diff options
| author | Soumya Managoli <quic_c_smanag@quicinc.com> | 2023-07-20 14:40:44 +0530 |
|---|---|---|
| committer | Siluxsept <ronny.horn.rh@gmail.com> | 2024-02-03 22:41:52 +0100 |
| commit | e8e3bc07b811de6e5930a06171e73190a1adad4c (patch) | |
| tree | 94bd8c5a7fc6b8ceb3a8d226f4a9f7ed20373cea | |
| parent | c1854c5c9484f427f84d1b38cb381d890d86f4bc (diff) | |
dsp: q6lsm: Address use after free for mmap handlet13.0
The global declared mmap_handle can be left dangling
for case when the handle is freed by the calling function.
Fix is to address this. Also add a check to make sure
the mmap_handle is accessed legally.
Change-Id: I367f8a41339aa0025b545b125ee820220efedeee
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
| -rw-r--r-- | techpack/audio/dsp/q6lsm.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/techpack/audio/dsp/q6lsm.c b/techpack/audio/dsp/q6lsm.c index 9c153b11f838..18725df543ae 100644 --- a/techpack/audio/dsp/q6lsm.c +++ b/techpack/audio/dsp/q6lsm.c @@ -392,6 +392,10 @@ static int q6lsm_apr_send_pkt(struct lsm_client *client, void *handle, } pr_debug("%s: enter wait %d\n", __func__, wait); + if (mmap_handle_p) { + pr_debug("%s: Invalid mmap_handle\n", __func__); + return -EINVAL; + } if (wait) mutex_lock(&lsm_common.apr_lock); if (mmap_p) { @@ -435,6 +439,7 @@ static int q6lsm_apr_send_pkt(struct lsm_client *client, void *handle, if (wait) mutex_unlock(&lsm_common.apr_lock); + mmap_handle_p = NULL; pr_debug("%s: leave ret %d\n", __func__, ret); return ret; } @@ -1392,7 +1397,8 @@ static int q6lsm_mmapcallback(struct apr_client_data *data, void *priv) case LSM_SESSION_CMDRSP_SHARED_MEM_MAP_REGIONS: if (atomic_read(&client->cmd_state) == CMD_STATE_WAIT_RESP) { spin_lock_irqsave(&mmap_lock, flags); - *mmap_handle_p = command; + if (mmap_handle_p) + *mmap_handle_p = command; /* spin_unlock_irqrestore implies barrier */ spin_unlock_irqrestore(&mmap_lock, flags); atomic_set(&client->cmd_state, CMD_STATE_CLEARED); |