aboutsummaryrefslogtreecommitdiffstats
path: root/sound/drivers
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2010-04-13 05:33:54 -0400
committerTakashi Iwai <tiwai@suse.de>2010-04-13 06:01:14 -0400
commitd97e1b78239c7e7e441088e0b644bd3b076002e6 (patch)
treeb05b5085bea932662ce60061d5b4b93834683327 /sound/drivers
parent24e4a1211f691fc671de44685430dbad757d8487 (diff)
ALSA: info - Check file position validity in common layer
Check the validity of the file position in the common info layer before calling read or write callbacks in assumption that entry->size is set up properly to indicate the max file size. Removed the redundant checks from the callbacks as well. Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/drivers')
-rw-r--r--sound/drivers/opl4/opl4_proc.c46
1 files changed, 16 insertions, 30 deletions
diff --git a/sound/drivers/opl4/opl4_proc.c b/sound/drivers/opl4/opl4_proc.c
index eb72814dfd5f..210b89de06d7 100644
--- a/sound/drivers/opl4/opl4_proc.c
+++ b/sound/drivers/opl4/opl4_proc.c
@@ -55,25 +55,18 @@ static ssize_t snd_opl4_mem_proc_read(struct snd_info_entry *entry,
55 size_t count, loff_t pos) 55 size_t count, loff_t pos)
56{ 56{
57 struct snd_opl4 *opl4 = entry->private_data; 57 struct snd_opl4 *opl4 = entry->private_data;
58 long size;
59 char* buf; 58 char* buf;
60 59
61 size = count; 60 buf = vmalloc(count);
62 if (pos + size > entry->size) 61 if (!buf)
63 size = entry->size - pos; 62 return -ENOMEM;
64 if (size > 0) { 63 snd_opl4_read_memory(opl4, buf, pos, count);
65 buf = vmalloc(size); 64 if (copy_to_user(_buf, buf, count)) {
66 if (!buf)
67 return -ENOMEM;
68 snd_opl4_read_memory(opl4, buf, pos, size);
69 if (copy_to_user(_buf, buf, size)) {
70 vfree(buf);
71 return -EFAULT;
72 }
73 vfree(buf); 65 vfree(buf);
74 return size; 66 return -EFAULT;
75 } 67 }
76 return 0; 68 vfree(buf);
69 return count;
77} 70}
78 71
79static ssize_t snd_opl4_mem_proc_write(struct snd_info_entry *entry, 72static ssize_t snd_opl4_mem_proc_write(struct snd_info_entry *entry,
@@ -83,25 +76,18 @@ static ssize_t snd_opl4_mem_proc_write(struct snd_info_entry *entry,
83 size_t count, size_t pos) 76 size_t count, size_t pos)
84{ 77{
85 struct snd_opl4 *opl4 = entry->private_data; 78 struct snd_opl4 *opl4 = entry->private_data;
86 long size;
87 char *buf; 79 char *buf;
88 80
89 size = count; 81 buf = vmalloc(count);
90 if (pos + size > entry->size) 82 if (!buf)
91 size = entry->size - pos; 83 return -ENOMEM;
92 if (size > 0) { 84 if (copy_from_user(buf, _buf, count)) {
93 buf = vmalloc(size);
94 if (!buf)
95 return -ENOMEM;
96 if (copy_from_user(buf, _buf, size)) {
97 vfree(buf);
98 return -EFAULT;
99 }
100 snd_opl4_write_memory(opl4, buf, pos, size);
101 vfree(buf); 85 vfree(buf);
102 return size; 86 return -EFAULT;
103 } 87 }
104 return 0; 88 snd_opl4_write_memory(opl4, buf, pos, count);
89 vfree(buf);
90 return count;
105} 91}
106 92
107static loff_t snd_opl4_mem_proc_llseek(struct snd_info_entry *entry, 93static loff_t snd_opl4_mem_proc_llseek(struct snd_info_entry *entry,