diff options
Diffstat (limited to 'sound')
-rw-r--r-- | sound/pci/asihpi/hpioctl.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c index 311499992a22..62895a719fcb 100644 --- a/sound/pci/asihpi/hpioctl.c +++ b/sound/pci/asihpi/hpioctl.c | |||
@@ -121,11 +121,17 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg) | |||
121 | phpi_ioctl_data = (struct hpi_ioctl_linux __user *)arg; | 121 | phpi_ioctl_data = (struct hpi_ioctl_linux __user *)arg; |
122 | 122 | ||
123 | /* Read the message and response pointers from user space. */ | 123 | /* Read the message and response pointers from user space. */ |
124 | get_user(puhm, &phpi_ioctl_data->phm); | 124 | if (get_user(puhm, &phpi_ioctl_data->phm) || |
125 | get_user(puhr, &phpi_ioctl_data->phr); | 125 | get_user(puhr, &phpi_ioctl_data->phr)) { |
126 | err = -EFAULT; | ||
127 | goto out; | ||
128 | } | ||
126 | 129 | ||
127 | /* Now read the message size and data from user space. */ | 130 | /* Now read the message size and data from user space. */ |
128 | get_user(hm->h.size, (u16 __user *)puhm); | 131 | if (get_user(hm->h.size, (u16 __user *)puhm)) { |
132 | err = -EFAULT; | ||
133 | goto out; | ||
134 | } | ||
129 | if (hm->h.size > sizeof(*hm)) | 135 | if (hm->h.size > sizeof(*hm)) |
130 | hm->h.size = sizeof(*hm); | 136 | hm->h.size = sizeof(*hm); |
131 | 137 | ||
@@ -138,7 +144,10 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg) | |||
138 | goto out; | 144 | goto out; |
139 | } | 145 | } |
140 | 146 | ||
141 | get_user(res_max_size, (u16 __user *)puhr); | 147 | if (get_user(res_max_size, (u16 __user *)puhr)) { |
148 | err = -EFAULT; | ||
149 | goto out; | ||
150 | } | ||
142 | /* printk(KERN_INFO "user response size %d\n", res_max_size); */ | 151 | /* printk(KERN_INFO "user response size %d\n", res_max_size); */ |
143 | if (res_max_size < sizeof(struct hpi_response_header)) { | 152 | if (res_max_size < sizeof(struct hpi_response_header)) { |
144 | HPI_DEBUG_LOG(WARNING, "small res size %d\n", res_max_size); | 153 | HPI_DEBUG_LOG(WARNING, "small res size %d\n", res_max_size); |