From 446bd647ceee73fbed50404daece9cbcec751f66 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 28 Dec 2017 16:30:22 -0500 Subject: snd_hwdep_dsp_load(): don't bother with access_ok() the only remaining instance of ->dsp_load() doesn't need it. Signed-off-by: Al Viro --- sound/core/hwdep.c | 2 -- 1 file changed, 2 deletions(-) (limited to 'sound/core') diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c index 8faae3d1455d..25b8f2234fc7 100644 --- a/sound/core/hwdep.c +++ b/sound/core/hwdep.c @@ -233,8 +233,6 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw, /* check whether the dsp was already loaded */ if (hw->dsp_loaded & (1 << info.index)) return -EBUSY; - if (!access_ok(VERIFY_READ, info.image, info.length)) - return -EFAULT; err = hw->ops.dsp_load(hw, &info); if (err < 0) return err; -- cgit v1.2.3 From 88a890375fa2fd9b54083979403243ab24a3ca35 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 7 Jan 2018 13:09:15 -0500 Subject: replace_user_tlv(): switch to vmemdup_user() Signed-off-by: Al Viro --- sound/core/control.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'sound/core') diff --git a/sound/core/control.c b/sound/core/control.c index 56b3e2d49c82..eaef67bd004b 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -25,6 +25,7 @@ #include #include #include +#include #include #include #include @@ -1129,7 +1130,7 @@ static int replace_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf, if (size > 1024 * 128) /* sane value */ return -EINVAL; - container = memdup_user(buf, size); + container = vmemdup_user(buf, size); if (IS_ERR(container)) return PTR_ERR(container); @@ -1137,7 +1138,7 @@ static int replace_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf, if (!change) change = memcmp(ue->tlv_data, container, size) != 0; if (!change) { - kfree(container); + kvfree(container); return 0; } @@ -1148,7 +1149,7 @@ static int replace_user_tlv(struct snd_kcontrol *kctl, unsigned int __user *buf, mask = SNDRV_CTL_EVENT_MASK_INFO; } - kfree(ue->tlv_data); + kvfree(ue->tlv_data); ue->tlv_data = container; ue->tlv_data_size = size; @@ -1225,7 +1226,7 @@ static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol) { struct user_element *ue = kcontrol->private_data; - kfree(ue->tlv_data); + kvfree(ue->tlv_data); kfree(ue->priv_data); kfree(ue); } -- cgit v1.2.3 From 59aeaf3fef9dcf59dc595390dd5b89dfedcb8926 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 7 Jan 2018 13:11:03 -0500 Subject: snd_ctl_elem_init_enum_names(): switch to vmemdup_user() Signed-off-by: Al Viro --- sound/core/control.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'sound/core') diff --git a/sound/core/control.c b/sound/core/control.c index eaef67bd004b..d16b53d0547c 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -1198,7 +1198,7 @@ static int snd_ctl_elem_init_enum_names(struct user_element *ue) if (ue->info.value.enumerated.names_length > 64 * 1024) return -EINVAL; - names = memdup_user((const void __user *)user_ptrval, + names = vmemdup_user((const void __user *)user_ptrval, ue->info.value.enumerated.names_length); if (IS_ERR(names)) return PTR_ERR(names); @@ -1209,7 +1209,7 @@ static int snd_ctl_elem_init_enum_names(struct user_element *ue) for (i = 0; i < ue->info.value.enumerated.items; ++i) { name_len = strnlen(p, buf_len); if (name_len == 0 || name_len >= 64 || name_len == buf_len) { - kfree(names); + kvfree(names); return -EINVAL; } p += name_len + 1; @@ -1227,7 +1227,7 @@ static void snd_ctl_elem_user_free(struct snd_kcontrol *kcontrol) struct user_element *ue = kcontrol->private_data; kvfree(ue->tlv_data); - kfree(ue->priv_data); + kvfree(ue->priv_data); kfree(ue); } -- cgit v1.2.3