From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Linus Torvalds <torvalds@linux-foundation.org>,
Takashi Iwai <tiwai@suse.de>
Subject: [PATCH 4.9 10/25] ALSA: wavefront: Proper check of get_user() error
Date: Mon, 23 May 2022 19:03:28 +0200 [thread overview]
Message-ID: <20220523165746.470112101@linuxfoundation.org> (raw)
In-Reply-To: <20220523165743.398280407@linuxfoundation.org>
From: Takashi Iwai <tiwai@suse.de>
commit a34ae6c0660d3b96b0055f68ef74dc9478852245 upstream.
The antient ISA wavefront driver reads its sample patch data (uploaded
over an ioctl) via __get_user() with no good reason; likely just for
some performance optimizations in the past. Let's change this to the
standard get_user() and the error check for handling the fault case
properly.
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220510103626.16635-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/isa/wavefront/wavefront_synth.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/sound/isa/wavefront/wavefront_synth.c
+++ b/sound/isa/wavefront/wavefront_synth.c
@@ -1091,7 +1091,8 @@ wavefront_send_sample (snd_wavefront_t *
if (dataptr < data_end) {
- __get_user (sample_short, dataptr);
+ if (get_user(sample_short, dataptr))
+ return -EFAULT;
dataptr += skip;
if (data_is_unsigned) { /* GUS ? */
next prev parent reply other threads:[~2022-05-23 17:05 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-23 17:03 [PATCH 4.9 00/25] 4.9.316-rc1 review Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 01/25] floppy: use a statically allocated error counter Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 02/25] um: Cleanup syscall_handler_t definition/cast, fix warning Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 03/25] Input: add bounds checking to input_set_capability() Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 04/25] MIPS: lantiq: check the return value of kzalloc() Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 05/25] drbd: remove usage of list iterator variable after loop Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 06/25] ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 07/25] mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 08/25] mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 09/25] mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch() Greg Kroah-Hartman
2022-05-23 17:03 ` Greg Kroah-Hartman [this message]
2022-05-23 17:03 ` [PATCH 4.9 11/25] perf: Fix sys_perf_event_open() race against self Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 12/25] drm/dp/mst: fix a possible memory leak in fetch_monitor_name() Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 13/25] net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 14/25] net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 15/25] net/qla3xxx: Fix a test in ql_reset_work() Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 16/25] NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 17/25] net: af_key: add check for pfkey_broadcast in function pfkey_process Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 18/25] ARM: 9196/1: spectre-bhb: enable for Cortex-A15 Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 19/25] ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 20/25] igb: skip phy status check where unavailable Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 21/25] perf bench numa: Address compiler error on s390 Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 22/25] scsi: qla2xxx: Fix missed DMA unmap for aborted commands Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 23/25] mac80211: fix rx reordering with non explicit / psmp ack policy Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 24/25] ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one() Greg Kroah-Hartman
2022-05-23 17:03 ` [PATCH 4.9 25/25] net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() Greg Kroah-Hartman
2022-05-23 17:43 ` [PATCH 4.9 00/25] 4.9.316-rc1 review Florian Fainelli
2022-05-23 22:58 ` Shuah Khan
2022-05-24 8:32 ` Jon Hunter
2022-05-24 12:09 ` Greg Kroah-Hartman
2022-05-24 14:55 ` Jon Hunter
2022-05-24 15:06 ` Greg Kroah-Hartman
2022-05-24 16:30 ` Florian Fainelli
2022-05-24 17:50 ` Jon Hunter
2022-05-24 18:42 ` Florian Fainelli
2022-05-25 9:05 ` Jon Hunter
2022-05-24 13:05 ` Naresh Kamboju
2022-05-24 15:27 ` Pavel Machek
2022-05-24 20:00 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220523165746.470112101@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.