| From a34ae6c0660d3b96b0055f68ef74dc9478852245 Mon Sep 17 00:00:00 2001 |
| From: Takashi Iwai <tiwai@suse.de> |
| Date: Tue, 10 May 2022 12:36:26 +0200 |
| Subject: ALSA: wavefront: Proper check of get_user() error |
| |
| From: Takashi Iwai <tiwai@suse.de> |
| |
| commit a34ae6c0660d3b96b0055f68ef74dc9478852245 upstream. |
| |
| The antient ISA wavefront driver reads its sample patch data (uploaded |
| over an ioctl) via __get_user() with no good reason; likely just for |
| some performance optimizations in the past. Let's change this to the |
| standard get_user() and the error check for handling the fault case |
| properly. |
| |
| Reported-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Cc: <stable@vger.kernel.org> |
| Link: https://lore.kernel.org/r/20220510103626.16635-1-tiwai@suse.de |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| sound/isa/wavefront/wavefront_synth.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/sound/isa/wavefront/wavefront_synth.c |
| +++ b/sound/isa/wavefront/wavefront_synth.c |
| @@ -1088,7 +1088,8 @@ wavefront_send_sample (snd_wavefront_t * |
| |
| if (dataptr < data_end) { |
| |
| - __get_user (sample_short, dataptr); |
| + if (get_user(sample_short, dataptr)) |
| + return -EFAULT; |
| dataptr += skip; |
| |
| if (data_is_unsigned) { /* GUS ? */ |
