replace_user_tlv(): switch to vmemdup_user() (88a89037) · Commits · e / devices / android_kernel_xiaomi_nabu

sound/core/control.c

+5 −4

Original line number	Diff line number	Diff line
		@@ -25,6 +25,7 @@
		#include <linux/slab.h>
		#include <linux/vmalloc.h>
		#include <linux/time.h>
		#include <linux/mm.h>
		#include <linux/sched/signal.h>
		#include <sound/core.h>
		#include <sound/minors.h>
		@@ -1129,7 +1130,7 @@ static int replace_user_tlv(struct snd_kcontrol kctl, unsigned int __user buf,
		if (size > 1024 * 128) /* sane value */
		return -EINVAL;

		container = memdup_user(buf, size);
		container = vmemdup_user(buf, size);
		if (IS_ERR(container))
		return PTR_ERR(container);

		@@ -1137,7 +1138,7 @@ static int replace_user_tlv(struct snd_kcontrol kctl, unsigned int __user buf,
		if (!change)
		change = memcmp(ue->tlv_data, container, size) != 0;
		if (!change) {
		kfree(container);
		kvfree(container);
		return 0;
		}

		@@ -1148,7 +1149,7 @@ static int replace_user_tlv(struct snd_kcontrol kctl, unsigned int __user buf,
		mask = SNDRV_CTL_EVENT_MASK_INFO;
		}

		kfree(ue->tlv_data);
		kvfree(ue->tlv_data);
		ue->tlv_data = container;
		ue->tlv_data_size = size;

		@@ -1225,7 +1226,7 @@ static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol)
		{
		struct user_element *ue = kcontrol->private_data;

		kfree(ue->tlv_data);
		kvfree(ue->tlv_data);
		kfree(ue->priv_data);
		kfree(ue);
		}