
		mutex_lock(&this_afe.cal_data[cal_index]->lock);
		cal_block = cal_utils_get_only_cal_block(this_afe.cal_data[cal_index]);
		if (cal_block == NULL \|\| cal_utils_is_cal_stale(cal_block)) {
		if (cal_block == NULL \|\| cal_utils_is_cal_stale(cal_block, this_afe.cal_data[cal_index])) {
		pr_err("%s: cal_block not found\n ", __func__);
		mutex_unlock(&this_afe.cal_data[cal_index]->lock);
		ret = -EINVAL;
		@@ -8258,7 +8258,7 @@ static int afe_sidetone(u16 tx_port_id, u16 rx_port_id, bool enable)

		mutex_lock(&this_afe.cal_data[cal_index]->lock);
		cal_block = cal_utils_get_only_cal_block(this_afe.cal_data[cal_index]);
		if (cal_block == NULL \|\| cal_utils_is_cal_stale(cal_block)) {
		if (cal_block == NULL \|\| cal_utils_is_cal_stale(cal_block, this_afe.cal_data[cal_index])) {
		pr_err("%s: cal_block not found\n", __func__);
		mutex_unlock(&this_afe.cal_data[cal_index]->lock);
		ret = -EINVAL;
		@@ -10326,7 +10326,7 @@ static struct cal_block_data *afe_find_hw_delay_by_path(
		cal_block = list_entry(ptr,
		struct cal_block_data, list);

		if (cal_utils_is_cal_stale(cal_block))
		if (cal_utils_is_cal_stale(cal_block, cal_type))
		continue;

		if (((struct audio_cal_info_hw_delay *)cal_block->cal_info)