Skip to content

Commit

Permalink
Merge branch 'topic/memdup_user' into for-linus
Browse files Browse the repository at this point in the history 
* topic/memdup_user:
  ALSA: sound/pci: use memdup_user()
  ALSA: sound/usb: use memdup_user()
  ALSA: sound/isa: use memdup_user()
  ALSA: sound/core: use memdup_user()
  • Loading branch information
@tiwai
tiwai committed Apr 15, 2009
2 parents 00610a8 + 336500f commit f4723b2
Show file tree
Hide file tree
Showing 11 changed files with 102 additions and 165 deletions.
35 changes: 13 additions & 22 deletions sound/core/control.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -723,14 +723,11 @@ static int snd_ctl_elem_read_user(struct snd_card *card,
{
struct snd_ctl_elem_value *control;
int result;

control = kmalloc(sizeof(*control), GFP_KERNEL);
if (control == NULL)
return -ENOMEM;
if (copy_from_user(control, _control, sizeof(*control))) {
kfree(control);
return -EFAULT;
}

control = memdup_user(_control, sizeof(*control));
if (IS_ERR(control))
return PTR_ERR(control);

snd_power_lock(card);
result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
if (result >= 0)
Expand Down Expand Up @@ -784,13 +781,10 @@ static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
struct snd_card *card;
int result;

control = kmalloc(sizeof(*control), GFP_KERNEL);
if (control == NULL)
return -ENOMEM;
if (copy_from_user(control, _control, sizeof(*control))) {
kfree(control);
return -EFAULT;
}
control = memdup_user(_control, sizeof(*control));
if (IS_ERR(control))
return PTR_ERR(control);

card = file->card;
snd_power_lock(card);
result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
Expand Down Expand Up @@ -916,13 +910,10 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol,
if (op_flag > 0) {
if (size > 1024 * 128) /* sane value */
return -EINVAL;
new_data = kmalloc(size, GFP_KERNEL);
if (new_data == NULL)
return -ENOMEM;
if (copy_from_user(new_data, tlv, size)) {
kfree(new_data);
return -EFAULT;
}

new_data = memdup_user(tlv, size);
if (IS_ERR(new_data))
return PTR_ERR(new_data);
change = ue->tlv_data_size != size;
if (!change)
change = memcmp(ue->tlv_data, new_data, size);
Expand Down
11 changes: 4 additions & 7 deletions sound/core/pcm_compat.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -232,14 +232,11 @@ static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream,
if (! (runtime = substream->runtime))
return -ENOTTY;

data = kmalloc(sizeof(*data), GFP_KERNEL);
if (data == NULL)
return -ENOMEM;
/* only fifo_size is different, so just copy all */
if (copy_from_user(data, data32, sizeof(*data32))) {
err = -EFAULT;
goto error;
}
data = memdup_user(data32, sizeof(*data32));
if (IS_ERR(data))
return PTR_ERR(data);

if (refine)
err = snd_pcm_hw_refine(substream, data);
else
Expand Down
93 changes: 35 additions & 58 deletions sound/core/pcm_native.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -327,21 +327,16 @@ static int snd_pcm_hw_refine_user(struct snd_pcm_substream *substream,
struct snd_pcm_hw_params *params;
int err;

params = kmalloc(sizeof(*params), GFP_KERNEL);
if (!params) {
err = -ENOMEM;
goto out;
}
if (copy_from_user(params, _params, sizeof(*params))) {
err = -EFAULT;
goto out;
}
params = memdup_user(_params, sizeof(*params));
if (IS_ERR(params))
return PTR_ERR(params);

err = snd_pcm_hw_refine(substream, params);
if (copy_to_user(_params, params, sizeof(*params))) {
if (!err)
err = -EFAULT;
}
out:

kfree(params);
return err;
}
Expand Down Expand Up @@ -465,21 +460,16 @@ static int snd_pcm_hw_params_user(struct snd_pcm_substream *substream,
struct snd_pcm_hw_params *params;
int err;

params = kmalloc(sizeof(*params), GFP_KERNEL);
if (!params) {
err = -ENOMEM;
goto out;
}
if (copy_from_user(params, _params, sizeof(*params))) {
err = -EFAULT;
goto out;
}
params = memdup_user(_params, sizeof(*params));
if (IS_ERR(params))
return PTR_ERR(params);

err = snd_pcm_hw_params(substream, params);
if (copy_to_user(_params, params, sizeof(*params))) {
if (!err)
err = -EFAULT;
}
out:

kfree(params);
return err;
}
Expand Down Expand Up @@ -2593,13 +2583,11 @@ static int snd_pcm_playback_ioctl1(struct file *file,
return -EFAULT;
if (copy_from_user(&xfern, _xfern, sizeof(xfern)))
return -EFAULT;
bufs = kmalloc(sizeof(void *) * runtime->channels, GFP_KERNEL);
if (bufs == NULL)
return -ENOMEM;
if (copy_from_user(bufs, xfern.bufs, sizeof(void *) * runtime->channels)) {
kfree(bufs);
return -EFAULT;
}

bufs = memdup_user(xfern.bufs,
sizeof(void *) * runtime->channels);
if (IS_ERR(bufs))
return PTR_ERR(bufs);
result = snd_pcm_lib_writev(substream, bufs, xfern.frames);
kfree(bufs);
__put_user(result, &_xfern->result);
Expand Down Expand Up @@ -2675,13 +2663,11 @@ static int snd_pcm_capture_ioctl1(struct file *file,
return -EFAULT;
if (copy_from_user(&xfern, _xfern, sizeof(xfern)))
return -EFAULT;
bufs = kmalloc(sizeof(void *) * runtime->channels, GFP_KERNEL);
if (bufs == NULL)
return -ENOMEM;
if (copy_from_user(bufs, xfern.bufs, sizeof(void *) * runtime->channels)) {
kfree(bufs);
return -EFAULT;
}

bufs = memdup_user(xfern.bufs,
sizeof(void *) * runtime->channels);
if (IS_ERR(bufs))
return PTR_ERR(bufs);
result = snd_pcm_lib_readv(substream, bufs, xfern.frames);
kfree(bufs);
__put_user(result, &_xfern->result);
Expand Down Expand Up @@ -3312,18 +3298,12 @@ static int snd_pcm_hw_refine_old_user(struct snd_pcm_substream *substream,
int err;

params = kmalloc(sizeof(*params), GFP_KERNEL);
if (!params) {
err = -ENOMEM;
goto out;
}
oparams = kmalloc(sizeof(*oparams), GFP_KERNEL);
if (!oparams) {
err = -ENOMEM;
goto out;
}
if (!params)
return -ENOMEM;

if (copy_from_user(oparams, _oparams, sizeof(*oparams))) {
err = -EFAULT;
oparams = memdup_user(_oparams, sizeof(*oparams));
if (IS_ERR(oparams)) {
err = PTR_ERR(oparams);
goto out;
}
snd_pcm_hw_convert_from_old_params(params, oparams);
Expand All @@ -3333,9 +3313,10 @@ static int snd_pcm_hw_refine_old_user(struct snd_pcm_substream *substream,
if (!err)
err = -EFAULT;
}

kfree(oparams);
out:
kfree(params);
kfree(oparams);
return err;
}

Expand All @@ -3347,17 +3328,12 @@ static int snd_pcm_hw_params_old_user(struct snd_pcm_substream *substream,
int err;

params = kmalloc(sizeof(*params), GFP_KERNEL);
if (!params) {
err = -ENOMEM;
goto out;
}
oparams = kmalloc(sizeof(*oparams), GFP_KERNEL);
if (!oparams) {
err = -ENOMEM;
goto out;
}
if (copy_from_user(oparams, _oparams, sizeof(*oparams))) {
err = -EFAULT;
if (!params)
return -ENOMEM;

oparams = memdup_user(_oparams, sizeof(*oparams));
if (IS_ERR(oparams)) {
err = PTR_ERR(oparams);
goto out;
}
snd_pcm_hw_convert_from_old_params(params, oparams);
Expand All @@ -3367,9 +3343,10 @@ static int snd_pcm_hw_params_old_user(struct snd_pcm_substream *substream,
if (!err)
err = -EFAULT;
}

kfree(oparams);
out:
kfree(params);
kfree(oparams);
return err;
}
#endif /* CONFIG_SND_SUPPORT_OLD_API */
Expand Down
9 changes: 4 additions & 5 deletions sound/core/seq/seq_compat.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,12 +48,11 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned
struct snd_seq_port_info *data;
mm_segment_t fs;

data = kmalloc(sizeof(*data), GFP_KERNEL);
if (! data)
return -ENOMEM;
data = memdup_user(data32, sizeof(*data32));
if (IS_ERR(data))
return PTR_ERR(data);

if (copy_from_user(data, data32, sizeof(*data32)) ||
get_user(data->flags, &data32->flags) ||
if (get_user(data->flags, &data32->flags) ||
get_user(data->time_queue, &data32->time_queue))
goto error;
data->kernel = NULL;
Expand Down
11 changes: 4 additions & 7 deletions sound/core/timer.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1395,13 +1395,10 @@ static int snd_timer_user_ginfo(struct file *file,
struct list_head *p;
int err = 0;

ginfo = kmalloc(sizeof(*ginfo), GFP_KERNEL);
if (! ginfo)
return -ENOMEM;
if (copy_from_user(ginfo, _ginfo, sizeof(*ginfo))) {
kfree(ginfo);
return -EFAULT;
}
ginfo = memdup_user(_ginfo, sizeof(*ginfo));
if (IS_ERR(ginfo))
return PTR_ERR(ginfo);

tid = ginfo->tid;
memset(ginfo, 0, sizeof(*ginfo));
ginfo->tid = tid;
Expand Down
19 changes: 10 additions & 9 deletions sound/isa/sb/sb16_csp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -684,15 +684,16 @@ static int snd_sb_csp_load(struct snd_sb_csp * p, const unsigned char *buf, int

static int snd_sb_csp_load_user(struct snd_sb_csp * p, const unsigned char __user *buf, int size, int load_flags)
{
int err = -ENOMEM;
unsigned char *kbuf = kmalloc(size, GFP_KERNEL);
if (kbuf) {
if (copy_from_user(kbuf, buf, size))
err = -EFAULT;
else
err = snd_sb_csp_load(p, kbuf, size, load_flags);
kfree(kbuf);
}
int err;
unsigned char *kbuf;

kbuf = memdup_user(buf, size);
if (IS_ERR(kbuf))
return PTR_ERR(kbuf);

err = snd_sb_csp_load(p, kbuf, size, load_flags);

kfree(kbuf);
return err;
}

Expand Down
14 changes: 5 additions & 9 deletions sound/isa/wavefront/wavefront_fx.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -202,15 +202,11 @@ snd_wavefront_fx_ioctl (struct snd_hwdep *sdev, struct file *file,
"> 512 bytes to FX\n");
return -EIO;
}
page_data = kmalloc(r.data[2] * sizeof(short), GFP_KERNEL);
if (!page_data)
return -ENOMEM;
if (copy_from_user (page_data,
(unsigned char __user *) r.data[3],
r.data[2] * sizeof(short))) {
kfree(page_data);
return -EFAULT;
}
page_data = memdup_user((unsigned char __user *)
r.data[3],
r.data[2] * sizeof(short));
if (IS_ERR(page_data))
return PTR_ERR(page_data);
pd = page_data;
}

Expand Down
11 changes: 5 additions & 6 deletions sound/isa/wavefront/wavefront_synth.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1664,12 +1664,11 @@ snd_wavefront_synth_ioctl (struct snd_hwdep *hw, struct file *file,
break;

case WFCTL_WFCMD:
wc = kmalloc(sizeof(*wc), GFP_KERNEL);
if (! wc)
return -ENOMEM;
if (copy_from_user (wc, argp, sizeof (*wc)))
err = -EFAULT;
else if (wavefront_synth_control (acard, wc) < 0)
wc = memdup_user(argp, sizeof(*wc));
if (IS_ERR(wc))
return PTR_ERR(wc);

if (wavefront_synth_control (acard, wc) < 0)
err = -EIO;
else if (copy_to_user (argp, wc, sizeof (*wc)))
err = -EFAULT;
Expand Down
Loading

0 comments on commit f4723b2

Please sign in to comment.