Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 69b05825 authored by Takashi Sakamoto's avatar Takashi Sakamoto Committed by Takashi Iwai
Browse files

ALSA: seq: fix to copy from/to user space 



When checking value of request for copy operation, current implementation
compares shifted value to macros, while these macros are already shifted.
As a result, it never performs to copy from/to user space.

This commit fixes the bug.

Fixes: 8ce8eb60('ALSA: seq: add an alternative way to handle ioctl requests'
Signed-off-by: default avatarTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 071f1344

sound/core/seq/seq_clientmgr.c

+2 −2
Original line number Diff line number Diff line
@@ -2122,7 +2122,7 @@ static long snd_seq_ioctl(struct file *file, unsigned int cmd, 
	 * within 13 bits. We can safely pick up the size from the command.

	 */

	size = _IOC_SIZE(handler->cmd);

	if (_IOC_DIR(handler->cmd) & IOC_IN) {

	if (handler->cmd & IOC_IN) {

		if (copy_from_user(&buf, (const void __user *)arg, size))

			return -EFAULT;

	}
@@ -2132,7 +2132,7 @@ static long snd_seq_ioctl(struct file *file, unsigned int cmd, 
		/* Some commands includes a bug in 'dir' field. */

		if (handler->cmd == SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT ||

		    handler->cmd == SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ||

		    (_IOC_DIR(handler->cmd) & IOC_OUT))

		    (handler->cmd & IOC_OUT))

			if (copy_to_user((void __user *)arg, &buf, size))

				return -EFAULT;

	}