- sound/{core,pci}/*.c

	- fix copy_{to,from}_user error handling (thanks to Rusty for pointing this out)
parent a252cfb4
......@@ -470,18 +470,16 @@ char *snd_kmalloc_strdup(const char *string, int flags)
int copy_to_user_fromio(void *dst, unsigned long src, size_t count)
{
#if defined(__i386_) || defined(CONFIG_SPARC32)
return copy_to_user(dst, (const void*) src, count);
return copy_to_user(dst, (const void*)src, count) ? -EFAULT : 0;
#else
char buf[1024];
while (count) {
size_t c = count;
int err;
if (c > sizeof(buf))
c = sizeof(buf);
memcpy_fromio(buf, src, c);
err = copy_to_user(dst, buf, c);
if (err)
return err;
if (copy_to_user(dst, buf, c))
return -EFAULT;
count -= c;
dst += c;
src += c;
......@@ -493,17 +491,15 @@ int copy_to_user_fromio(void *dst, unsigned long src, size_t count)
int copy_from_user_toio(unsigned long dst, const void *src, size_t count)
{
#if defined(__i386_) || defined(CONFIG_SPARC32)
return copy_from_user((void*)dst, src, count);
return copy_from_user((void*)dst, src, count) ? -EFAULT : 0;
#else
char buf[1024];
while (count) {
size_t c = count;
int err;
if (c > sizeof(buf))
c = sizeof(buf);
err = copy_from_user(buf, src, c);
if (err)
return err;
if (copy_from_user(buf, src, c))
return -EFAULT;
memcpy_toio(dst, buf, c);
count -= c;
dst += c;
......
......@@ -846,9 +846,13 @@ static int snd_cmipci_ac3_copy(snd_pcm_substream_t *subs, int channel,
snd_pcm_uframes_t offset;
snd_pcm_runtime_t *runtime = subs->runtime;
if (! cm->channel[CM_CH_PLAY].ac3_shift)
return copy_from_user(runtime->dma_area + frames_to_bytes(runtime, pos),
src, frames_to_bytes(runtime, count));
if (!cm->channel[CM_CH_PLAY].ac3_shift) {
if (copy_from_user(runtime->dma_area +
frames_to_bytes(runtime, pos), src,
frames_to_bytes(runtime, count)))
return -EFAULT;
return 0;
}
if (! access_ok(VERIFY_READ, src, count))
return -EFAULT;
......
......@@ -1455,9 +1455,7 @@ static int snd_korg1212_playback_copy(snd_pcm_substream_t *substream,
snd_assert(pos + count <= K1212_MAX_SAMPLES, return -EINVAL);
copy_from_user(dst, src, count * K1212_FRAME_SIZE);
return 0;
return copy_from_user(dst, src, count * K1212_FRAME_SIZE) : -EFAULT : 0;
}
static int snd_korg1212_capture_copy(snd_pcm_substream_t *substream,
......@@ -1475,9 +1473,7 @@ static int snd_korg1212_capture_copy(snd_pcm_substream_t *substream,
snd_assert(pos + count <= K1212_MAX_SAMPLES, return -EINVAL);
copy_to_user(dst, src, count * K1212_FRAME_SIZE);
return 0;
return copy_to_user(dst, src, count * K1212_FRAME_SIZE) ? -EFAULT : 0;
}
static int snd_korg1212_playback_silence(snd_pcm_substream_t *substream,
......
......@@ -2015,7 +2015,8 @@ static int snd_rme9652_playback_copy(snd_pcm_substream_t *substream, int channel
substream->pstr->stream,
channel);
snd_assert(channel_buf != NULL, return -EIO);
copy_from_user(channel_buf + pos * 4, src, count * 4);
if (copy_from_user(channel_buf + pos * 4, src, count * 4))
return -EFAULT;
return count;
}
......@@ -2031,7 +2032,8 @@ static int snd_rme9652_capture_copy(snd_pcm_substream_t *substream, int channel,
substream->pstr->stream,
channel);
snd_assert(channel_buf != NULL, return -EIO);
copy_to_user(dst, channel_buf + pos * 4, count * 4);
if (copy_to_user(dst, channel_buf + pos * 4, count * 4))
return -EFAULT;
return count;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment