Skip to contentSkip to conversation

ALSA: line6: fix a crash in line6_hwdep_write()

PATCH Applied Dan Carpenter 3 participants 3 messages Oct 12, 2016

Subsystems (2)
Sound Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 ALSA: line6: fix a crash in line6_hwdep_write()

The error checking here is messed up so we could end up dereferencing -EFAULT.

Fixes a16039cbf1a1 ('ALSA: line6: Add hwdep interface to access the POD control messages')
Signed-off-by Dan Carpenter <[email protected]>
sound/usb/line6/driver.c +2 -2
index 14e587e..90009c0 100644
@@ -604,8 +604,8 @@ line6_hwdep_write(struct snd_hwdep *hwdep, const char __user *data, long count,
 	}
 
 	data_copy = memdup_user(data, count);
-	if (IS_ERR(ERR_PTR))
-		return -ENOMEM;
+	if (IS_ERR(data_copy))
+		return PTR_ERR(data_copy);
 
 	rv = line6_send_raw_message(line6, data_copy, count);
Reviewed-by on v1 1/1
#1 lore raw
Quoted 5 lines · Dan Carpenter

The error checking here is messed up so we could end up dereferencing -EFAULT.

Fixes a16039cbf1a1 ('ALSA: line6: Add hwdep interface to access the POD control messages')
Signed-off-by Dan Carpenter <[email protected]>
Reviewed-by Takashi Sakamoto <[email protected]>
Quoted 14 lines
sound/usb/line6/driver.c +2 -2
index 14e587e..90009c0 100644
@@ -604,8 +604,8 @@ line6_hwdep_write(struct snd_hwdep *hwdep, const char __user *data, long count,
 	}
 
 	data_copy = memdup_user(data, count);
-	if (IS_ERR(ERR_PTR))
-		return -ENOMEM;
+	if (IS_ERR(data_copy))
+		return PTR_ERR(data_copy);
 
 	rv = line6_send_raw_message(line6, data_copy, count);
Applied
#2 lore raw
In reply to Dan Carpenter
Quoted 6 lines · Dan Carpenter

The error checking here is messed up so we could end up dereferencing -EFAULT.

Fixes a16039cbf1a1 ('ALSA: line6: Add hwdep interface to access the POD control messages')
Signed-off-by Dan Carpenter <[email protected]>

Applied, thanks.

Takashi

Quoted 17 lines
sound/usb/line6/driver.c +2 -2
index 14e587e..90009c0 100644
@@ -604,8 +604,8 @@ line6_hwdep_write(struct snd_hwdep *hwdep, const char __user *data, long count,
 	}
 
 	data_copy = memdup_user(data, count);
-	if (IS_ERR(ERR_PTR))
-		return -ENOMEM;
+	if (IS_ERR(data_copy))
+		return PTR_ERR(data_copy);
 
 	rv = line6_send_raw_message(line6, data_copy, count);