* [PATCH] sound/isa : check __copy_to_user in sscape_upload_bootblock()
@ 2004-11-28 21:35 Jesper Juhl
2004-11-30 14:38 ` Takashi Iwai
0 siblings, 1 reply; 2+ messages in thread
From: Jesper Juhl @ 2004-11-28 21:35 UTC (permalink / raw)
To: alsa-devel; +Cc: linux-kernel
__copy_to_user() is called without checking its return value in
sound/isa/sscape.c::sscape_upload_bootblock .
Signed-off-by: Jesper Juhl <juhl-lkml@dif.dk>
diff -p -U 5 linux-2.6.10-rc2-bk11-orig/sound/isa/sscape.c linux-2.6.10-rc2-bk11/sound/isa/sscape.c
--- linux-2.6.10-rc2-bk11-orig/sound/isa/sscape.c 2004-11-17 01:20:39.000000000 +0100
+++ linux-2.6.10-rc2-bk11/sound/isa/sscape.c 2004-11-28 22:24:14.000000000 +0100
@@ -570,11 +570,12 @@ static int sscape_upload_bootblock(struc
if (ret == 0) {
if (data < 0) {
snd_printk(KERN_ERR "sscape: timeout reading firmware version\n");
ret = -EAGAIN;
} else {
- __copy_to_user(&bb->version, &data, sizeof(bb->version));
+ if (__copy_to_user(&bb->version, &data, sizeof(bb->version)))
+ ret = -EFAULT;
}
}
return ret;
}
--
Jesper Juhl
PS. Please CC me on replies from alsa-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] sound/isa : check __copy_to_user in sscape_upload_bootblock()
2004-11-28 21:35 [PATCH] sound/isa : check __copy_to_user in sscape_upload_bootblock() Jesper Juhl
@ 2004-11-30 14:38 ` Takashi Iwai
0 siblings, 0 replies; 2+ messages in thread
From: Takashi Iwai @ 2004-11-30 14:38 UTC (permalink / raw)
To: Jesper Juhl; +Cc: alsa-devel, linux-kernel
At Sun, 28 Nov 2004 22:35:23 +0100 (CET),
Jesper Juhl wrote:
>
>
> __copy_to_user() is called without checking its return value in
> sound/isa/sscape.c::sscape_upload_bootblock .
>
> Signed-off-by: Jesper Juhl <juhl-lkml@dif.dk>
Thanks, applied to ALSA tree now.
Takashi
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2004-11-30 14:38 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2004-11-28 21:35 [PATCH] sound/isa : check __copy_to_user in sscape_upload_bootblock() Jesper Juhl
2004-11-30 14:38 ` Takashi Iwai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).