rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

ASoC: msm: qdsp6v2: return error when copy from userspace fails

Browse Source 
A copy_from_user is not always expected to succeed. Therefore, check
for an error before operating on the buffer post copy.

CRs-Fixed: 1116070
Change-Id: I21032719e6e85f280ca0cda875c84ac8dee8916b
Signed-off-by: Siena Richard <sienar@codeaurora.org>
CVE-2017-0610 follow-up
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This commit is contained in:
Siena Richard
2019-08-06 12:25:47 +02:00
committed by Francescodario Cuzzocrea
parent 60b61ffed9
commit f370b53808
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c
+12 -8
View File
@@ -1,4 +1,4 @@
/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -817,17 +817,21 @@ static int msm_pcm_playback_copy(struct snd_pcm_substream *substream, int a,
if (prtd->mode == MODE_PCM) {
ret = copy_from_user(&buf_node->frame.voc_pkt,
buf, count);
if (ret) {
pr_err("%s: copy from user failed %d\n",
__func__, ret);
return -EFAULT;
}
buf_node->frame.pktlen = count;
} else
} else {
ret = copy_from_user(&buf_node->frame,
buf, count);
if (ret) {
pr_err("%s: copy from user failed %d\n",
__func__, ret);
return -EFAULT;
if (ret) {
pr_err("%s: copy from user failed %d\n",
__func__, ret);
return -EFAULT;
}
}
spin_lock_irqsave(&prtd->dsp_lock, dsp_flags);
list_add_tail(&buf_node->list, &prtd->in_queue);
spin_unlock_irqrestore(&prtd->dsp_lock, dsp_flags);