Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bc9b0644 authored by Jay Wang's avatar Jay Wang Committed by Stephen Boyd
Browse files

ASoC: msm: Fix the issue that freed data structure is accessed 



When there is a failure while opening q6asm capturing stream,
it releases the q6asm data structure which is accessed by
stream closing function and lead to a crash. Resolving the
issue by freeing the data structure in closing function
instead of during opening failure.

Change-Id: Ie45335a98be21d3b6035115241f657185a918be0
CRs-Fixed: 373438
Signed-off-by: default avatarJay Wang <jaywang@codeaurora.org>
parent 3b2444a7

sound/soc/msm/msm-pcm-q6.c

+8 −5
Original line number Diff line number Diff line
@@ -532,12 +532,15 @@ static int msm_pcm_capture_close(struct snd_pcm_substream *substream) 
	int dir = OUT;



	pr_debug("%s\n", __func__);

	if (prtd->audio_client) {

		q6asm_cmd(prtd->audio_client, CMD_CLOSE);

		q6asm_audio_client_buf_free_contiguous(dir,

				prtd->audio_client);

		q6asm_audio_client_free(prtd->audio_client);

	}



	msm_pcm_routing_dereg_phy_stream(soc_prtd->dai_link->be_id,

		SNDRV_PCM_STREAM_CAPTURE);

	q6asm_audio_client_free(prtd->audio_client);

	kfree(prtd);



	return 0;
@@ -638,7 +641,7 @@ static int msm_pcm_hw_params(struct snd_pcm_substream *substream, 
		if (ret < 0) {

			pr_err("%s: q6asm_open_read failed\n", __func__);

			q6asm_audio_client_free(prtd->audio_client);

			kfree(prtd);

			prtd->audio_client = NULL;

			return -ENOMEM;

		}

	}