evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "ASoC: msm: qdsp6v2: Fix dangling pointer access"

Browse source
This commit is contained in:
Linux Build Service Account 2017-09-22 09:13:41 -07:00 • committed by Gerrit - the friendly Code Review server
commit ba64f1b64f
1 changed files with 11 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
sound/soc/msm/qdsp6v2/q6asm.c
View file

@ -3368,6 +3368,15 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac,
int bytes_to_alloc, rc;
size_t len;
mutex_lock(&ac->cmd_lock);
if (ac->port[dir].buf) {
pr_err("%s: Buffer already allocated\n", __func__);
rc = -EINVAL;
mutex_unlock(&ac->cmd_lock);
goto done;
}
buf_circ = kzalloc(sizeof(struct audio_buffer), GFP_KERNEL);
if (!buf_circ) {
@ -3375,10 +3384,6 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac,
goto done;
}
mutex_lock(&ac->cmd_lock);
ac->port[dir].buf = buf_circ;
bytes_to_alloc = bufsz * bufcnt;
bytes_to_alloc = PAGE_ALIGN(bytes_to_alloc);
@ -3390,11 +3395,12 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac,
if (rc) {
pr_err("%s: Audio ION alloc is failed, rc = %d\n", __func__,
rc);
mutex_unlock(&ac->cmd_lock);
kfree(buf_circ);
mutex_unlock(&ac->cmd_lock);
goto done;
}
ac->port[dir].buf = buf_circ;
buf_circ->used = dir ^ 1;
buf_circ->size = bytes_to_alloc;
buf_circ->actual_size = bytes_to_alloc;
@ -3559,12 +3565,6 @@ int q6asm_open_shared_io(struct audio_client *ac,
goto done;
}
if (ac->port[dir].buf) {
pr_err("%s: Buffer already allocated\n", __func__);
rc = -EINVAL;
goto done;
}
rc = q6asm_set_shared_circ_buff(ac, open, bufsz, bufcnt, dir);
if (rc)