diff options
| author | Iliyan Malchev <malchev@google.com> | 2010-09-30 19:18:16 -0700 |
|---|---|---|
| committer | Dima Zavin <dima@android.com> | 2011-01-04 18:10:25 -0800 |
| commit | 73dc8051f251f76541fb18135b8110d7eed5fd6d (patch) | |
| tree | 87d366d132790d38e5a5c0f9766d5239c4285fe6 | |
| parent | e1b8c41d955ada77c04cdf0e91f055197346032d (diff) | |
| download | experimental-73dc8051f251f76541fb18135b8110d7eed5fd6d.tar.gz | |
[ARM] msm8k: fixes for audio_ctl and pcm_out
-- q6_ioctl was not doing proper checks on user data
-- pcm_ioctl would crash if AUDIO_SET_VOUME got called before AUDIO_START
Signed-off-by: Iliyan Malchev <malchev@google.com>
| -rw-r--r-- | arch/arm/mach-msm/qdsp6/audio_ctl.c | 30 | ||||
| -rw-r--r-- | arch/arm/mach-msm/qdsp6/pcm_out.c | 6 |
2 files changed, 29 insertions, 7 deletions
diff --git a/arch/arm/mach-msm/qdsp6/audio_ctl.c b/arch/arm/mach-msm/qdsp6/audio_ctl.c index 5f9f317babb..170b3eb10f6 100644 --- a/arch/arm/mach-msm/qdsp6/audio_ctl.c +++ b/arch/arm/mach-msm/qdsp6/audio_ctl.c @@ -90,28 +90,40 @@ static int q6_ioctl(struct inode *inode, struct file *file, switch (cmd) { case AUDIO_SWITCH_DEVICE: rc = copy_from_user(&id, (void *)arg, sizeof(id)); - if (!rc) + if (rc) { + pr_err("%s: bad user address\n", __func__); + rc = -EFAULT; + } else rc = q6audio_do_routing(id[0], id[1]); break; case AUDIO_SET_VOLUME: rc = copy_from_user(&n, (void *)arg, sizeof(n)); - if (!rc) + if (rc) { + pr_err("%s: bad user address\n", __func__); + rc = -EFAULT; + } else rc = q6audio_set_rx_volume(n); break; case AUDIO_SET_MUTE: rc = copy_from_user(&n, (void *)arg, sizeof(n)); - if (!rc) + if (rc) { + pr_err("%s: bad user address\n", __func__); + rc = -EFAULT; + } else rc = q6audio_set_tx_mute(n); break; case AUDIO_UPDATE_ACDB: rc = copy_from_user(&id, (void *)arg, sizeof(id)); - if (!rc) + if (rc) { + pr_err("%s: bad user address\n", __func__); + rc = -EFAULT; + } else rc = q6audio_update_acdb(id[0], id[1]); break; case AUDIO_START_VOICE: - if (arg == 0) { + if (arg == 0) id[0] = id[1] = 0; - } else if (copy_from_user(&id, (void*) arg, sizeof(id))) { + else if (copy_from_user(&id, (void *)arg, sizeof(id))) { pr_info("voice: copy acdb_id from user failed\n"); rc = -EFAULT; break; @@ -123,10 +135,14 @@ static int q6_ioctl(struct inode *inode, struct file *file, break; case AUDIO_REINIT_ACDB: rc = copy_from_user(&filename, (void *)arg, sizeof(filename)); - if (!rc) + if (rc) { + pr_err("%s: bad user address\n", __func__); + rc = -EFAULT; + } else rc = q6audio_reinit_acdb(filename); break; default: + pr_info("%s: unknown %d\n", __func__, cmd); rc = -EINVAL; } diff --git a/arch/arm/mach-msm/qdsp6/pcm_out.c b/arch/arm/mach-msm/qdsp6/pcm_out.c index 11221686566..6d041d8c686 100644 --- a/arch/arm/mach-msm/qdsp6/pcm_out.c +++ b/arch/arm/mach-msm/qdsp6/pcm_out.c @@ -56,6 +56,12 @@ static long pcm_ioctl(struct file *file, unsigned int cmd, unsigned long arg) switch (cmd) { case AUDIO_SET_VOLUME: { int vol; + if (!pcm->ac) { + pr_err("%s: cannot set volume before AUDIO_START!\n", + __func__); + rc = -EINVAL; + break; + } if (copy_from_user(&vol, (void*) arg, sizeof(vol))) { rc = -EFAULT; break; |