Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5b27ee0c authored by Laxminath Kasam's avatar Laxminath Kasam
Browse files

ASoC: msm: qdsp6v2: fix null pointer access during SSR 



While SSR in progress, CMD_CLOSE is sent to asm driver
and at the same time ac->apr handle is set to NULL
as part of RESET_EVENTS callback to this driver.
As both contexts are not synchronized, sometimes
ac->apr handle structure is dereferenced after it
is set to NULL. Fix the issue by having synchronization
between the two contexts.

Change-Id: I0840fbf8281e48f20293ef3d797ff67a3e10e757
Signed-off-by: default avatarLaxminath Kasam <lkasam@codeaurora.org>
parent 7558a649

sound/soc/msm/qdsp6v2/q6asm.c

+4 −1
Original line number Diff line number Diff line
@@ -1447,6 +1447,7 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
	}



	if (data->opcode == RESET_EVENTS) {

		mutex_lock(&ac->cmd_lock);

		atomic_set(&ac->reset, 1);

		if (ac->apr == NULL)

			ac->apr = ac->apr2;
@@ -1462,6 +1463,7 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) 
		atomic_set(&ac->cmd_state, 0);

		wake_up(&ac->time_wait);

		wake_up(&ac->cmd_wait);

		mutex_unlock(&ac->cmd_lock);

		return 0;

	}
@@ -1879,12 +1881,13 @@ static void __q6asm_add_hdr(struct audio_client *ac, struct apr_hdr *hdr, 
{

	dev_vdbg(ac->dev, "%s: pkt_size=%d cmd_flg=%d session=%d stream_id=%d\n",

			__func__, pkt_size, cmd_flg, ac->session, stream_id);

	mutex_lock(&ac->cmd_lock);

	if (ac->apr == NULL) {

		pr_err("%s: AC APR handle NULL", __func__);

		mutex_unlock(&ac->cmd_lock);

		return;

	}



	mutex_lock(&ac->cmd_lock);

	hdr->hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD, \

			APR_HDR_LEN(sizeof(struct apr_hdr)),\

			APR_PKT_VER);