Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5eea0ca8 authored by Fred Oh's avatar Fred Oh
Browse files

ASoC: msm: qdsp6v2: make frame info to static array 



Frame info which track size of captured data and offset is dyanmically
allocated data. Some crashes are reported due to frame info is used after
free. Error type is null pointer dereference. Total size of frame info is
relatively small and it is part of msm_audio which is dynamically
allocated structure. No need to allocate and track it separately.

Change-Id: I393a935cb43454af7b208039bf39af7bfe7feb06
Signed-off-by: default avatarFred Oh <fred@codeaurora.org>
parent 3e5d75b2

sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c

+2 −17
Original line number Diff line number Diff line
@@ -55,14 +55,6 @@ struct snd_msm { 
	struct snd_pcm *pcm;

};



#define PLAYBACK_MIN_NUM_PERIODS    2

#define PLAYBACK_MAX_NUM_PERIODS    8

#define PLAYBACK_MAX_PERIOD_SIZE    12288

#define PLAYBACK_MIN_PERIOD_SIZE    128

#define CAPTURE_MIN_NUM_PERIODS     2

#define CAPTURE_MAX_NUM_PERIODS     8

#define CAPTURE_MAX_PERIOD_SIZE     16384

#define CAPTURE_MIN_PERIOD_SIZE     320

#define CMD_EOS_MIN_TIMEOUT_LENGTH  50

#define CMD_EOS_TIMEOUT_MULTIPLIER  (HZ * 50)
@@ -374,14 +366,9 @@ static int msm_pcm_capture_prepare(struct snd_pcm_substream *substream) 
		return -EINVAL;

	}



	pr_debug("%s\n", __func__);

	if (prtd->enabled == IDLE) {

		prtd->in_frame_info = kcalloc(runtime->periods,

					sizeof(struct msm_audio_in_frame_info),

					GFP_KERNEL);

		if (!prtd->in_frame_info)

			return -ENOMEM;



		pr_debug("%s:perf_mode=%d periods=%d\n", __func__,

			pdata->perf_mode, runtime->periods);

		params = &soc_prtd->dpcm[substream->stream].hw_params;

		if (params_format(params) == SNDRV_PCM_FORMAT_S24_LE)

			bits_per_sample = 24;
@@ -402,7 +389,6 @@ static int msm_pcm_capture_prepare(struct snd_pcm_substream *substream) 
			pr_err("%s: q6asm_open_read failed\n", __func__);

			q6asm_audio_client_free(prtd->audio_client);

			prtd->audio_client = NULL;

			kfree(prtd->in_frame_info);

			return -ENOMEM;

		}
@@ -797,7 +783,6 @@ static int msm_pcm_capture_close(struct snd_pcm_substream *substream) 


	pr_debug("%s\n", __func__);

	if (prtd->audio_client) {

		kfree(prtd->in_frame_info);

		q6asm_cmd(prtd->audio_client, CMD_CLOSE);

		q6asm_audio_client_buf_free_contiguous(dir,

				prtd->audio_client);

sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.h

+11 −1
Original line number Diff line number Diff line
@@ -57,6 +57,15 @@ struct msm_audio_in_frame_info { 
	uint32_t offset;

};



#define PLAYBACK_MIN_NUM_PERIODS    2

#define PLAYBACK_MAX_NUM_PERIODS    8

#define PLAYBACK_MAX_PERIOD_SIZE    12288

#define PLAYBACK_MIN_PERIOD_SIZE    128

#define CAPTURE_MIN_NUM_PERIODS     2

#define CAPTURE_MAX_NUM_PERIODS     8

#define CAPTURE_MAX_PERIOD_SIZE     16384

#define CAPTURE_MIN_PERIOD_SIZE     320



struct msm_audio {

	struct snd_pcm_substream *substream;

	unsigned int pcm_size;
@@ -100,7 +109,8 @@ struct msm_audio { 
	int cmd_interrupt;

	bool meta_data_mode;

	uint32_t volume;

	struct msm_audio_in_frame_info *in_frame_info; /* array of frame info */

	/* array of frame info */

	struct msm_audio_in_frame_info in_frame_info[CAPTURE_MAX_NUM_PERIODS];

};



struct output_meta_data_st {