* [PATCH] sound/isa : check __copy_to_user in sscape_upload_bootblock()
@ 2004-11-28 21:35 ` Jesper Juhl
0 siblings, 0 replies; 4+ messages in thread
From: Jesper Juhl @ 2004-11-28 21:35 UTC (permalink / raw)
To: alsa-devel; +Cc: linux-kernel
__copy_to_user() is called without checking its return value in
sound/isa/sscape.c::sscape_upload_bootblock .
Signed-off-by: Jesper Juhl <juhl-lkml@dif.dk>
diff -p -U 5 linux-2.6.10-rc2-bk11-orig/sound/isa/sscape.c linux-2.6.10-rc2-bk11/sound/isa/sscape.c
--- linux-2.6.10-rc2-bk11-orig/sound/isa/sscape.c 2004-11-17 01:20:39.000000000 +0100
+++ linux-2.6.10-rc2-bk11/sound/isa/sscape.c 2004-11-28 22:24:14.000000000 +0100
@@ -570,11 +570,12 @@ static int sscape_upload_bootblock(struc
if (ret == 0) {
if (data < 0) {
snd_printk(KERN_ERR "sscape: timeout reading firmware version\n");
ret = -EAGAIN;
} else {
- __copy_to_user(&bb->version, &data, sizeof(bb->version));
+ if (__copy_to_user(&bb->version, &data, sizeof(bb->version)))
+ ret = -EFAULT;
}
}
return ret;
}
--
Jesper Juhl
PS. Please CC me on replies from alsa-devel
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH] sound/isa : check __copy_to_user in sscape_upload_bootblock()
@ 2004-11-28 21:35 ` Jesper Juhl
0 siblings, 0 replies; 4+ messages in thread
From: Jesper Juhl @ 2004-11-28 21:35 UTC (permalink / raw)
To: alsa-devel; +Cc: linux-kernel
__copy_to_user() is called without checking its return value in
sound/isa/sscape.c::sscape_upload_bootblock .
Signed-off-by: Jesper Juhl <juhl-lkml@dif.dk>
diff -p -U 5 linux-2.6.10-rc2-bk11-orig/sound/isa/sscape.c linux-2.6.10-rc2-bk11/sound/isa/sscape.c
--- linux-2.6.10-rc2-bk11-orig/sound/isa/sscape.c 2004-11-17 01:20:39.000000000 +0100
+++ linux-2.6.10-rc2-bk11/sound/isa/sscape.c 2004-11-28 22:24:14.000000000 +0100
@@ -570,11 +570,12 @@ static int sscape_upload_bootblock(struc
if (ret == 0) {
if (data < 0) {
snd_printk(KERN_ERR "sscape: timeout reading firmware version\n");
ret = -EAGAIN;
} else {
- __copy_to_user(&bb->version, &data, sizeof(bb->version));
+ if (__copy_to_user(&bb->version, &data, sizeof(bb->version)))
+ ret = -EFAULT;
}
}
return ret;
}
--
Jesper Juhl
PS. Please CC me on replies from alsa-devel
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] sound/isa : check __copy_to_user in sscape_upload_bootblock()
2004-11-28 21:35 ` Jesper Juhl
@ 2004-11-30 14:38 ` Takashi Iwai
-1 siblings, 0 replies; 4+ messages in thread
From: Takashi Iwai @ 2004-11-30 14:38 UTC (permalink / raw)
To: Jesper Juhl; +Cc: alsa-devel, linux-kernel
At Sun, 28 Nov 2004 22:35:23 +0100 (CET),
Jesper Juhl wrote:
>
>
> __copy_to_user() is called without checking its return value in
> sound/isa/sscape.c::sscape_upload_bootblock .
>
> Signed-off-by: Jesper Juhl <juhl-lkml@dif.dk>
Thanks, applied to ALSA tree now.
Takashi
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2004-11-30 14:38 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-11-28 21:35 [PATCH] sound/isa : check __copy_to_user in sscape_upload_bootblock() Jesper Juhl
2004-11-28 21:35 ` Jesper Juhl
2004-11-30 14:38 ` Takashi Iwai
2004-11-30 14:38 ` Takashi Iwai
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.