Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0aed2b7e authored by Vidyakumar Athota's avatar Vidyakumar Athota
Browse files

ASoC: msm-lsm-client: free lsm client data in msm_lsm_close 



Currently lsm client data is deallocated when q6lsm_open() fails
which can cause memory corruption if lsm client data is accessed
after freed. Fix this issue by deallocating the client data only
in msm_lsm_close().

Change-Id: If048c26a0ffd8a346a28622183cbf2ba1e7e5ff3
Signed-off-by: default avatarVidyakumar Athota <vathota@codeaurora.org>
parent d70d0441

include/sound/q6lsm.h

+1 −0
Original line number Diff line number Diff line
@@ -71,6 +71,7 @@ struct lsm_client { 
	uint16_t	connect_to_port;

	uint8_t		num_confidence_levels;

	uint8_t		*confidence_levels;

	bool		opened;

	bool		started;

	dma_addr_t	lsm_cal_phy_addr;

	uint32_t	lsm_cal_size;

sound/soc/msm/qdsp6v2/msm-lsm-client.c

+7 −3
Original line number Diff line number Diff line
@@ -746,10 +746,9 @@ static int msm_lsm_ioctl_shared(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: lsm open failed, %d\n",

				__func__, ret);

			q6lsm_client_free(prtd->lsm_client);

			kfree(prtd);

			return ret;

		}

		prtd->lsm_client->opened = true;

		dev_dbg(rtd->dev, "%s: Session_ID = %d, APP ID = %d\n",

			__func__,

			prtd->lsm_client->session,
@@ -1690,6 +1689,7 @@ static int msm_lsm_open(struct snd_pcm_substream *substream) 
		runtime->private_data = NULL;

		return -ENOMEM;

	}

	prtd->lsm_client->opened = false;

	return 0;

}
@@ -1762,7 +1762,10 @@ static int msm_lsm_close(struct snd_pcm_substream *substream) 
				 __func__);

	}



	if (prtd->lsm_client->opened) {

		q6lsm_close(prtd->lsm_client);

		prtd->lsm_client->opened = false;

	}

	q6lsm_client_free(prtd->lsm_client);



	spin_lock_irqsave(&prtd->event_lock, flags);
@@ -1770,6 +1773,7 @@ static int msm_lsm_close(struct snd_pcm_substream *substream) 
	prtd->event_status = NULL;

	spin_unlock_irqrestore(&prtd->event_lock, flags);

	kfree(prtd);

	runtime->private_data = NULL;



	return 0;

}