ALSA: sound/core: use memdup_user() (ef44a1ec) · Commits · e / devices / android_kernel_xiaomi_sm6125

sound/core/control.c

+13 −22

Original line number	Original line	Diff line number	Diff line
	@@ -724,13 +724,10 @@ static int snd_ctl_elem_read_user(struct snd_card *card,
	struct snd_ctl_elem_value *control;		struct snd_ctl_elem_value *control;
	int result;		int result;

	control = kmalloc(sizeof(*control), GFP_KERNEL);		control = memdup_user(_control, sizeof(*control));
	if (control == NULL)		if (IS_ERR(control))
	return -ENOMEM;		return PTR_ERR(control);
	if (copy_from_user(control, _control, sizeof(*control))) {
	kfree(control);
	return -EFAULT;
	}
	snd_power_lock(card);		snd_power_lock(card);
	result = snd_power_wait(card, SNDRV_CTL_POWER_D0);		result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
	if (result >= 0)		if (result >= 0)
	@@ -784,13 +781,10 @@ static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
	struct snd_card *card;		struct snd_card *card;
	int result;		int result;

	control = kmalloc(sizeof(*control), GFP_KERNEL);		control = memdup_user(_control, sizeof(*control));
	if (control == NULL)		if (IS_ERR(control))
	return -ENOMEM;		return PTR_ERR(control);
	if (copy_from_user(control, _control, sizeof(*control))) {
	kfree(control);
	return -EFAULT;
	}
	card = file->card;		card = file->card;
	snd_power_lock(card);		snd_power_lock(card);
	result = snd_power_wait(card, SNDRV_CTL_POWER_D0);		result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
	@@ -916,13 +910,10 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol,
	if (op_flag > 0) {		if (op_flag > 0) {
	if (size > 1024 * 128) /* sane value */		if (size > 1024 * 128) /* sane value */
	return -EINVAL;		return -EINVAL;
	new_data = kmalloc(size, GFP_KERNEL);
	if (new_data == NULL)		new_data = memdup_user(tlv, size);
	return -ENOMEM;		if (IS_ERR(new_data))
	if (copy_from_user(new_data, tlv, size)) {		return PTR_ERR(new_data);
	kfree(new_data);
	return -EFAULT;
	}
	change = ue->tlv_data_size != size;		change = ue->tlv_data_size != size;
	if (!change)		if (!change)
	change = memcmp(ue->tlv_data, new_data, size);		change = memcmp(ue->tlv_data, new_data, size);

sound/core/pcm_compat.c

+4 −7

Original line number	Original line	Diff line number	Diff line
	@@ -232,14 +232,11 @@ static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream,
	if (! (runtime = substream->runtime))		if (! (runtime = substream->runtime))
	return -ENOTTY;		return -ENOTTY;

	data = kmalloc(sizeof(*data), GFP_KERNEL);
	if (data == NULL)
	return -ENOMEM;
	/* only fifo_size is different, so just copy all */		/* only fifo_size is different, so just copy all */
	if (copy_from_user(data, data32, sizeof(*data32))) {		data = memdup_user(data32, sizeof(*data32));
	err = -EFAULT;		if (IS_ERR(data))
	goto error;		return PTR_ERR(data);
	}
	if (refine)		if (refine)
	err = snd_pcm_hw_refine(substream, data);		err = snd_pcm_hw_refine(substream, data);
	else		else

sound/core/pcm_native.c

+35 −58

Original line number	Original line	Diff line number	Diff line
	@@ -327,21 +327,16 @@ static int snd_pcm_hw_refine_user(struct snd_pcm_substream *substream,
	struct snd_pcm_hw_params *params;		struct snd_pcm_hw_params *params;
	int err;		int err;

	params = kmalloc(sizeof(*params), GFP_KERNEL);		params = memdup_user(_params, sizeof(*params));
	if (!params) {		if (IS_ERR(params))
	err = -ENOMEM;		return PTR_ERR(params);
	goto out;
	}
	if (copy_from_user(params, _params, sizeof(*params))) {
	err = -EFAULT;
	goto out;
	}
	err = snd_pcm_hw_refine(substream, params);		err = snd_pcm_hw_refine(substream, params);
	if (copy_to_user(_params, params, sizeof(*params))) {		if (copy_to_user(_params, params, sizeof(*params))) {
	if (!err)		if (!err)
	err = -EFAULT;		err = -EFAULT;
	}		}
	out:
	kfree(params);		kfree(params);
	return err;		return err;
	}		}
	@@ -465,21 +460,16 @@ static int snd_pcm_hw_params_user(struct snd_pcm_substream *substream,
	struct snd_pcm_hw_params *params;		struct snd_pcm_hw_params *params;
	int err;		int err;

	params = kmalloc(sizeof(*params), GFP_KERNEL);		params = memdup_user(_params, sizeof(*params));
	if (!params) {		if (IS_ERR(params))
	err = -ENOMEM;		return PTR_ERR(params);
	goto out;
	}
	if (copy_from_user(params, _params, sizeof(*params))) {
	err = -EFAULT;
	goto out;
	}
	err = snd_pcm_hw_params(substream, params);		err = snd_pcm_hw_params(substream, params);
	if (copy_to_user(_params, params, sizeof(*params))) {		if (copy_to_user(_params, params, sizeof(*params))) {
	if (!err)		if (!err)
	err = -EFAULT;		err = -EFAULT;
	}		}
	out:
	kfree(params);		kfree(params);
	return err;		return err;
	}		}
	@@ -2593,13 +2583,11 @@ static int snd_pcm_playback_ioctl1(struct file *file,
	return -EFAULT;		return -EFAULT;
	if (copy_from_user(&xfern, _xfern, sizeof(xfern)))		if (copy_from_user(&xfern, _xfern, sizeof(xfern)))
	return -EFAULT;		return -EFAULT;
	bufs = kmalloc(sizeof(void ) runtime->channels, GFP_KERNEL);
	if (bufs == NULL)		bufs = memdup_user(xfern.bufs,
	return -ENOMEM;		sizeof(void ) runtime->channels);
	if (copy_from_user(bufs, xfern.bufs, sizeof(void ) runtime->channels)) {		if (IS_ERR(bufs))
	kfree(bufs);		return PTR_ERR(bufs);
	return -EFAULT;
	}
	result = snd_pcm_lib_writev(substream, bufs, xfern.frames);		result = snd_pcm_lib_writev(substream, bufs, xfern.frames);
	kfree(bufs);		kfree(bufs);
	__put_user(result, &_xfern->result);		__put_user(result, &_xfern->result);
	@@ -2675,13 +2663,11 @@ static int snd_pcm_capture_ioctl1(struct file *file,
	return -EFAULT;		return -EFAULT;
	if (copy_from_user(&xfern, _xfern, sizeof(xfern)))		if (copy_from_user(&xfern, _xfern, sizeof(xfern)))
	return -EFAULT;		return -EFAULT;
	bufs = kmalloc(sizeof(void ) runtime->channels, GFP_KERNEL);
	if (bufs == NULL)		bufs = memdup_user(xfern.bufs,
	return -ENOMEM;		sizeof(void ) runtime->channels);
	if (copy_from_user(bufs, xfern.bufs, sizeof(void ) runtime->channels)) {		if (IS_ERR(bufs))
	kfree(bufs);		return PTR_ERR(bufs);
	return -EFAULT;
	}
	result = snd_pcm_lib_readv(substream, bufs, xfern.frames);		result = snd_pcm_lib_readv(substream, bufs, xfern.frames);
	kfree(bufs);		kfree(bufs);
	__put_user(result, &_xfern->result);		__put_user(result, &_xfern->result);
	@@ -3312,18 +3298,12 @@ static int snd_pcm_hw_refine_old_user(struct snd_pcm_substream *substream,
	int err;		int err;

	params = kmalloc(sizeof(*params), GFP_KERNEL);		params = kmalloc(sizeof(*params), GFP_KERNEL);
	if (!params) {		if (!params)
	err = -ENOMEM;		return -ENOMEM;
	goto out;
	}
	oparams = kmalloc(sizeof(*oparams), GFP_KERNEL);
	if (!oparams) {
	err = -ENOMEM;
	goto out;
	}

	if (copy_from_user(oparams, _oparams, sizeof(*oparams))) {		oparams = memdup_user(_oparams, sizeof(*oparams));
	err = -EFAULT;		if (IS_ERR(oparams)) {
			err = PTR_ERR(oparams);
	goto out;		goto out;
	}		}
	snd_pcm_hw_convert_from_old_params(params, oparams);		snd_pcm_hw_convert_from_old_params(params, oparams);
	@@ -3333,9 +3313,10 @@ static int snd_pcm_hw_refine_old_user(struct snd_pcm_substream *substream,
	if (!err)		if (!err)
	err = -EFAULT;		err = -EFAULT;
	}		}

			kfree(oparams);
	out:		out:
	kfree(params);		kfree(params);
	kfree(oparams);
	return err;		return err;
	}		}

	@@ -3347,17 +3328,12 @@ static int snd_pcm_hw_params_old_user(struct snd_pcm_substream *substream,
	int err;		int err;

	params = kmalloc(sizeof(*params), GFP_KERNEL);		params = kmalloc(sizeof(*params), GFP_KERNEL);
	if (!params) {		if (!params)
	err = -ENOMEM;		return -ENOMEM;
	goto out;
	}		oparams = memdup_user(_oparams, sizeof(*oparams));
	oparams = kmalloc(sizeof(*oparams), GFP_KERNEL);		if (IS_ERR(oparams)) {
	if (!oparams) {		err = PTR_ERR(oparams);
	err = -ENOMEM;
	goto out;
	}
	if (copy_from_user(oparams, _oparams, sizeof(*oparams))) {
	err = -EFAULT;
	goto out;		goto out;
	}		}
	snd_pcm_hw_convert_from_old_params(params, oparams);		snd_pcm_hw_convert_from_old_params(params, oparams);
	@@ -3367,9 +3343,10 @@ static int snd_pcm_hw_params_old_user(struct snd_pcm_substream *substream,
	if (!err)		if (!err)
	err = -EFAULT;		err = -EFAULT;
	}		}

			kfree(oparams);
	out:		out:
	kfree(params);		kfree(params);
	kfree(oparams);
	return err;		return err;
	}		}
	#endif /* CONFIG_SND_SUPPORT_OLD_API */		#endif /* CONFIG_SND_SUPPORT_OLD_API */

sound/core/seq/seq_compat.c

+4 −5

Original line number	Original line	Diff line number	Diff line
	@@ -48,12 +48,11 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned
	struct snd_seq_port_info *data;		struct snd_seq_port_info *data;
	mm_segment_t fs;		mm_segment_t fs;

	data = kmalloc(sizeof(*data), GFP_KERNEL);		data = memdup_user(data32, sizeof(*data32));
	if (! data)		if (IS_ERR(data))
	return -ENOMEM;		return PTR_ERR(data);

	if (copy_from_user(data, data32, sizeof(*data32)) \|\|		if (get_user(data->flags, &data32->flags) \|\|
	get_user(data->flags, &data32->flags) \|\|
	get_user(data->time_queue, &data32->time_queue))		get_user(data->time_queue, &data32->time_queue))
	goto error;		goto error;
	data->kernel = NULL;		data->kernel = NULL;

sound/core/timer.c

+4 −7

Original line number	Original line	Diff line number	Diff line
	@@ -1395,13 +1395,10 @@ static int snd_timer_user_ginfo(struct file *file,
	struct list_head *p;		struct list_head *p;
	int err = 0;		int err = 0;

	ginfo = kmalloc(sizeof(*ginfo), GFP_KERNEL);		ginfo = memdup_user(_ginfo, sizeof(*ginfo));
	if (! ginfo)		if (IS_ERR(ginfo))
	return -ENOMEM;		return PTR_ERR(ginfo);
	if (copy_from_user(ginfo, _ginfo, sizeof(*ginfo))) {
	kfree(ginfo);
	return -EFAULT;
	}
	tid = ginfo->tid;		tid = ginfo->tid;
	memset(ginfo, 0, sizeof(*ginfo));		memset(ginfo, 0, sizeof(*ginfo));
	ginfo->tid = tid;		ginfo->tid = tid;