* [patch] ASoC: ab8500-codec: info leak in anc_status_control_put()
@ 2013-09-13 7:53 Dan Carpenter
2013-09-13 17:36 ` Mark Brown
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2013-09-13 7:53 UTC (permalink / raw)
To: Liam Girdwood
Cc: Mark Brown, Jaroslav Kysela, Takashi Iwai, Grant Likely,
Rob Herring, Fabio Baltieri, Lee Jones, Jiri Kosina, Ola Lilja,
alsa-devel, kernel-janitors
If the user passes an invalid value it leads to an info leak when we
print the error message or it could oops. This is called with user
supplied data from snd_ctl_elem_write().
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/sound/soc/codecs/ab8500-codec.c b/sound/soc/codecs/ab8500-codec.c
index b8ba0ad..80555d7 100644
--- a/sound/soc/codecs/ab8500-codec.c
+++ b/sound/soc/codecs/ab8500-codec.c
@@ -1225,13 +1225,18 @@ static int anc_status_control_put(struct snd_kcontrol *kcontrol,
struct ab8500_codec_drvdata *drvdata = dev_get_drvdata(codec->dev);
struct device *dev = codec->dev;
bool apply_fir, apply_iir;
- int req, status;
+ unsigned int req;
+ int status;
dev_dbg(dev, "%s: Enter.\n", __func__);
mutex_lock(&drvdata->anc_lock);
req = ucontrol->value.integer.value[0];
+ if (req >= ARRAY_SIZE(enum_anc_state)) {
+ status = -EINVAL;
+ goto cleanup;
+ }
if (req != ANC_APPLY_FIR_IIR && req != ANC_APPLY_FIR &&
req != ANC_APPLY_IIR) {
dev_err(dev, "%s: ERROR: Unsupported status to set '%s'!\n",
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [patch] ASoC: ab8500-codec: info leak in anc_status_control_put()
2013-09-13 7:53 [patch] ASoC: ab8500-codec: info leak in anc_status_control_put() Dan Carpenter
@ 2013-09-13 17:36 ` Mark Brown
0 siblings, 0 replies; 2+ messages in thread
From: Mark Brown @ 2013-09-13 17:36 UTC (permalink / raw)
To: Dan Carpenter
Cc: Liam Girdwood, Jaroslav Kysela, Takashi Iwai, Grant Likely,
Rob Herring, Fabio Baltieri, Lee Jones, Jiri Kosina, Ola Lilja,
alsa-devel, kernel-janitors
[-- Attachment #1: Type: text/plain, Size: 265 bytes --]
On Fri, Sep 13, 2013 at 10:53:36AM +0300, Dan Carpenter wrote:
> If the user passes an invalid value it leads to an info leak when we
> print the error message or it could oops. This is called with user
> supplied data from snd_ctl_elem_write().
Applied, thanks.
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-09-13 17:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-09-13 7:53 [patch] ASoC: ab8500-codec: info leak in anc_status_control_put() Dan Carpenter
2013-09-13 17:36 ` Mark Brown
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).