lkml.org 
[lkml]   [2016]   [Feb]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.16.y-ckt 128/180] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode
    Date
    3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Nicolas Boichat <drinkcat@chromium.org>

    commit 9586495dc3011a80602329094e746dbce16cb1f1 upstream.

    This reverts one hunk of
    commit ef44a1ec6eee ("ALSA: sound/core: use memdup_user()"), which
    replaced a number of kmalloc followed by memcpy with memdup calls.

    In this case, we are copying from a struct snd_seq_port_info32 to a
    struct snd_seq_port_info, but the latter is 4 bytes longer than the
    32-bit version, so we need to separate kmalloc and copy calls.

    Fixes: ef44a1ec6eee ('ALSA: sound/core: use memdup_user()')
    Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    ---
    sound/core/seq/seq_compat.c | 9 +++++----
    1 file changed, 5 insertions(+), 4 deletions(-)

    diff --git a/sound/core/seq/seq_compat.c b/sound/core/seq/seq_compat.c
    index 81f7c109dc46..65175902a68a 100644
    --- a/sound/core/seq/seq_compat.c
    +++ b/sound/core/seq/seq_compat.c
    @@ -49,11 +49,12 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned
    struct snd_seq_port_info *data;
    mm_segment_t fs;

    - data = memdup_user(data32, sizeof(*data32));
    - if (IS_ERR(data))
    - return PTR_ERR(data);
    + data = kmalloc(sizeof(*data), GFP_KERNEL);
    + if (!data)
    + return -ENOMEM;

    - if (get_user(data->flags, &data32->flags) ||
    + if (copy_from_user(data, data32, sizeof(*data32)) ||
    + get_user(data->flags, &data32->flags) ||
    get_user(data->time_queue, &data32->time_queue))
    goto error;
    data->kernel = NULL;
    \
     
     \ /
      Last update: 2016-02-04 00:41    [W:2.345 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site