Loading sound/isa/sb/sb16_csp.c +10 −9 Original line number Diff line number Diff line Loading @@ -684,15 +684,16 @@ static int snd_sb_csp_load(struct snd_sb_csp * p, const unsigned char *buf, int static int snd_sb_csp_load_user(struct snd_sb_csp * p, const unsigned char __user *buf, int size, int load_flags) { int err = -ENOMEM; unsigned char *kbuf = kmalloc(size, GFP_KERNEL); if (kbuf) { if (copy_from_user(kbuf, buf, size)) err = -EFAULT; else int err; unsigned char *kbuf; kbuf = memdup_user(buf, size); if (IS_ERR(kbuf)) return PTR_ERR(kbuf); err = snd_sb_csp_load(p, kbuf, size, load_flags); kfree(kbuf); } return err; } Loading sound/isa/wavefront/wavefront_fx.c +5 −9 Original line number Diff line number Diff line Loading @@ -210,15 +210,11 @@ snd_wavefront_fx_ioctl (struct snd_hwdep *sdev, struct file *file, "> 512 bytes to FX\n"); return -EIO; } page_data = kmalloc(r.data[2] * sizeof(short), GFP_KERNEL); if (!page_data) return -ENOMEM; if (copy_from_user (page_data, (unsigned char __user *) r.data[3], r.data[2] * sizeof(short))) { kfree(page_data); return -EFAULT; } page_data = memdup_user((unsigned char __user *) r.data[3], r.data[2] * sizeof(short)); if (IS_ERR(page_data)) return PTR_ERR(page_data); pd = page_data; } Loading sound/isa/wavefront/wavefront_synth.c +5 −6 Original line number Diff line number Diff line Loading @@ -1664,12 +1664,11 @@ snd_wavefront_synth_ioctl (struct snd_hwdep *hw, struct file *file, break; case WFCTL_WFCMD: wc = kmalloc(sizeof(*wc), GFP_KERNEL); if (! wc) return -ENOMEM; if (copy_from_user (wc, argp, sizeof (*wc))) err = -EFAULT; else if (wavefront_synth_control (acard, wc) < 0) wc = memdup_user(argp, sizeof(*wc)); if (IS_ERR(wc)) return PTR_ERR(wc); if (wavefront_synth_control (acard, wc) < 0) err = -EIO; else if (copy_to_user (argp, wc, sizeof (*wc))) err = -EFAULT; Loading Loading
sound/isa/sb/sb16_csp.c +10 −9 Original line number Diff line number Diff line Loading @@ -684,15 +684,16 @@ static int snd_sb_csp_load(struct snd_sb_csp * p, const unsigned char *buf, int static int snd_sb_csp_load_user(struct snd_sb_csp * p, const unsigned char __user *buf, int size, int load_flags) { int err = -ENOMEM; unsigned char *kbuf = kmalloc(size, GFP_KERNEL); if (kbuf) { if (copy_from_user(kbuf, buf, size)) err = -EFAULT; else int err; unsigned char *kbuf; kbuf = memdup_user(buf, size); if (IS_ERR(kbuf)) return PTR_ERR(kbuf); err = snd_sb_csp_load(p, kbuf, size, load_flags); kfree(kbuf); } return err; } Loading
sound/isa/wavefront/wavefront_fx.c +5 −9 Original line number Diff line number Diff line Loading @@ -210,15 +210,11 @@ snd_wavefront_fx_ioctl (struct snd_hwdep *sdev, struct file *file, "> 512 bytes to FX\n"); return -EIO; } page_data = kmalloc(r.data[2] * sizeof(short), GFP_KERNEL); if (!page_data) return -ENOMEM; if (copy_from_user (page_data, (unsigned char __user *) r.data[3], r.data[2] * sizeof(short))) { kfree(page_data); return -EFAULT; } page_data = memdup_user((unsigned char __user *) r.data[3], r.data[2] * sizeof(short)); if (IS_ERR(page_data)) return PTR_ERR(page_data); pd = page_data; } Loading
sound/isa/wavefront/wavefront_synth.c +5 −6 Original line number Diff line number Diff line Loading @@ -1664,12 +1664,11 @@ snd_wavefront_synth_ioctl (struct snd_hwdep *hw, struct file *file, break; case WFCTL_WFCMD: wc = kmalloc(sizeof(*wc), GFP_KERNEL); if (! wc) return -ENOMEM; if (copy_from_user (wc, argp, sizeof (*wc))) err = -EFAULT; else if (wavefront_synth_control (acard, wc) < 0) wc = memdup_user(argp, sizeof(*wc)); if (IS_ERR(wc)) return PTR_ERR(wc); if (wavefront_synth_control (acard, wc) < 0) err = -EIO; else if (copy_to_user (argp, wc, sizeof (*wc))) err = -EFAULT; Loading