Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c6414d8e authored by Karthik Reddy Katta's avatar Karthik Reddy Katta Committed by Gerrit - the friendly Code Review server
Browse files

voice_svc : Fix crash in voice_svc driver during SSR 



Current implementation allocates invalid amount of
memory for payload when RESET_EVENTS is received.
Set the payload size to zero. Avoid allocating
and accessing the payload memory for RESET_EVENTS.

CRs-fixed: 798906
Change-Id: I5c07785d516d2f64d9bd183d3b91b8cf069f43d5
Signed-off-by: default avatarKarthik Reddy Katta <a_katta@codeaurora.org>
parent 649e8188

drivers/soc/qcom/qdsp6v2/voice_svc.c

+8 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2014, The Linux Foundation. All rights reserved.

/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -103,6 +103,13 @@ static int32_t qdsp_apr_callback(struct apr_client_data *data, void *priv) 
		} else if (data->reset_proc == APR_DEST_MODEM) {

			pr_debug("%s: Received Modem reset event\n", __func__);

		}

		/* Set the remaining member variables to default values

			for RESET_EVENTS */

		data->payload_size = 0;

		data->payload = NULL;

		data->src_port = 0;

		data->dest_port = 0;

		data->token = 0;

	}



	spin_lock_irqsave(&prtd->response_lock, spin_flags);