Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e9f25689 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Staging: sst: fixups in SNDRV_SST_STREAM_DECODE 



This is another patch about copying data to the kernel before using it.

SNDRV_SST_STREAM_DECODE is sort of tricky because we need to do a
copy_from_user() that gives us another two pointers and we have copy
those.  Those again give us some more pointers that we have to copy.

Besides those problems, the code had a stack overflow:
-	struct snd_sst_buff_entry ibuf_temp[param->ibufs->entries],
-		obuf_temp[param->obufs->entries];
param->ibufs->entries comes from the user.

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Acked-by: default avatarVinod Koul <vinod.koul@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent bc704e31

drivers/staging/intel_sst/intel_sst_app_interface.c

+57 −36
Original line number Diff line number Diff line
@@ -1105,62 +1105,83 @@ long intel_sst_ioctl(struct file *file_ptr, unsigned int cmd, unsigned long arg) 
	}



	case _IOC_NR(SNDRV_SST_STREAM_DECODE): {

		struct snd_sst_dbufs *param =

				(struct snd_sst_dbufs *)arg, dbufs_local;

		int i;

		struct snd_sst_dbufs param;

		struct snd_sst_dbufs dbufs_local;

		struct snd_sst_buffs ibufs, obufs;

		struct snd_sst_buff_entry ibuf_temp[param->ibufs->entries],

				obuf_temp[param->obufs->entries];

		struct snd_sst_buff_entry *ibuf_tmp, *obuf_tmp;

		char __user *dest;



		pr_debug("sst: SNDRV_SST_STREAM_DECODE recived\n");

		if (minor != STREAM_MODULE) {

			retval = -EBADRQC;

			break;

		}

		if (!param) {

			retval = -EINVAL;

		if (copy_from_user(&param, (void __user *)arg,

				sizeof(param))) {

			retval = -EFAULT;

			break;

		}



		dbufs_local.input_bytes_consumed = param->input_bytes_consumed;

		dbufs_local.input_bytes_consumed = param.input_bytes_consumed;

		dbufs_local.output_bytes_produced =

					param->output_bytes_produced;

					param.output_bytes_produced;



		if (copy_from_user(&ibufs, param.ibufs, sizeof(ibufs))) {

			retval = -EFAULT;

			break;

		}

		if (copy_from_user(&obufs, param.obufs, sizeof(obufs))) {

			retval = -EFAULT;

			break;

		}



		ibuf_tmp = kcalloc(ibufs.entries, sizeof(*ibuf_tmp), GFP_KERNEL);

		obuf_tmp = kcalloc(obufs.entries, sizeof(*obuf_tmp), GFP_KERNEL);

		if (!ibuf_tmp || !obuf_tmp) {

			retval = -ENOMEM;

			goto free_iobufs;

		}



		if (copy_from_user(ibuf_tmp, ibufs.buff_entry,

				ibufs.entries * sizeof(*ibuf_tmp))) {

			retval = -EFAULT;

			goto free_iobufs;

		}

		ibufs.buff_entry = ibuf_tmp;

		dbufs_local.ibufs = &ibufs;

		dbufs_local.obufs = &obufs;

		dbufs_local.ibufs->entries = param->ibufs->entries;

		dbufs_local.ibufs->type = param->ibufs->type;

		dbufs_local.obufs->entries = param->obufs->entries;

		dbufs_local.obufs->type = param->obufs->type;



		dbufs_local.ibufs->buff_entry = ibuf_temp;

		for (i = 0; i < dbufs_local.ibufs->entries; i++) {

			ibuf_temp[i].buffer =

				param->ibufs->buff_entry[i].buffer;

			ibuf_temp[i].size =

				param->ibufs->buff_entry[i].size;

		}

		dbufs_local.obufs->buff_entry = obuf_temp;

		for (i = 0; i < dbufs_local.obufs->entries; i++) {

			obuf_temp[i].buffer =

				param->obufs->buff_entry[i].buffer;

			obuf_temp[i].size =

				param->obufs->buff_entry[i].size;



		if (copy_from_user(obuf_tmp, obufs.buff_entry,

				obufs.entries * sizeof(*obuf_tmp))) {

			retval = -EFAULT;

			goto free_iobufs;

		}

		obufs.buff_entry = obuf_tmp;

		dbufs_local.obufs = &obufs;



		retval = sst_decode(str_id, &dbufs_local);

		if (retval)

		if (retval) {

			retval = -EAGAIN;

		if (copy_to_user(&param->input_bytes_consumed,

			goto free_iobufs;

		}



		dest = (char *)arg + offsetof(struct snd_sst_dbufs, input_bytes_consumed);

		if (copy_to_user(dest,

				&dbufs_local.input_bytes_consumed,

				sizeof(unsigned long long))) {

			retval = -EFAULT;

			break;

			goto free_iobufs;

		}

		if (copy_to_user(&param->output_bytes_produced,



		dest = (char *)arg + offsetof(struct snd_sst_dbufs, input_bytes_consumed);

		if (copy_to_user(dest,

				&dbufs_local.output_bytes_produced,

				sizeof(unsigned long long))) {

			retval = -EFAULT;

			break;

			goto free_iobufs;

		}

free_iobufs:

		kfree(ibuf_tmp);

		kfree(obuf_tmp);

		break;

	}