Commit 3b97eed2 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman

Staging: sst: dereferencing user pointers

This code dereferences user supplied pointers directly instead of doing
a copy_from_user().  Some kernel configs put user and kernel memory in
different address spaces so this code isn't portable.  Also the user
memory could be swapped out or in this case the pointer could just be
NULL leading to an oops.

Another thing is that it makes permission tests like this sort of
meaningless.
	if (minor == STREAM_MODULE && rec_mute->stream_id == 0) {
		retval = -EPERM;
		break;
	}
The user could set stream_id to 1 for the test and then change it later.
Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Acked-by: default avatarVinod Koul <vinod.koul@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent ea07a9f2
...@@ -885,41 +885,39 @@ long intel_sst_ioctl(struct file *file_ptr, unsigned int cmd, unsigned long arg) ...@@ -885,41 +885,39 @@ long intel_sst_ioctl(struct file *file_ptr, unsigned int cmd, unsigned long arg)
break; break;
} }
case _IOC_NR(SNDRV_SST_SET_VOL): { case _IOC_NR(SNDRV_SST_SET_VOL): {
struct snd_sst_vol *set_vol; struct snd_sst_vol set_vol;
struct snd_sst_vol *rec_vol = (struct snd_sst_vol *)arg;
if (copy_from_user(&set_vol, (void __user *)arg,
sizeof(set_vol))) {
pr_debug("sst: copy failed\n");
retval = -EFAULT;
break;
}
pr_debug("sst: SET_VOLUME recieved for %d!\n", pr_debug("sst: SET_VOLUME recieved for %d!\n",
rec_vol->stream_id); set_vol.stream_id);
if (minor == STREAM_MODULE && rec_vol->stream_id == 0) { if (minor == STREAM_MODULE && set_vol.stream_id == 0) {
pr_debug("sst: invalid operation!\n"); pr_debug("sst: invalid operation!\n");
retval = -EPERM; retval = -EPERM;
break; break;
} }
set_vol = kzalloc(sizeof(*set_vol), GFP_ATOMIC); retval = sst_set_vol(&set_vol);
if (!set_vol) {
pr_debug("sst: mem allocation failed\n");
retval = -ENOMEM;
break; break;
} }
if (copy_from_user(set_vol, rec_vol, sizeof(*set_vol))) { case _IOC_NR(SNDRV_SST_GET_VOL): {
pr_debug("sst: copy failed\n"); struct snd_sst_vol get_vol;
if (copy_from_user(&get_vol, (void __user *)arg,
sizeof(get_vol))) {
retval = -EFAULT; retval = -EFAULT;
break; break;
} }
retval = sst_set_vol(set_vol);
kfree(set_vol);
break;
}
case _IOC_NR(SNDRV_SST_GET_VOL): {
struct snd_sst_vol *rec_vol = (struct snd_sst_vol *)arg;
struct snd_sst_vol get_vol;
pr_debug("sst: IOCTL_GET_VOLUME recieved for stream = %d!\n", pr_debug("sst: IOCTL_GET_VOLUME recieved for stream = %d!\n",
rec_vol->stream_id); get_vol.stream_id);
if (minor == STREAM_MODULE && rec_vol->stream_id == 0) { if (minor == STREAM_MODULE && get_vol.stream_id == 0) {
pr_debug("sst: invalid operation!\n"); pr_debug("sst: invalid operation!\n");
retval = -EPERM; retval = -EPERM;
break; break;
} }
get_vol.stream_id = rec_vol->stream_id;
retval = sst_get_vol(&get_vol); retval = sst_get_vol(&get_vol);
if (retval) { if (retval) {
retval = -EIO; retval = -EIO;
...@@ -938,25 +936,20 @@ long intel_sst_ioctl(struct file *file_ptr, unsigned int cmd, unsigned long arg) ...@@ -938,25 +936,20 @@ long intel_sst_ioctl(struct file *file_ptr, unsigned int cmd, unsigned long arg)
} }
case _IOC_NR(SNDRV_SST_MUTE): { case _IOC_NR(SNDRV_SST_MUTE): {
struct snd_sst_mute *set_mute; struct snd_sst_mute set_mute;
struct snd_sst_vol *rec_mute = (struct snd_sst_vol *)arg;
pr_debug("sst: SNDRV_SST_SET_VOLUME recieved for %d!\n", if (copy_from_user(&set_mute, (void __user *)arg,
rec_mute->stream_id); sizeof(set_mute))) {
if (minor == STREAM_MODULE && rec_mute->stream_id == 0) { retval = -EFAULT;
retval = -EPERM;
break;
}
set_mute = kzalloc(sizeof(*set_mute), GFP_ATOMIC);
if (!set_mute) {
retval = -ENOMEM;
break; break;
} }
if (copy_from_user(set_mute, rec_mute, sizeof(*set_mute))) { pr_debug("sst: SNDRV_SST_SET_VOLUME recieved for %d!\n",
retval = -EFAULT; set_mute.stream_id);
if (minor == STREAM_MODULE && set_mute.stream_id == 0) {
retval = -EPERM;
break; break;
} }
retval = sst_set_mute(set_mute); retval = sst_set_mute(&set_mute);
kfree(set_mute);
break; break;
} }
case _IOC_NR(SNDRV_SST_STREAM_GET_PARAMS): { case _IOC_NR(SNDRV_SST_STREAM_GET_PARAMS): {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment