diff options
author | Takashi Iwai <tiwai@suse.de> | 2022-05-10 12:36:26 +0200 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-05-25 09:10:37 +0200 |
commit | 5a76a35f999d0936fcfa658b8f09df4508e0543b (patch) | |
tree | 2e0d03f887f1f586d4d330abdc29773024e00c32 /sound/isa/wavefront | |
parent | e9758b6e27e8063424769ded36899c8d98c962c1 (diff) | |
download | linux-stable-5a76a35f999d0936fcfa658b8f09df4508e0543b.tar.gz linux-stable-5a76a35f999d0936fcfa658b8f09df4508e0543b.tar.bz2 linux-stable-5a76a35f999d0936fcfa658b8f09df4508e0543b.zip |
ALSA: wavefront: Proper check of get_user() error
commit a34ae6c0660d3b96b0055f68ef74dc9478852245 upstream.
The antient ISA wavefront driver reads its sample patch data (uploaded
over an ioctl) via __get_user() with no good reason; likely just for
some performance optimizations in the past. Let's change this to the
standard get_user() and the error check for handling the fault case
properly.
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220510103626.16635-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'sound/isa/wavefront')
-rw-r--r-- | sound/isa/wavefront/wavefront_synth.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c index 13c8e6542a2f..9dd0ae377980 100644 --- a/sound/isa/wavefront/wavefront_synth.c +++ b/sound/isa/wavefront/wavefront_synth.c @@ -1092,7 +1092,8 @@ wavefront_send_sample (snd_wavefront_t *dev, if (dataptr < data_end) { - __get_user (sample_short, dataptr); + if (get_user(sample_short, dataptr)) + return -EFAULT; dataptr += skip; if (data_is_unsigned) { /* GUS ? */ |