Merge "dsp: q6lsm: Address use after free for mmap handle" (6a075b57) · Commits · e / devices / android_kernel_oneplus_sm7250

dsp/q6lsm.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -478,6 +478,10 @@ static int q6lsm_apr_send_pkt(struct lsm_client client, void handle,
		}

		pr_debug("%s: enter wait %d\n", __func__, wait);
		if (mmap_handle_p) {
		pr_debug("%s: Invalid mmap_handle\n", __func__);
		return -EINVAL;
		}
		if (wait)
		mutex_lock(&lsm_common.apr_lock);
		if (mmap_p) {
		@@ -523,6 +527,7 @@ static int q6lsm_apr_send_pkt(struct lsm_client client, void handle,

		if (mmap_p && *mmap_p == 0)
		ret = -ENOMEM;
		mmap_handle_p = NULL;
		pr_debug("%s: leave ret %d\n", __func__, ret);
		return ret;
		}
		@@ -2046,6 +2051,7 @@ static int q6lsm_mmapcallback(struct apr_client_data data, void priv)
		case LSM_SESSION_CMDRSP_SHARED_MEM_MAP_REGIONS:
		if (atomic_read(&client->cmd_state) == CMD_STATE_WAIT_RESP) {
		spin_lock_irqsave(&mmap_lock, flags);
		if (mmap_handle_p)
		*mmap_handle_p = command;
		/* spin_unlock_irqrestore implies barrier */
		spin_unlock_irqrestore(&mmap_lock, flags);