Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2684ad75 authored by Ben Romberger's avatar Ben Romberger Committed by Gerrit - the friendly Code Review server
Browse files

hal: Fix adev_open error handling 

Change error handling in adev_open to correctly
set adev pointer to NULL after freeing memory and
destroy adev mutex before freeing adev memory. If
adev pointer is not set to NULL any calls made
into ahal will pass NULL checks and access freed
memory causing multiple issues such as segmentation
for locking a freed adev mutex.

Change-Id: I3cf35999d09418be3bb0c888d620eae18831a153
parent 3335dcd7

hal/audio_hw.c

+4 −2
Original line number Diff line number Diff line
@@ -7308,23 +7308,25 @@ static int adev_open(const hw_module_t *module, const char *name, 
    /* Loads platform specific libraries dynamically */

    adev->platform = platform_init(adev);

    if (!adev->platform) {

        pthread_mutex_destroy(&adev->lock);

        free(adev->snd_dev_ref_cnt);

        free(adev);

        adev = NULL;

        ALOGE("%s: Failed to init platform data, aborting.", __func__);

        *device = NULL;

        pthread_mutex_unlock(&adev_init_lock);

        pthread_mutex_destroy(&adev->lock);

        return -EINVAL;

    }



    if (audio_extn_qaf_is_enabled()) {

        ret = audio_extn_qaf_init(adev);

        if (ret < 0) {

            pthread_mutex_destroy(&adev->lock);

            free(adev);

            adev = NULL;

            ALOGE("%s: Failed to init platform data, aborting.", __func__);

            *device = NULL;

            pthread_mutex_unlock(&adev_init_lock);

            pthread_mutex_destroy(&adev->lock);

            return ret;

        }