lkml.org 
[lkml]   [2013]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 049/110] ASoC: ab8500-codec: info leak in anc_status_control_put()
    Date
    3.10-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit d63733aed90b432e5cc489ddfa28e342f91b4652 upstream.

    If the user passes an invalid value it leads to an info leak when we
    print the error message or it could oops. This is called with user
    supplied data from snd_ctl_elem_write().

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Mark Brown <broonie@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/soc/codecs/ab8500-codec.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    --- a/sound/soc/codecs/ab8500-codec.c
    +++ b/sound/soc/codecs/ab8500-codec.c
    @@ -1225,13 +1225,18 @@ static int anc_status_control_put(struct
    struct ab8500_codec_drvdata *drvdata = dev_get_drvdata(codec->dev);
    struct device *dev = codec->dev;
    bool apply_fir, apply_iir;
    - int req, status;
    + unsigned int req;
    + int status;

    dev_dbg(dev, "%s: Enter.\n", __func__);

    mutex_lock(&drvdata->anc_lock);

    req = ucontrol->value.integer.value[0];
    + if (req >= ARRAY_SIZE(enum_anc_state)) {
    + status = -EINVAL;
    + goto cleanup;
    + }
    if (req != ANC_APPLY_FIR_IIR && req != ANC_APPLY_FIR &&
    req != ANC_APPLY_IIR) {
    dev_err(dev, "%s: ERROR: Unsupported status to set '%s'!\n",



    \
     
     \ /
      Last update: 2013-10-12 02:21    [W:2.731 / U:0.192 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site