Commit 12cc11e9 authored by Jaroslav Kysela's avatar Jaroslav Kysela

[ALSA] check __copy_to_user in sscape_upload_bootblock()

Sound Scape driver
__copy_to_user() is called without checking its return value in
sound/isa/sscape.c::sscape_upload_bootblock .
Signed-off-by: default avatarJesper Juhl <juhl-lkml@dif.dk>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 0e0b7c68
...@@ -572,7 +572,8 @@ static int sscape_upload_bootblock(struct soundscape *sscape, struct sscape_boot ...@@ -572,7 +572,8 @@ static int sscape_upload_bootblock(struct soundscape *sscape, struct sscape_boot
snd_printk(KERN_ERR "sscape: timeout reading firmware version\n"); snd_printk(KERN_ERR "sscape: timeout reading firmware version\n");
ret = -EAGAIN; ret = -EAGAIN;
} else { } else {
__copy_to_user(&bb->version, &data, sizeof(bb->version)); if (__copy_to_user(&bb->version, &data, sizeof(bb->version)))
ret = -EFAULT;
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment