- sound/{core,pci}/*.c

	- fix copy_{to,from}_user error handling (thanks to Rusty for pointing this out)
parent a252cfb4
...@@ -470,18 +470,16 @@ char *snd_kmalloc_strdup(const char *string, int flags) ...@@ -470,18 +470,16 @@ char *snd_kmalloc_strdup(const char *string, int flags)
int copy_to_user_fromio(void *dst, unsigned long src, size_t count) int copy_to_user_fromio(void *dst, unsigned long src, size_t count)
{ {
#if defined(__i386_) || defined(CONFIG_SPARC32) #if defined(__i386_) || defined(CONFIG_SPARC32)
return copy_to_user(dst, (const void*) src, count); return copy_to_user(dst, (const void*)src, count) ? -EFAULT : 0;
#else #else
char buf[1024]; char buf[1024];
while (count) { while (count) {
size_t c = count; size_t c = count;
int err;
if (c > sizeof(buf)) if (c > sizeof(buf))
c = sizeof(buf); c = sizeof(buf);
memcpy_fromio(buf, src, c); memcpy_fromio(buf, src, c);
err = copy_to_user(dst, buf, c); if (copy_to_user(dst, buf, c))
if (err) return -EFAULT;
return err;
count -= c; count -= c;
dst += c; dst += c;
src += c; src += c;
...@@ -493,17 +491,15 @@ int copy_to_user_fromio(void *dst, unsigned long src, size_t count) ...@@ -493,17 +491,15 @@ int copy_to_user_fromio(void *dst, unsigned long src, size_t count)
int copy_from_user_toio(unsigned long dst, const void *src, size_t count) int copy_from_user_toio(unsigned long dst, const void *src, size_t count)
{ {
#if defined(__i386_) || defined(CONFIG_SPARC32) #if defined(__i386_) || defined(CONFIG_SPARC32)
return copy_from_user((void*)dst, src, count); return copy_from_user((void*)dst, src, count) ? -EFAULT : 0;
#else #else
char buf[1024]; char buf[1024];
while (count) { while (count) {
size_t c = count; size_t c = count;
int err;
if (c > sizeof(buf)) if (c > sizeof(buf))
c = sizeof(buf); c = sizeof(buf);
err = copy_from_user(buf, src, c); if (copy_from_user(buf, src, c))
if (err) return -EFAULT;
return err;
memcpy_toio(dst, buf, c); memcpy_toio(dst, buf, c);
count -= c; count -= c;
dst += c; dst += c;
......
...@@ -846,9 +846,13 @@ static int snd_cmipci_ac3_copy(snd_pcm_substream_t *subs, int channel, ...@@ -846,9 +846,13 @@ static int snd_cmipci_ac3_copy(snd_pcm_substream_t *subs, int channel,
snd_pcm_uframes_t offset; snd_pcm_uframes_t offset;
snd_pcm_runtime_t *runtime = subs->runtime; snd_pcm_runtime_t *runtime = subs->runtime;
if (! cm->channel[CM_CH_PLAY].ac3_shift) if (!cm->channel[CM_CH_PLAY].ac3_shift) {
return copy_from_user(runtime->dma_area + frames_to_bytes(runtime, pos), if (copy_from_user(runtime->dma_area +
src, frames_to_bytes(runtime, count)); frames_to_bytes(runtime, pos), src,
frames_to_bytes(runtime, count)))
return -EFAULT;
return 0;
}
if (! access_ok(VERIFY_READ, src, count)) if (! access_ok(VERIFY_READ, src, count))
return -EFAULT; return -EFAULT;
......
...@@ -1455,9 +1455,7 @@ static int snd_korg1212_playback_copy(snd_pcm_substream_t *substream, ...@@ -1455,9 +1455,7 @@ static int snd_korg1212_playback_copy(snd_pcm_substream_t *substream,
snd_assert(pos + count <= K1212_MAX_SAMPLES, return -EINVAL); snd_assert(pos + count <= K1212_MAX_SAMPLES, return -EINVAL);
copy_from_user(dst, src, count * K1212_FRAME_SIZE); return copy_from_user(dst, src, count * K1212_FRAME_SIZE) : -EFAULT : 0;
return 0;
} }
static int snd_korg1212_capture_copy(snd_pcm_substream_t *substream, static int snd_korg1212_capture_copy(snd_pcm_substream_t *substream,
...@@ -1475,9 +1473,7 @@ static int snd_korg1212_capture_copy(snd_pcm_substream_t *substream, ...@@ -1475,9 +1473,7 @@ static int snd_korg1212_capture_copy(snd_pcm_substream_t *substream,
snd_assert(pos + count <= K1212_MAX_SAMPLES, return -EINVAL); snd_assert(pos + count <= K1212_MAX_SAMPLES, return -EINVAL);
copy_to_user(dst, src, count * K1212_FRAME_SIZE); return copy_to_user(dst, src, count * K1212_FRAME_SIZE) ? -EFAULT : 0;
return 0;
} }
static int snd_korg1212_playback_silence(snd_pcm_substream_t *substream, static int snd_korg1212_playback_silence(snd_pcm_substream_t *substream,
......
...@@ -2015,7 +2015,8 @@ static int snd_rme9652_playback_copy(snd_pcm_substream_t *substream, int channel ...@@ -2015,7 +2015,8 @@ static int snd_rme9652_playback_copy(snd_pcm_substream_t *substream, int channel
substream->pstr->stream, substream->pstr->stream,
channel); channel);
snd_assert(channel_buf != NULL, return -EIO); snd_assert(channel_buf != NULL, return -EIO);
copy_from_user(channel_buf + pos * 4, src, count * 4); if (copy_from_user(channel_buf + pos * 4, src, count * 4))
return -EFAULT;
return count; return count;
} }
...@@ -2031,7 +2032,8 @@ static int snd_rme9652_capture_copy(snd_pcm_substream_t *substream, int channel, ...@@ -2031,7 +2032,8 @@ static int snd_rme9652_capture_copy(snd_pcm_substream_t *substream, int channel,
substream->pstr->stream, substream->pstr->stream,
channel); channel);
snd_assert(channel_buf != NULL, return -EIO); snd_assert(channel_buf != NULL, return -EIO);
copy_to_user(dst, channel_buf + pos * 4, count * 4); if (copy_to_user(dst, channel_buf + pos * 4, count * 4))
return -EFAULT;
return count; return count;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment