diff options
Diffstat (limited to 'sound')
-rw-r--r-- | sound/isa/sb/sb16_csp.c | 19 | ||||
-rw-r--r-- | sound/isa/wavefront/wavefront_fx.c | 14 | ||||
-rw-r--r-- | sound/isa/wavefront/wavefront_synth.c | 11 |
3 files changed, 20 insertions, 24 deletions
diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c index 49037d074c71..bdc8dde4e4a2 100644 --- a/sound/isa/sb/sb16_csp.c +++ b/sound/isa/sb/sb16_csp.c | |||
@@ -684,15 +684,16 @@ static int snd_sb_csp_load(struct snd_sb_csp * p, const unsigned char *buf, int | |||
684 | 684 | ||
685 | static int snd_sb_csp_load_user(struct snd_sb_csp * p, const unsigned char __user *buf, int size, int load_flags) | 685 | static int snd_sb_csp_load_user(struct snd_sb_csp * p, const unsigned char __user *buf, int size, int load_flags) |
686 | { | 686 | { |
687 | int err = -ENOMEM; | 687 | int err; |
688 | unsigned char *kbuf = kmalloc(size, GFP_KERNEL); | 688 | unsigned char *kbuf; |
689 | if (kbuf) { | 689 | |
690 | if (copy_from_user(kbuf, buf, size)) | 690 | kbuf = memdup_user(buf, size); |
691 | err = -EFAULT; | 691 | if (IS_ERR(kbuf)) |
692 | else | 692 | return PTR_ERR(kbuf); |
693 | err = snd_sb_csp_load(p, kbuf, size, load_flags); | 693 | |
694 | kfree(kbuf); | 694 | err = snd_sb_csp_load(p, kbuf, size, load_flags); |
695 | } | 695 | |
696 | kfree(kbuf); | ||
696 | return err; | 697 | return err; |
697 | } | 698 | } |
698 | 699 | ||
diff --git a/sound/isa/wavefront/wavefront_fx.c b/sound/isa/wavefront/wavefront_fx.c index dfc449a2194e..5e6870baa296 100644 --- a/sound/isa/wavefront/wavefront_fx.c +++ b/sound/isa/wavefront/wavefront_fx.c | |||
@@ -210,15 +210,11 @@ snd_wavefront_fx_ioctl (struct snd_hwdep *sdev, struct file *file, | |||
210 | "> 512 bytes to FX\n"); | 210 | "> 512 bytes to FX\n"); |
211 | return -EIO; | 211 | return -EIO; |
212 | } | 212 | } |
213 | page_data = kmalloc(r.data[2] * sizeof(short), GFP_KERNEL); | 213 | page_data = memdup_user((unsigned char __user *) |
214 | if (!page_data) | 214 | r.data[3], |
215 | return -ENOMEM; | 215 | r.data[2] * sizeof(short)); |
216 | if (copy_from_user (page_data, | 216 | if (IS_ERR(page_data)) |
217 | (unsigned char __user *) r.data[3], | 217 | return PTR_ERR(page_data); |
218 | r.data[2] * sizeof(short))) { | ||
219 | kfree(page_data); | ||
220 | return -EFAULT; | ||
221 | } | ||
222 | pd = page_data; | 218 | pd = page_data; |
223 | } | 219 | } |
224 | 220 | ||
diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c index beb312cca75b..5d4ff48c4345 100644 --- a/sound/isa/wavefront/wavefront_synth.c +++ b/sound/isa/wavefront/wavefront_synth.c | |||
@@ -1664,12 +1664,11 @@ snd_wavefront_synth_ioctl (struct snd_hwdep *hw, struct file *file, | |||
1664 | break; | 1664 | break; |
1665 | 1665 | ||
1666 | case WFCTL_WFCMD: | 1666 | case WFCTL_WFCMD: |
1667 | wc = kmalloc(sizeof(*wc), GFP_KERNEL); | 1667 | wc = memdup_user(argp, sizeof(*wc)); |
1668 | if (! wc) | 1668 | if (IS_ERR(wc)) |
1669 | return -ENOMEM; | 1669 | return PTR_ERR(wc); |
1670 | if (copy_from_user (wc, argp, sizeof (*wc))) | 1670 | |
1671 | err = -EFAULT; | 1671 | if (wavefront_synth_control (acard, wc) < 0) |
1672 | else if (wavefront_synth_control (acard, wc) < 0) | ||
1673 | err = -EIO; | 1672 | err = -EIO; |
1674 | else if (copy_to_user (argp, wc, sizeof (*wc))) | 1673 | else if (copy_to_user (argp, wc, sizeof (*wc))) |
1675 | err = -EFAULT; | 1674 | err = -EFAULT; |