Re: [PATCH 6/6] DSPBRIDGE: Use _IOxx macro to define ioctls

Nishanth Menon
2010-01-11T20:11:32Z

Ramirez Luna, Omar had written, on 01/11/2010 02:12 PM, the following:
[...]

> diff --git a/drivers/dsp/bridge/pmgr/wcd.c b/drivers/dsp/bridge/pmgr/wcd.c
> index 02def74..f52b7b8 100644
> --- a/drivers/dsp/bridge/pmgr/wcd.c
> +++ b/drivers/dsp/bridge/pmgr/wcd.c
[...]

>
> static inline void __cp_fm_usr(void *to, const void __user *from,
> @@ -273,13 +286,48 @@ static inline void __cp_to_usr(void __user *to, const void *from,
> inline DSP_STATUS WCD_CallDevIOCtl(u32 cmd, union Trapped_Args *args,
> u32 *result, void *pr_ctxt)
> {
> - if (cmd < ARRAY_SIZE(WCD_cmdTable)) {
> - /* make the fxn call via the cmd table */
> - *result = (*WCD_cmdTable[cmd].fxn) (args, pr_ctxt);
> - return DSP_SOK;
> + u32(*ioctl_cmd)(union Trapped_Args *args, void *pr_ctxt);
> + int i;
> +
> + if (_IOC_TYPE(cmd) != DB) {
> + pr_err("%s: Incompatible dspbridge ioctl number\n", __func__);
> + goto err;
> }
>
> - return DSP_EINVALIDARG;
> + /* Retrieve the fxn via the cmd table */
> + i = cmd & DB_IOC_MASK;
> + switch (cmd & DB_MODULE_MASK) {
> + case DB_MGR:
> + ioctl_cmd = mgr_cmd[i].fxn;
just realized we have a risk here. if i > sizeof(mgr_cmd), then we will
not catch the out of range error.
[...]
--
Regards,
Nishanth Menon