* [PATCH] ALSA: emux: stop if copy_from_user() fails
@ 2017-03-31 13:53 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2017-03-31 13:53 UTC (permalink / raw)
To: Jaroslav Kysela; +Cc: alsa-devel, kernel-janitors, Takashi Iwai
If we can't fill the "patch" struct because "count" is too small (it can
be as low as 4 bytes) or because copy_from_user() failed, then just
return instead of using unintialized data.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
index ac75816ada7c..850fab4a8f3b 100644
--- a/sound/synth/emux/emux_oss.c
+++ b/sound/synth/emux/emux_oss.c
@@ -225,9 +225,9 @@ snd_emux_load_patch_seq_oss(struct snd_seq_oss_arg *arg, int format,
else if (format = SNDRV_OSS_SOUNDFONT_PATCH) {
struct soundfont_patch_info patch;
if (count < (int)sizeof(patch))
- rc = -EINVAL;
+ return -EINVAL;
if (copy_from_user(&patch, buf, sizeof(patch)))
- rc = -EFAULT;
+ return -EFAULT;
if (patch.type >= SNDRV_SFNT_LOAD_INFO &&
patch.type <= SNDRV_SFNT_PROBE_DATA)
rc = snd_soundfont_load(emu->sflist, buf, count, SF_CLIENT_NO(p->chset.port));
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH] ALSA: emux: stop if copy_from_user() fails
@ 2017-03-31 13:53 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2017-03-31 13:53 UTC (permalink / raw)
To: Jaroslav Kysela; +Cc: alsa-devel, kernel-janitors, Takashi Iwai
If we can't fill the "patch" struct because "count" is too small (it can
be as low as 4 bytes) or because copy_from_user() failed, then just
return instead of using unintialized data.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
index ac75816ada7c..850fab4a8f3b 100644
--- a/sound/synth/emux/emux_oss.c
+++ b/sound/synth/emux/emux_oss.c
@@ -225,9 +225,9 @@ snd_emux_load_patch_seq_oss(struct snd_seq_oss_arg *arg, int format,
else if (format == SNDRV_OSS_SOUNDFONT_PATCH) {
struct soundfont_patch_info patch;
if (count < (int)sizeof(patch))
- rc = -EINVAL;
+ return -EINVAL;
if (copy_from_user(&patch, buf, sizeof(patch)))
- rc = -EFAULT;
+ return -EFAULT;
if (patch.type >= SNDRV_SFNT_LOAD_INFO &&
patch.type <= SNDRV_SFNT_PROBE_DATA)
rc = snd_soundfont_load(emu->sflist, buf, count, SF_CLIENT_NO(p->chset.port));
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] ALSA: emux: stop if copy_from_user() fails
2017-03-31 13:53 ` Dan Carpenter
@ 2017-03-31 14:24 ` Takashi Iwai
-1 siblings, 0 replies; 4+ messages in thread
From: Takashi Iwai @ 2017-03-31 14:24 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Jaroslav Kysela, alsa-devel, kernel-janitors
On Fri, 31 Mar 2017 15:53:40 +0200,
Dan Carpenter wrote:
>
> If we can't fill the "patch" struct because "count" is too small (it can
> be as low as 4 bytes) or because copy_from_user() failed, then just
> return instead of using unintialized data.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Thanks, applied now.
Takashi
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] ALSA: emux: stop if copy_from_user() fails
@ 2017-03-31 14:24 ` Takashi Iwai
0 siblings, 0 replies; 4+ messages in thread
From: Takashi Iwai @ 2017-03-31 14:24 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Jaroslav Kysela, alsa-devel, kernel-janitors
On Fri, 31 Mar 2017 15:53:40 +0200,
Dan Carpenter wrote:
>
> If we can't fill the "patch" struct because "count" is too small (it can
> be as low as 4 bytes) or because copy_from_user() failed, then just
> return instead of using unintialized data.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Thanks, applied now.
Takashi
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-03-31 14:24 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-03-31 13:53 [PATCH] ALSA: emux: stop if copy_from_user() fails Dan Carpenter
2017-03-31 13:53 ` Dan Carpenter
2017-03-31 14:24 ` Takashi Iwai
2017-03-31 14:24 ` Takashi Iwai
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.