aboutsummaryrefslogtreecommitdiff
path: root/sound/pci/asihpi
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2017-10-09 14:11:30 +0200
committerTakashi Iwai <tiwai@suse.de>2017-10-09 14:11:30 +0200
commit545633f6fecd240bfa50bb8e2db627eac76f9f8a (patch)
tree7b68d3d5d49e352c5d1eaecd5e0958db89bda09a /sound/pci/asihpi
parent3a9fce327ff9cabf7f89d3f20616a83af28393da (diff)
parent5803b023881857db32ffefa0d269c90280a67ee0 (diff)
downloadlinux-stericsson-545633f6fecd240bfa50bb8e2db627eac76f9f8a.tar.gz
Merge branch 'for-linus' into for-next
Diffstat (limited to 'sound/pci/asihpi')
-rw-r--r--sound/pci/asihpi/hpioctl.c12
1 files changed, 8 insertions, 4 deletions
diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
index 7e3aa50b21f9..5badd08e1d69 100644
--- a/sound/pci/asihpi/hpioctl.c
+++ b/sound/pci/asihpi/hpioctl.c
@@ -103,6 +103,7 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
void __user *puhr;
union hpi_message_buffer_v1 *hm;
union hpi_response_buffer_v1 *hr;
+ u16 msg_size;
u16 res_max_size;
u32 uncopied_bytes;
int err = 0;
@@ -127,22 +128,25 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
}
/* Now read the message size and data from user space. */
- if (get_user(hm->h.size, (u16 __user *)puhm)) {
+ if (get_user(msg_size, (u16 __user *)puhm)) {
err = -EFAULT;
goto out;
}
- if (hm->h.size > sizeof(*hm))
- hm->h.size = sizeof(*hm);
+ if (msg_size > sizeof(*hm))
+ msg_size = sizeof(*hm);
/* printk(KERN_INFO "message size %d\n", hm->h.wSize); */
- uncopied_bytes = copy_from_user(hm, puhm, hm->h.size);
+ uncopied_bytes = copy_from_user(hm, puhm, msg_size);
if (uncopied_bytes) {
HPI_DEBUG_LOG(ERROR, "uncopied bytes %d\n", uncopied_bytes);
err = -EFAULT;
goto out;
}
+ /* Override h.size in case it is changed between two userspace fetches */
+ hm->h.size = msg_size;
+
if (get_user(res_max_size, (u16 __user *)puhr)) {
err = -EFAULT;
goto out;