summaryrefslogtreecommitdiff
path: root/sound/drivers
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2010-04-13 11:33:54 +0200
committerTakashi Iwai <tiwai@suse.de>2010-04-13 12:01:14 +0200
commitd97e1b78239c7e7e441088e0b644bd3b076002e6 (patch)
treeb05b5085bea932662ce60061d5b4b93834683327 /sound/drivers
parent24e4a1211f691fc671de44685430dbad757d8487 (diff)
downloadlinux-3.10-d97e1b78239c7e7e441088e0b644bd3b076002e6.tar.gz
linux-3.10-d97e1b78239c7e7e441088e0b644bd3b076002e6.tar.bz2
linux-3.10-d97e1b78239c7e7e441088e0b644bd3b076002e6.zip
ALSA: info - Check file position validity in common layer
Check the validity of the file position in the common info layer before calling read or write callbacks in assumption that entry->size is set up properly to indicate the max file size. Removed the redundant checks from the callbacks as well. Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/drivers')
-rw-r--r--sound/drivers/opl4/opl4_proc.c46
1 files changed, 16 insertions, 30 deletions
diff --git a/sound/drivers/opl4/opl4_proc.c b/sound/drivers/opl4/opl4_proc.c
index eb72814dfd5..210b89de06d 100644
--- a/sound/drivers/opl4/opl4_proc.c
+++ b/sound/drivers/opl4/opl4_proc.c
@@ -55,25 +55,18 @@ static ssize_t snd_opl4_mem_proc_read(struct snd_info_entry *entry,
size_t count, loff_t pos)
{
struct snd_opl4 *opl4 = entry->private_data;
- long size;
char* buf;
- size = count;
- if (pos + size > entry->size)
- size = entry->size - pos;
- if (size > 0) {
- buf = vmalloc(size);
- if (!buf)
- return -ENOMEM;
- snd_opl4_read_memory(opl4, buf, pos, size);
- if (copy_to_user(_buf, buf, size)) {
- vfree(buf);
- return -EFAULT;
- }
+ buf = vmalloc(count);
+ if (!buf)
+ return -ENOMEM;
+ snd_opl4_read_memory(opl4, buf, pos, count);
+ if (copy_to_user(_buf, buf, count)) {
vfree(buf);
- return size;
+ return -EFAULT;
}
- return 0;
+ vfree(buf);
+ return count;
}
static ssize_t snd_opl4_mem_proc_write(struct snd_info_entry *entry,
@@ -83,25 +76,18 @@ static ssize_t snd_opl4_mem_proc_write(struct snd_info_entry *entry,
size_t count, size_t pos)
{
struct snd_opl4 *opl4 = entry->private_data;
- long size;
char *buf;
- size = count;
- if (pos + size > entry->size)
- size = entry->size - pos;
- if (size > 0) {
- buf = vmalloc(size);
- if (!buf)
- return -ENOMEM;
- if (copy_from_user(buf, _buf, size)) {
- vfree(buf);
- return -EFAULT;
- }
- snd_opl4_write_memory(opl4, buf, pos, size);
+ buf = vmalloc(count);
+ if (!buf)
+ return -ENOMEM;
+ if (copy_from_user(buf, _buf, count)) {
vfree(buf);
- return size;
+ return -EFAULT;
}
- return 0;
+ snd_opl4_write_memory(opl4, buf, pos, count);
+ vfree(buf);
+ return count;
}
static loff_t snd_opl4_mem_proc_llseek(struct snd_info_entry *entry,