dsp: fix NULL pointer exception in core driver
NULL pointer dereference occurs while getting version size
when version info memory allocation fails.
Add NULL check to avoid this NULL pointer exception.
CRs-Fixed: 2142971
Change-Id: I47a905a9b4e767d54b406a279626369f18a861d9
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
diff --git a/dsp/q6core.c b/dsp/q6core.c
index e7c41bb..c5b6409 100644
--- a/dsp/q6core.c
+++ b/dsp/q6core.c
@@ -108,8 +108,7 @@
*/
ver_size = sizeof(struct avcs_get_fwk_version) +
num_services * sizeof(struct avs_svc_api_info);
- if (q6core_lcl.q6core_avcs_ver_info.ver_info != NULL)
- pr_warn("%s: Version info is not NULL\n", __func__);
+
q6core_lcl.q6core_avcs_ver_info.ver_info =
kzalloc(ver_size, GFP_ATOMIC);
if (q6core_lcl.q6core_avcs_ver_info.ver_info == NULL)
@@ -236,7 +235,6 @@
pr_debug("%s: Received AVCS_CMDRSP_GET_FWK_VERSION\n",
__func__);
payload1 = data->payload;
- q6core_lcl.avcs_fwk_ver_resp_received = 1;
ret = parse_fwk_version_info(payload1);
if (ret < 0) {
q6core_lcl.adsp_status = ret;
@@ -246,6 +244,7 @@
q6core_lcl.q6core_avcs_ver_info.status =
VER_QUERY_SUPPORTED;
}
+ q6core_lcl.avcs_fwk_ver_resp_received = 1;
wake_up(&q6core_lcl.avcs_fwk_ver_req_wait);
break;
default:
@@ -445,8 +444,14 @@
if (ret)
goto done;
- num_services = q6core_lcl.q6core_avcs_ver_info.ver_info
- ->avcs_fwk_version.num_services;
+ if (q6core_lcl.q6core_avcs_ver_info.ver_info != NULL) {
+ num_services = q6core_lcl.q6core_avcs_ver_info.ver_info
+ ->avcs_fwk_version.num_services;
+ } else {
+ pr_err("%s: ver_info is NULL\n", __func__);
+ ret = -EINVAL;
+ goto done;
+ }
ret = sizeof(struct avcs_get_fwk_version);
if (service_id == AVCS_SERVICE_ID_ALL)