There were some places in intel_sst_mmap_play_capture() that
dereferenced user pointers instead of copying the data to the kernel.
I removed the BUG_ON(!mmap_buf) and BUG_ON(!buf_entry) since those are
never possible in the current code.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Cc: Vinod Koul <vinod.koul@intel.com>
Cc: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
int retval, i;
struct stream_info *stream;
struct snd_sst_mmap_buff_entry *buf_entry;
int retval, i;
struct stream_info *stream;
struct snd_sst_mmap_buff_entry *buf_entry;
+ struct snd_sst_mmap_buff_entry *tmp_buf;
pr_debug("sst:called for str_id %d\n", str_id);
retval = sst_validate_strid(str_id);
if (retval)
return -EINVAL;
pr_debug("sst:called for str_id %d\n", str_id);
retval = sst_validate_strid(str_id);
if (retval)
return -EINVAL;
stream = &sst_drv_ctx->streams[str_id];
if (stream->mmapped != true)
stream = &sst_drv_ctx->streams[str_id];
if (stream->mmapped != true)
stream->curr_bytes = 0;
stream->cumm_bytes = 0;
stream->curr_bytes = 0;
stream->cumm_bytes = 0;
+ tmp_buf = kcalloc(mmap_buf->entries, sizeof(*tmp_buf), GFP_KERNEL);
+ if (!tmp_buf)
+ return -ENOMEM;
+ if (copy_from_user(tmp_buf, (void __user *)mmap_buf->buff,
+ mmap_buf->entries * sizeof(*tmp_buf))) {
+ retval = -EFAULT;
+ goto out_free;
+ }
+
pr_debug("sst:new buffers count %d status %d\n",
mmap_buf->entries, stream->status);
pr_debug("sst:new buffers count %d status %d\n",
mmap_buf->entries, stream->status);
- buf_entry = mmap_buf->buff;
for (i = 0; i < mmap_buf->entries; i++) {
for (i = 0; i < mmap_buf->entries; i++) {
bufs = kzalloc(sizeof(*bufs), GFP_KERNEL);
bufs = kzalloc(sizeof(*bufs), GFP_KERNEL);
- if (!bufs)
- return -ENOMEM;
+ if (!bufs) {
+ retval = -ENOMEM;
+ goto out_free;
+ }
bufs->size = buf_entry->size;
bufs->offset = buf_entry->offset;
bufs->addr = sst_drv_ctx->mmap_mem;
bufs->size = buf_entry->size;
bufs->offset = buf_entry->offset;
bufs->addr = sst_drv_ctx->mmap_mem;
if (sst_play_frame(str_id) < 0) {
pr_warn("sst: play frames fail\n");
mutex_unlock(&stream->lock);
if (sst_play_frame(str_id) < 0) {
pr_warn("sst: play frames fail\n");
mutex_unlock(&stream->lock);
+ retval = -EIO;
+ goto out_free;
}
} else if (stream->ops == STREAM_OPS_CAPTURE) {
if (sst_capture_frame(str_id) < 0) {
pr_warn("sst: capture frame fail\n");
mutex_unlock(&stream->lock);
}
} else if (stream->ops == STREAM_OPS_CAPTURE) {
if (sst_capture_frame(str_id) < 0) {
pr_warn("sst: capture frame fail\n");
mutex_unlock(&stream->lock);
+ retval = -EIO;
+ goto out_free;
if (retval >= 0)
retval = stream->cumm_bytes;
pr_debug("sst:end of play/rec ioctl bytes = %d!!\n", retval);
if (retval >= 0)
retval = stream->cumm_bytes;
pr_debug("sst:end of play/rec ioctl bytes = %d!!\n", retval);
+
+out_free:
+ kfree(tmp_buf);