Staging: sst: dereferencing user pointers
This code dereferences user supplied pointers directly instead of doing a copy_from_user(). Some kernel configs put user and kernel memory in different address spaces so this code isn't portable. Also the user memory could be swapped out or in this case the pointer could just be NULL leading to an oops. Another thing is that it makes permission tests like this sort of meaningless. if (minor == STREAM_MODULE && rec_mute->stream_id == 0) { retval = -EPERM; break; } The user could set stream_id to 1 for the test and then change it later. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
parent
ea07a9f255
commit
3b97eed201
1 changed files with 36 additions and 43 deletions
|
@ -885,41 +885,39 @@ long intel_sst_ioctl(struct file *file_ptr, unsigned int cmd, unsigned long arg)
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
case _IOC_NR(SNDRV_SST_SET_VOL): {
|
case _IOC_NR(SNDRV_SST_SET_VOL): {
|
||||||
struct snd_sst_vol *set_vol;
|
struct snd_sst_vol set_vol;
|
||||||
struct snd_sst_vol *rec_vol = (struct snd_sst_vol *)arg;
|
|
||||||
pr_debug("sst: SET_VOLUME recieved for %d!\n",
|
if (copy_from_user(&set_vol, (void __user *)arg,
|
||||||
rec_vol->stream_id);
|
sizeof(set_vol))) {
|
||||||
if (minor == STREAM_MODULE && rec_vol->stream_id == 0) {
|
|
||||||
pr_debug("sst: invalid operation!\n");
|
|
||||||
retval = -EPERM;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
set_vol = kzalloc(sizeof(*set_vol), GFP_ATOMIC);
|
|
||||||
if (!set_vol) {
|
|
||||||
pr_debug("sst: mem allocation failed\n");
|
|
||||||
retval = -ENOMEM;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
if (copy_from_user(set_vol, rec_vol, sizeof(*set_vol))) {
|
|
||||||
pr_debug("sst: copy failed\n");
|
pr_debug("sst: copy failed\n");
|
||||||
retval = -EFAULT;
|
retval = -EFAULT;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
retval = sst_set_vol(set_vol);
|
pr_debug("sst: SET_VOLUME recieved for %d!\n",
|
||||||
kfree(set_vol);
|
set_vol.stream_id);
|
||||||
break;
|
if (minor == STREAM_MODULE && set_vol.stream_id == 0) {
|
||||||
}
|
pr_debug("sst: invalid operation!\n");
|
||||||
case _IOC_NR(SNDRV_SST_GET_VOL): {
|
retval = -EPERM;
|
||||||
struct snd_sst_vol *rec_vol = (struct snd_sst_vol *)arg;
|
break;
|
||||||
struct snd_sst_vol get_vol;
|
}
|
||||||
pr_debug("sst: IOCTL_GET_VOLUME recieved for stream = %d!\n",
|
retval = sst_set_vol(&set_vol);
|
||||||
rec_vol->stream_id);
|
break;
|
||||||
if (minor == STREAM_MODULE && rec_vol->stream_id == 0) {
|
}
|
||||||
|
case _IOC_NR(SNDRV_SST_GET_VOL): {
|
||||||
|
struct snd_sst_vol get_vol;
|
||||||
|
|
||||||
|
if (copy_from_user(&get_vol, (void __user *)arg,
|
||||||
|
sizeof(get_vol))) {
|
||||||
|
retval = -EFAULT;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
pr_debug("sst: IOCTL_GET_VOLUME recieved for stream = %d!\n",
|
||||||
|
get_vol.stream_id);
|
||||||
|
if (minor == STREAM_MODULE && get_vol.stream_id == 0) {
|
||||||
pr_debug("sst: invalid operation!\n");
|
pr_debug("sst: invalid operation!\n");
|
||||||
retval = -EPERM;
|
retval = -EPERM;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
get_vol.stream_id = rec_vol->stream_id;
|
|
||||||
retval = sst_get_vol(&get_vol);
|
retval = sst_get_vol(&get_vol);
|
||||||
if (retval) {
|
if (retval) {
|
||||||
retval = -EIO;
|
retval = -EIO;
|
||||||
|
@ -938,25 +936,20 @@ long intel_sst_ioctl(struct file *file_ptr, unsigned int cmd, unsigned long arg)
|
||||||
}
|
}
|
||||||
|
|
||||||
case _IOC_NR(SNDRV_SST_MUTE): {
|
case _IOC_NR(SNDRV_SST_MUTE): {
|
||||||
struct snd_sst_mute *set_mute;
|
struct snd_sst_mute set_mute;
|
||||||
struct snd_sst_vol *rec_mute = (struct snd_sst_vol *)arg;
|
|
||||||
pr_debug("sst: SNDRV_SST_SET_VOLUME recieved for %d!\n",
|
if (copy_from_user(&set_mute, (void __user *)arg,
|
||||||
rec_mute->stream_id);
|
sizeof(set_mute))) {
|
||||||
if (minor == STREAM_MODULE && rec_mute->stream_id == 0) {
|
|
||||||
retval = -EPERM;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
set_mute = kzalloc(sizeof(*set_mute), GFP_ATOMIC);
|
|
||||||
if (!set_mute) {
|
|
||||||
retval = -ENOMEM;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
if (copy_from_user(set_mute, rec_mute, sizeof(*set_mute))) {
|
|
||||||
retval = -EFAULT;
|
retval = -EFAULT;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
retval = sst_set_mute(set_mute);
|
pr_debug("sst: SNDRV_SST_SET_VOLUME recieved for %d!\n",
|
||||||
kfree(set_mute);
|
set_mute.stream_id);
|
||||||
|
if (minor == STREAM_MODULE && set_mute.stream_id == 0) {
|
||||||
|
retval = -EPERM;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
retval = sst_set_mute(&set_mute);
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
case _IOC_NR(SNDRV_SST_STREAM_GET_PARAMS): {
|
case _IOC_NR(SNDRV_SST_STREAM_GET_PARAMS): {
|
||||||
|
|
Reference in a new issue