tequilaOS/platform_device_motorola_sm6225-common
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

sm6225-common: amplifier: Add amplifier usecase to head of usecase list

Browse source 
When a call is received, if the ringtone is played through the speaker,
the audio HAL will freeze and restart when the call is answered,
leading to a few seconds of silence at the beginning of the call. This
happens because of a NULL pointer dereference, which is in turn caused
by a UAF in the check_usecases_codec_backend() function, in the audio
HAL.

The UAF occurs because the amplifier HAL appends its usecase at the
wrong end of the usecases list - tail instead of head. When the second
list_for_each() loop in the aforementioned function iterates through
the list, it first finds the regular low-latency-playback usecase,
and calls disable_snd_device() for the speaker output device. This
causes the amplifier HAL to execute aw882xx_stop_feedback(), which
frees its usecase in the list, but the internal pointer of the
list_for_each() macro already points to it, thus the following
iteration effectively operates on a free'd object.

To fix this issue, have the amplifier HAL append its usecase to the
head of the list: this way, it will be iterated on before the
low-latency-playback usecase, i.e. before it gets free'd.

Change-Id: Ia8dcb11b3ed320836a6602798ff5c390e7afa9d2
This commit is contained in:
Tommaso Fonda 2023-11-21 15:58:46 +01:00 committed by Michael Bestas
parent 8378a099fa
commit c00c013f19
No known key found for this signature in database
GPG key ID: CC95044519BE6669
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
audio_amplifier/audio_amplifier.c
View file

@ -92,7 +92,7 @@ int aw882xx_start_feedback(void* adev, uint32_t snd_device) {
aw_dev->usecase_tx->in_snd_device = SND_DEVICE_IN_CAPTURE_VI_FEEDBACK; aw_dev->usecase_tx->in_snd_device = SND_DEVICE_IN_CAPTURE_VI_FEEDBACK;
list_init(&aw_dev->usecase_tx->device_list); list_init(&aw_dev->usecase_tx->device_list);
list_add_tail(&aw_dev->adev->usecase_list, &aw_dev->usecase_tx->list); list_add_head(&aw_dev->adev->usecase_list, &aw_dev->usecase_tx->list);
enable_snd_device(aw_dev->adev, aw_dev->usecase_tx->in_snd_device); enable_snd_device(aw_dev->adev, aw_dev->usecase_tx->in_snd_device);
enable_audio_route(aw_dev->adev, aw_dev->usecase_tx); enable_audio_route(aw_dev->adev, aw_dev->usecase_tx);