Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b0cc58a2 authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai
Browse files

ALSA: mixart: range checking proc file 



The original code doesn't take into consideration that the value of
MIXART_BA0_SIZE - pos can be less than zero which would lead to a large
unsigned value for "count".

Also I moved the check that read size is a multiple of 4 bytes below
the code that adjusts "count".

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Cc: <stable@kernel.org>
Acked-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent a0fd4345

sound/pci/mixart/mixart.c

+14 −10
Original line number Original line Diff line number Diff line
@@ -1161,12 +1161,14 @@ static long snd_mixart_BA0_read(struct snd_info_entry *entry, void *file_private 
				unsigned long count, unsigned long pos)

				unsigned long count, unsigned long pos)

{

{

	struct mixart_mgr *mgr = entry->private_data;

	struct mixart_mgr *mgr = entry->private_data;

	unsigned long maxsize;





	count = count & ~3; /* make sure the read size is a multiple of 4 bytes */

	if (pos >= MIXART_BA0_SIZE)

	if(count <= 0)

		return 0;

		return 0;

	if(pos + count > MIXART_BA0_SIZE)

	maxsize = MIXART_BA0_SIZE - pos;

		count = (long)(MIXART_BA0_SIZE - pos);

	if (count > maxsize)

		count = maxsize;

	count = count & ~3; /* make sure the read size is a multiple of 4 bytes */

	if (copy_to_user_fromio(buf, MIXART_MEM(mgr, pos), count))

	if (copy_to_user_fromio(buf, MIXART_MEM(mgr, pos), count))

		return -EFAULT;

		return -EFAULT;

	return count;

	return count;
@@ -1180,12 +1182,14 @@ static long snd_mixart_BA1_read(struct snd_info_entry *entry, void *file_private 
				unsigned long count, unsigned long pos)

				unsigned long count, unsigned long pos)

{

{

	struct mixart_mgr *mgr = entry->private_data;

	struct mixart_mgr *mgr = entry->private_data;

	unsigned long maxsize;





	count = count & ~3; /* make sure the read size is a multiple of 4 bytes */

	if (pos > MIXART_BA1_SIZE)

	if(count <= 0)

		return 0;

		return 0;

	if(pos + count > MIXART_BA1_SIZE)

	maxsize = MIXART_BA1_SIZE - pos;

		count = (long)(MIXART_BA1_SIZE - pos);

	if (count > maxsize)

		count = maxsize;

	count = count & ~3; /* make sure the read size is a multiple of 4 bytes */

	if (copy_to_user_fromio(buf, MIXART_REG(mgr, pos), count))

	if (copy_to_user_fromio(buf, MIXART_REG(mgr, pos), count))

		return -EFAULT;

		return -EFAULT;

	return count;

	return count;