Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9734b72a authored by Xiaojun Sang's avatar Xiaojun Sang
Browse files

ASoC: msm: qdsp6v2: set pointer to NULL after free 



Unsanitized pointer after kfree leads to potential risk.
Set pointer to NULL.

CRs-Fixed: 2008031
Change-Id: Ia59a57fcd142a6ed18d168992b8da4019314afa4
Signed-off-by: default avatarXiaojun Sang <xsang@codeaurora.org>
parent 49d57d9b

sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -1586,6 +1586,7 @@ static int msm_compr_playback_free(struct snd_compr_stream *cstream) 
	kfree(pdata->dec_params[soc_prtd->dai_link->be_id]);

	kfree(pdata->dec_params[soc_prtd->dai_link->be_id]);

	pdata->dec_params[soc_prtd->dai_link->be_id] = NULL;

	pdata->dec_params[soc_prtd->dai_link->be_id] = NULL;

	kfree(prtd);

	kfree(prtd);

	runtime->private_data = NULL;





	return 0;

	return 0;

}

}
@@ -1645,6 +1646,7 @@ static int msm_compr_capture_free(struct snd_compr_stream *cstream) 
	q6asm_audio_client_free(ac);

	q6asm_audio_client_free(ac);





	kfree(prtd);

	kfree(prtd);

	runtime->private_data = NULL;





	return 0;

	return 0;

}

}

sound/soc/msm/qdsp6v2/msm-pcm-afe-v2.c

+2 −1
Original line number Original line Diff line number Diff line 
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.

*

*

* This program is free software; you can redistribute it and/or modify

* This program is free software; you can redistribute it and/or modify

* it under the terms of the GNU General Public License version 2 and

* it under the terms of the GNU General Public License version 2 and
@@ -684,6 +684,7 @@ done: 
	mutex_unlock(&prtd->lock);

	mutex_unlock(&prtd->lock);

	prtd->prepared--;

	prtd->prepared--;

	kfree(prtd);

	kfree(prtd);

	runtime->private_data = NULL;

	return 0;

	return 0;

}

}

static int msm_afe_prepare(struct snd_pcm_substream *substream)

static int msm_afe_prepare(struct snd_pcm_substream *substream)

sound/soc/msm/qdsp6v2/msm-pcm-q6-noirq.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -570,6 +570,8 @@ static int msm_pcm_close(struct snd_pcm_substream *substream) 
					 SNDRV_PCM_STREAM_PLAYBACK :

					 SNDRV_PCM_STREAM_PLAYBACK :

					 SNDRV_PCM_STREAM_CAPTURE);

					 SNDRV_PCM_STREAM_CAPTURE);

	kfree(prtd);

	kfree(prtd);

	runtime->private_data = NULL;



	return 0;

	return 0;

}

}

sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -804,6 +804,8 @@ static int msm_pcm_playback_close(struct snd_pcm_substream *substream) 
	msm_pcm_routing_dereg_phy_stream(soc_prtd->dai_link->be_id,

	msm_pcm_routing_dereg_phy_stream(soc_prtd->dai_link->be_id,

						SNDRV_PCM_STREAM_PLAYBACK);

						SNDRV_PCM_STREAM_PLAYBACK);

	kfree(prtd);

	kfree(prtd);

	runtime->private_data = NULL;



	return 0;

	return 0;

}

}
@@ -909,6 +911,7 @@ static int msm_pcm_capture_close(struct snd_pcm_substream *substream) 
	msm_pcm_routing_dereg_phy_stream(soc_prtd->dai_link->be_id,

	msm_pcm_routing_dereg_phy_stream(soc_prtd->dai_link->be_id,

		SNDRV_PCM_STREAM_CAPTURE);

		SNDRV_PCM_STREAM_CAPTURE);

	kfree(prtd);

	kfree(prtd);

	runtime->private_data = NULL;





	return 0;

	return 0;

}

}