Messages in this thread Patch in this message | | | Date | Sun, 28 Nov 2004 22:35:23 +0100 (CET) | From | Jesper Juhl <> | Subject | [PATCH] sound/isa : check __copy_to_user in sscape_upload_bootblock() |
| |
__copy_to_user() is called without checking its return value in sound/isa/sscape.c::sscape_upload_bootblock .
Signed-off-by: Jesper Juhl <juhl-lkml@dif.dk>
diff -p -U 5 linux-2.6.10-rc2-bk11-orig/sound/isa/sscape.c linux-2.6.10-rc2-bk11/sound/isa/sscape.c --- linux-2.6.10-rc2-bk11-orig/sound/isa/sscape.c 2004-11-17 01:20:39.000000000 +0100 +++ linux-2.6.10-rc2-bk11/sound/isa/sscape.c 2004-11-28 22:24:14.000000000 +0100 @@ -570,11 +570,12 @@ static int sscape_upload_bootblock(struc if (ret == 0) { if (data < 0) { snd_printk(KERN_ERR "sscape: timeout reading firmware version\n"); ret = -EAGAIN; } else { - __copy_to_user(&bb->version, &data, sizeof(bb->version)); + if (__copy_to_user(&bb->version, &data, sizeof(bb->version))) + ret = -EFAULT; } } return ret; }
-- Jesper Juhl
PS. Please CC me on replies from alsa-devel
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |