Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8e10ffee authored by Yeleswarapu Nagaradhesh's avatar Yeleswarapu Nagaradhesh Committed by Gerrit - the friendly Code Review server
Browse files

ASoC: msm: acquire lock in ioctl 



If two ioctls are triggered with different commands,
there is a possibility to access freed confidence level
memory. To resolve this acquire lock in ioctl.
Also release mutex lock properly in error cases.

CRs-Fixed: 1103085
Change-Id: I7d6b2eff21c8297e5f0755a0c141254be32f777d
Signed-off-by: default avatarYeleswarapu Nagaradhesh <nagaradh@codeaurora.org>
parent edc93d8c

sound/soc/msm/msm-cpe-lsm.c

+41 −20
Original line number Diff line number Diff line
@@ -2162,7 +2162,8 @@ static int msm_cpe_lsm_ioctl(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: not supported if using topology\n",

				__func__, "LSM_REG_SND_MODEL_V2");

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		if (copy_from_user(&snd_model, (void *)arg,
@@ -2295,7 +2296,8 @@ static int msm_cpe_lsm_ioctl(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: not supported if using topology\n",

				__func__, "SNDRV_LSM_SET_PARAMS");

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		if (copy_from_user(&det_params, (void *) arg,
@@ -2322,14 +2324,16 @@ static int msm_cpe_lsm_ioctl(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: not supported if not using topology\n",

				__func__, "SET_MODULE_PARAMS");

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		if (!arg) {

			dev_err(rtd->dev,

				"%s: %s: No Param data to set\n",

				__func__, "SET_MODULE_PARAMS");

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		if (copy_from_user(&p_data, arg,
@@ -2337,7 +2341,8 @@ static int msm_cpe_lsm_ioctl(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: copy_from_user failed, size = %zd\n",

				__func__, "p_data", sizeof(p_data));

			return -EFAULT;

			err = -EFAULT;

			goto done;

		}



		if (p_data.num_params > LSM_PARAMS_MAX) {
@@ -2345,7 +2350,8 @@ static int msm_cpe_lsm_ioctl(struct snd_pcm_substream *substream, 
				"%s: %s: Invalid num_params %d\n",

				__func__, "SET_MODULE_PARAMS",

				p_data.num_params);

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		p_size = p_data.num_params *
@@ -2356,12 +2362,15 @@ static int msm_cpe_lsm_ioctl(struct snd_pcm_substream *substream, 
				"%s: %s: Invalid size %zd\n",

				__func__, "SET_MODULE_PARAMS", p_size);



			return -EFAULT;

			err = -EFAULT;

			goto done;

		}



		params = kzalloc(p_size, GFP_KERNEL);

		if (!params)

			return -ENOMEM;

		if (!params) {

			err = -ENOMEM;

			goto done;

		}



		if (copy_from_user(params, p_data.params,

				   p_data.data_size)) {
@@ -2369,7 +2378,8 @@ static int msm_cpe_lsm_ioctl(struct snd_pcm_substream *substream, 
				"%s: %s: copy_from_user failed, size = %d\n",

				__func__, "params", p_data.data_size);

			kfree(params);

			return -EFAULT;

			err = -EFAULT;

			goto done;

		}



		err = msm_cpe_lsm_process_params(substream, &p_data, params);
@@ -2480,7 +2490,8 @@ static int msm_cpe_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: not supported if using topology\n",

				__func__, "LSM_REG_SND_MODEL_V2_32");

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		dev_dbg(rtd->dev,
@@ -2700,7 +2711,9 @@ static int msm_cpe_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: not supported if using topology\n",

				__func__, "SNDRV_LSM_SET_PARAMS32");

			return -EINVAL;



			err = -EINVAL;

			goto done;

		}



		if (copy_from_user(&det_params32, arg,
@@ -2744,7 +2757,8 @@ static int msm_cpe_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: not supported if not using topology\n",

				__func__, "SET_MODULE_PARAMS_32");

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		if (copy_from_user(&p_data_32, arg,
@@ -2753,7 +2767,8 @@ static int msm_cpe_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
				"%s: %s: copy_from_user failed, size = %zd\n",

				__func__, "SET_MODULE_PARAMS_32",

				sizeof(p_data_32));

			return -EFAULT;

			err = -EFAULT;

			goto done;

		}



		p_data.params = compat_ptr(p_data_32.params);
@@ -2765,7 +2780,8 @@ static int msm_cpe_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
				"%s: %s: Invalid num_params %d\n",

				__func__, "SET_MODULE_PARAMS_32",

				p_data.num_params);

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		if (p_data.data_size !=
@@ -2774,21 +2790,25 @@ static int msm_cpe_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
				"%s: %s: Invalid size %d\n",

				__func__, "SET_MODULE_PARAMS_32",

				p_data.data_size);

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		p_size = sizeof(struct lsm_params_info_32) *

			 p_data.num_params;



		params32 = kzalloc(p_size, GFP_KERNEL);

		if (!params32)

			return -ENOMEM;

		if (!params32) {

			err = -ENOMEM;

			goto done;

		}



		p_size = sizeof(struct lsm_params_info) * p_data.num_params;

		params = kzalloc(p_size, GFP_KERNEL);

		if (!params) {

			kfree(params32);

			return -ENOMEM;

			err = -ENOMEM;

			goto done;

		}



		if (copy_from_user(params32, p_data.params,
@@ -2798,7 +2818,8 @@ static int msm_cpe_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
				__func__, "params32", p_data.data_size);

			kfree(params32);

			kfree(params);

			return -EFAULT;

			err = -EFAULT;

			goto done;

		}



		p_info_32 = (struct lsm_params_info_32 *) params32;

sound/soc/msm/qdsp6v2/msm-lsm-client.c

+66 −25
Original line number Diff line number Diff line
@@ -92,6 +92,7 @@ struct lsm_priv { 
	atomic_t buf_count;

	atomic_t read_abort;

	wait_queue_head_t period_wait;

	struct mutex lsm_api_lock;

	int appl_cnt;

	int dma_write;

};
@@ -980,10 +981,18 @@ static int msm_lsm_ioctl_shared(struct snd_pcm_substream *substream, 


		dev_dbg(rtd->dev, "%s: Get event status\n", __func__);

		atomic_set(&prtd->event_wait_stop, 0);



		/*

		 * Release the api lock before wait to allow

		 * other IOCTLs to be invoked while waiting

		 * for event

		 */

		mutex_unlock(&prtd->lsm_api_lock);

		rc = wait_event_freezable(prtd->event_wait,

				(cmpxchg(&prtd->event_avail, 1, 0) ||

				 (xchg = atomic_cmpxchg(&prtd->event_wait_stop,

							1, 0))));

		mutex_lock(&prtd->lsm_api_lock);

		dev_dbg(rtd->dev, "%s: wait_event_freezable %d event_wait_stop %d\n",

			 __func__, rc, xchg);

		if (!rc && !xchg) {
@@ -1302,6 +1311,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
	rtd = substream->private_data;

	prtd = runtime->private_data;



	mutex_lock(&prtd->lsm_api_lock);



	switch (cmd) {

	case SNDRV_LSM_EVENT_STATUS: {

		struct snd_lsm_event_status *user = NULL, userarg32;
@@ -1309,7 +1320,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
		if (copy_from_user(&userarg32, arg, sizeof(userarg32))) {

			dev_err(rtd->dev, "%s: err copyuser ioctl %s\n",

				__func__, "SNDRV_LSM_EVENT_STATUS");

			return -EFAULT;

			err = -EFAULT;

			goto done;

		}



		if (userarg32.payload_size >
@@ -1317,7 +1329,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
			pr_err("%s: payload_size %d is invalid, max allowed = %d\n",

				__func__, userarg32.payload_size,

				LISTEN_MAX_STATUS_PAYLOAD_SIZE);

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		size = sizeof(*user) + userarg32.payload_size;
@@ -1326,7 +1339,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: Allocation failed event status size %d\n",

				__func__, size);

			return -EFAULT;

			err = -EFAULT;

			goto done;

		} else {

			cmd = SNDRV_LSM_EVENT_STATUS;

			user->payload_size = userarg32.payload_size;
@@ -1442,7 +1456,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: not supported if using topology\n",

				__func__, "REG_SND_MODEL_V2");

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		if (copy_from_user(&snd_modelv232, arg,
@@ -1483,7 +1498,7 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: not supported if using topology\n",

				__func__, "SET_PARAMS_32");

			return -EINVAL;

			err = -EINVAL;

		}



		if (copy_from_user(&det_params32, arg,
@@ -1527,7 +1542,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: not supported if not using topology\n",

				__func__, "SET_MODULE_PARAMS_32");

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		if (copy_from_user(&p_data_32, arg,
@@ -1536,7 +1552,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
				"%s: %s: copy_from_user failed, size = %zd\n",

				__func__, "SET_MODULE_PARAMS_32",

				sizeof(p_data_32));

			return -EFAULT;

			err = -EFAULT;

			goto done;

		}



		p_data.params = compat_ptr(p_data_32.params);
@@ -1548,7 +1565,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
				"%s: %s: Invalid num_params %d\n",

				__func__, "SET_MODULE_PARAMS_32",

				p_data.num_params);

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		if (p_data.data_size !=
@@ -1557,7 +1575,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
				"%s: %s: Invalid size %d\n",

				__func__, "SET_MODULE_PARAMS_32",

				p_data.data_size);

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		p_size = sizeof(struct lsm_params_info_32) *
@@ -1568,7 +1587,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: no memory for params32, size = %zd\n",

				__func__, p_size);

			return -ENOMEM;

			err = -ENOMEM;

			goto done;

		}



		p_size = sizeof(struct lsm_params_info) * p_data.num_params;
@@ -1578,7 +1598,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
				"%s: no memory for params, size = %zd\n",

				__func__, p_size);

			kfree(params32);

			return -ENOMEM;

			err = -ENOMEM;

			goto done;

		}



		if (copy_from_user(params32, p_data.params,
@@ -1588,7 +1609,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
				__func__, "params32", p_data.data_size);

			kfree(params32);

			kfree(params);

			return -EFAULT;

			err = -EFAULT;

			goto done;

		}



		p_info_32 = (struct lsm_params_info_32 *) params32;
@@ -1631,6 +1653,8 @@ static int msm_lsm_ioctl_compat(struct snd_pcm_substream *substream, 
		err = msm_lsm_ioctl_shared(substream, cmd, arg);

		break;

	}

done:

	mutex_unlock(&prtd->lsm_api_lock);

	return err;

}

#else
@@ -1655,6 +1679,7 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
	prtd = runtime->private_data;

	rtd = substream->private_data;



	mutex_lock(&prtd->lsm_api_lock);

	switch (cmd) {

	case SNDRV_LSM_REG_SND_MODEL_V2: {

		struct snd_lsm_sound_model_v2 snd_model_v2;
@@ -1663,7 +1688,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: not supported if using topology\n",

				__func__, "REG_SND_MODEL_V2");

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		if (copy_from_user(&snd_model_v2, arg, sizeof(snd_model_v2))) {
@@ -1690,7 +1716,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: not supported if using topology\n",

				__func__, "SET_PARAMS");

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		pr_debug("%s: SNDRV_LSM_SET_PARAMS\n", __func__);
@@ -1711,7 +1738,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: LSM_SET_PARAMS failed, err %d\n",

				__func__, err);

		return err;



		goto done;

	}



	case SNDRV_LSM_SET_MODULE_PARAMS: {
@@ -1723,7 +1751,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: not supported if not using topology\n",

				__func__, "SET_MODULE_PARAMS");

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		if (copy_from_user(&p_data, arg,
@@ -1731,7 +1760,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: %s: copy_from_user failed, size = %zd\n",

				__func__, "p_data", sizeof(p_data));

			return -EFAULT;

			err = -EFAULT;

			goto done;

		}



		if (p_data.num_params > LSM_PARAMS_MAX) {
@@ -1739,7 +1769,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
				"%s: %s: Invalid num_params %d\n",

				__func__, "SET_MODULE_PARAMS",

				p_data.num_params);

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		p_size = p_data.num_params *
@@ -1750,7 +1781,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
				"%s: %s: Invalid size %zd\n",

				__func__, "SET_MODULE_PARAMS", p_size);



			return -EFAULT;

			err = -EFAULT;

			goto done;

		}



		params = kzalloc(p_size, GFP_KERNEL);
@@ -1758,7 +1790,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: no memory for params\n",

				__func__);

			return -ENOMEM;

			err = -ENOMEM;

			goto done;

		}



		if (copy_from_user(params, p_data.params,
@@ -1767,7 +1800,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
				"%s: %s: copy_from_user failed, size = %d\n",

				__func__, "params", p_data.data_size);

			kfree(params);

			return -EFAULT;

			err = -EFAULT;

			goto done;

		}



		err = msm_lsm_process_params(substream, &p_data, params);
@@ -1787,7 +1821,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: err copyuser event_status\n",

				__func__);

			return -EFAULT;

			err = -EFAULT;

			goto done;

		}



		if (userarg.payload_size >
@@ -1795,7 +1830,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
			pr_err("%s: payload_size %d is invalid, max allowed = %d\n",

				__func__, userarg.payload_size,

				LISTEN_MAX_STATUS_PAYLOAD_SIZE);

			return -EINVAL;

			err = -EINVAL;

			goto done;

		}



		size = sizeof(struct snd_lsm_event_status) +
@@ -1805,7 +1841,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
			dev_err(rtd->dev,

				"%s: Allocation failed event status size %d\n",

				__func__, size);

			return -EFAULT;

			err = -EFAULT;

			goto done;

		} else {

			user->payload_size = userarg.payload_size;

			err = msm_lsm_ioctl_shared(substream, cmd, user);
@@ -1828,7 +1865,7 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
		if (err)

			dev_err(rtd->dev,

				"%s: lsmevent failed %d", __func__, err);

		return err;

		goto done;

	}



	case SNDRV_LSM_EVENT_STATUS_V3: {
@@ -1894,6 +1931,8 @@ static int msm_lsm_ioctl(struct snd_pcm_substream *substream, 
		err = msm_lsm_ioctl_shared(substream, cmd, arg);

	break;

	}

done:

	mutex_unlock(&prtd->lsm_api_lock);

	return err;

}
@@ -1910,6 +1949,7 @@ static int msm_lsm_open(struct snd_pcm_substream *substream) 
		       __func__);

		return -ENOMEM;

	}

	mutex_init(&prtd->lsm_api_lock);

	spin_lock_init(&prtd->event_lock);

	init_waitqueue_head(&prtd->event_wait);

	init_waitqueue_head(&prtd->period_wait);
@@ -2069,6 +2109,7 @@ static int msm_lsm_close(struct snd_pcm_substream *substream) 
	kfree(prtd->event_status);

	prtd->event_status = NULL;

	spin_unlock_irqrestore(&prtd->event_lock, flags);

	mutex_destroy(&prtd->lsm_api_lock);

	kfree(prtd);

	runtime->private_data = NULL;