Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 08f984c7 authored by Eliot Blennerhassett's avatar Eliot Blennerhassett Committed by Takashi Iwai
Browse files

ALSA: asihpi - Clarify adapter index validity check 



Avoids assigning possibly invalid address to pa, even if it
is never dereferenced.
Correct error response to reflect request object/function ids.

Signed-off-by: default avatarEliot Blennerhassett <eblennerhassett@audioscience.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent dc889f18

sound/pci/asihpi/hpioctl.c

+12 −7
Original line number Original line Diff line number Diff line
@@ -177,16 +177,21 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
	} else {

	} else {

		u16 __user *ptr = NULL;

		u16 __user *ptr = NULL;

		u32 size = 0;

		u32 size = 0;



		u32 adapter_present;

		/* -1=no data 0=read from user mem, 1=write to user mem */

		/* -1=no data 0=read from user mem, 1=write to user mem */

		int wrflag = -1;

		int wrflag = -1;

		u32 adapter = hm->h.adapter_index;

		struct hpi_adapter *pa;

		struct hpi_adapter *pa = &adapters[adapter];



		if (hm->h.adapter_index < HPI_MAX_ADAPTERS) {

			pa = &adapters[hm->h.adapter_index];

			adapter_present = pa->type;

		} else {

			adapter_present = 0;

		}





		if ((adapter >= HPI_MAX_ADAPTERS) || (!pa->type)) {

		if (!adapter_present) {

			hpi_init_response(&hr->r0, HPI_OBJ_ADAPTER,

			hpi_init_response(&hr->r0, hm->h.object,

				HPI_ADAPTER_OPEN,

				hm->h.function, HPI_ERROR_BAD_ADAPTER_NUMBER);

				HPI_ERROR_BAD_ADAPTER_NUMBER);





			uncopied_bytes =

			uncopied_bytes =

				copy_to_user(puhr, hr, sizeof(hr->h));

				copy_to_user(puhr, hr, sizeof(hr->h));