Merge "ASoC: msm: qdsp6v2: Fix dangling pointer access" (1d7e4c52) · Commits · e / devices / android_kernel_xiaomi_markw

sound/soc/msm/qdsp6v2/q6asm.c

+11 −11

Original line number	Diff line number	Diff line
		@@ -2989,6 +2989,15 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac,
		int bytes_to_alloc, rc;
		size_t len;

		mutex_lock(&ac->cmd_lock);

		if (ac->port[dir].buf) {
		pr_err("%s: Buffer already allocated\n", __func__);
		rc = -EINVAL;
		mutex_unlock(&ac->cmd_lock);
		goto done;
		}

		buf_circ = kzalloc(sizeof(struct audio_buffer), GFP_KERNEL);

		if (!buf_circ) {
		@@ -2996,10 +3005,6 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac,
		goto done;
		}

		mutex_lock(&ac->cmd_lock);

		ac->port[dir].buf = buf_circ;

		bytes_to_alloc = bufsz * bufcnt;
		bytes_to_alloc = PAGE_ALIGN(bytes_to_alloc);

		@@ -3011,11 +3016,12 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac,
		if (rc) {
		pr_err("%s: Audio ION alloc is failed, rc = %d\n", __func__,
		rc);
		mutex_unlock(&ac->cmd_lock);
		kfree(buf_circ);
		mutex_unlock(&ac->cmd_lock);
		goto done;
		}

		ac->port[dir].buf = buf_circ;
		buf_circ->used = dir ^ 1;
		buf_circ->size = bytes_to_alloc;
		buf_circ->actual_size = bytes_to_alloc;
		@@ -3177,12 +3183,6 @@ int q6asm_open_shared_io(struct audio_client *ac,
		goto done;
		}

		if (ac->port[dir].buf) {
		pr_err("%s: Buffer already allocated\n", __func__);
		rc = -EINVAL;
		goto done;
		}

		rc = q6asm_set_shared_circ_buff(ac, open, bufsz, bufcnt, dir);

		if (rc)