[alsa-devel] [patch] ALSA: line6: fix a crash in line6_hwdep_write()
The error checking here is messed up so we could end up dereferencing -EFAULT.
Fixes: a16039cbf1a1 ('ALSA: line6: Add hwdep interface to access the POD control messages') Signed-off-by: Dan Carpenter dan.carpenter@oracle.com
diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c index 14e587e..90009c0 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -604,8 +604,8 @@ line6_hwdep_write(struct snd_hwdep *hwdep, const char __user *data, long count, }
data_copy = memdup_user(data, count); - if (IS_ERR(ERR_PTR)) - return -ENOMEM; + if (IS_ERR(data_copy)) + return PTR_ERR(data_copy);
rv = line6_send_raw_message(line6, data_copy, count);
On Oct 12 2016 15:21, Dan Carpenter wrote:
The error checking here is messed up so we could end up dereferencing -EFAULT.
Fixes: a16039cbf1a1 ('ALSA: line6: Add hwdep interface to access the POD control messages') Signed-off-by: Dan Carpenter dan.carpenter@oracle.com
Reviewed-by: Takashi Sakamoto o-takashi@sakamocchi.jp
diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c index 14e587e..90009c0 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -604,8 +604,8 @@ line6_hwdep_write(struct snd_hwdep *hwdep, const char __user *data, long count, }
data_copy = memdup_user(data, count);
- if (IS_ERR(ERR_PTR))
return -ENOMEM;
if (IS_ERR(data_copy))
return PTR_ERR(data_copy);rv = line6_send_raw_message(line6, data_copy, count);
On Wed, 12 Oct 2016 08:21:40 +0200, Dan Carpenter wrote:
The error checking here is messed up so we could end up dereferencing -EFAULT.
Fixes: a16039cbf1a1 ('ALSA: line6: Add hwdep interface to access the POD control messages') Signed-off-by: Dan Carpenter dan.carpenter@oracle.com
Applied, thanks.
Takashi
diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c index 14e587e..90009c0 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -604,8 +604,8 @@ line6_hwdep_write(struct snd_hwdep *hwdep, const char __user *data, long count, }
data_copy = memdup_user(data, count);
- if (IS_ERR(ERR_PTR))
return -ENOMEM;
if (IS_ERR(data_copy))
return PTR_ERR(data_copy);rv = line6_send_raw_message(line6, data_copy, count);
participants (3)
-
Dan Carpenter -
Takashi Iwai -
Takashi Sakamoto