write in 30M

hc

2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc

 kernel/sound/core/control_compat.c
..
..
@@ -1,21 +1,8 @@
1
+// SPDX-License-Identifier: GPL-2.0-or-later
1
2
 /*
2
3
  * compat ioctls for control API
3
4
  *
4
5
  *   Copyright (c) by Takashi Iwai <tiwai@suse.de>
5
- *
6
- *   This program is free software; you can redistribute it and/or modify
7
- *   it under the terms of the GNU General Public License as published by
8
- *   the Free Software Foundation; either version 2 of the License, or
9
- *   (at your option) any later version.
10
- *
11
- *   This program is distributed in the hope that it will be useful,
12
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
13
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14
- *   GNU General Public License for more details.
15
- *
16
- *   You should have received a copy of the GNU General Public License
17
- *   along with this program; if not, write to the Free Software
18
- *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
19
6
  */
20
7
 
21
8
 /* this file included from control.c */
..
..
@@ -35,24 +22,22 @@
35
22
 static int snd_ctl_elem_list_compat(struct snd_card *card,
36
23
 				    struct snd_ctl_elem_list32 __user *data32)
37
24
 {
38
-	struct snd_ctl_elem_list __user *data;
25
+	struct snd_ctl_elem_list data = {};
39
26
 	compat_caddr_t ptr;
40
27
 	int err;
41
28
 
42
-	data = compat_alloc_user_space(sizeof(*data));
43
-
44
29
 	/* offset, space, used, count */
45
-	if (copy_in_user(data, data32, 4 * sizeof(u32)))
30
+	if (copy_from_user(&data, data32, 4 * sizeof(u32)))
46
31
 		return -EFAULT;
47
32
 	/* pids */
48
-	if (get_user(ptr, &data32->pids) ||
49
-	    put_user(compat_ptr(ptr), &data->pids))
33
+	if (get_user(ptr, &data32->pids))
50
34
 		return -EFAULT;
51
-	err = snd_ctl_elem_list(card, data);
35
+	data.pids = compat_ptr(ptr);
36
+	err = snd_ctl_elem_list(card, &data);
52
37
 	if (err < 0)
53
38
 		return err;
54
39
 	/* copy the result */
55
-	if (copy_in_user(data32, data, 4 * sizeof(u32)))
40
+	if (copy_to_user(data32, &data, 4 * sizeof(u32)))
56
41
 		return -EFAULT;
57
42
 	return 0;
58
43
 }
..
..
@@ -236,7 +221,7 @@
236
221
 {
237
222
 	struct snd_ctl_elem_value32 __user *data32 = userdata;
238
223
 	int i, type, size;
239
-	int uninitialized_var(count);
224
+	int count;
240
225
 	unsigned int indirect;
241
226
 
242
227
 	if (copy_from_user(&data->id, &data32->id, sizeof(data->id)))
..
..
@@ -319,7 +304,9 @@
319
304
 	err = snd_power_wait(card, SNDRV_CTL_POWER_D0);
320
305
 	if (err < 0)
321
306
 		goto error;
307
+	down_read(&card->controls_rwsem);
322
308
 	err = snd_ctl_elem_read(card, data);
309
+	up_read(&card->controls_rwsem);
323
310
 	if (err < 0)
324
311
 		goto error;
325
312
 	err = copy_ctl_value_to_user(userdata, valuep, data, type, count);
..
..
@@ -347,7 +334,9 @@
347
334
 	err = snd_power_wait(card, SNDRV_CTL_POWER_D0);
348
335
 	if (err < 0)
349
336
 		goto error;
337
+	down_write(&card->controls_rwsem);
350
338
 	err = snd_ctl_elem_write(card, file, data);
339
+	up_write(&card->controls_rwsem);
351
340
 	if (err < 0)
352
341
 		goto error;
353
342
 	err = copy_ctl_value_to_user(userdata, valuep, data, type, count);