diff options
| author | David S. Miller <davem@davemloft.net> | 2016-11-15 10:54:36 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-11-15 10:54:36 -0500 |
| commit | bb598c1b8c9bf56981927dcb8c0dc34b8ff95342 (patch) | |
| tree | 69fe6d3bcdbf0acb76e42b144d8af5a0234ccdcb /sound/core/info.c | |
| parent | eb2ca35f1814dad3ca547261eedfbbd0d65a0efc (diff) | |
| parent | e76d21c40bd6c67fd4e2c1540d77e113df962b4d (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Several cases of bug fixes in 'net' overlapping other changes in
'net-next-.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'sound/core/info.c')
| -rw-r--r-- | sound/core/info.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/sound/core/info.c b/sound/core/info.c index 895362a696c9..8ab72e0f5932 100644 --- a/sound/core/info.c +++ b/sound/core/info.c @@ -325,10 +325,15 @@ static ssize_t snd_info_text_entry_write(struct file *file, size_t next; int err = 0; + if (!entry->c.text.write) + return -EIO; pos = *offset; if (!valid_pos(pos, count)) return -EIO; next = pos + count; + /* don't handle too large text inputs */ + if (next > 16 * 1024) + return -EIO; mutex_lock(&entry->access); buf = data->wbuffer; if (!buf) { @@ -366,7 +371,9 @@ static int snd_info_seq_show(struct seq_file *seq, void *p) struct snd_info_private_data *data = seq->private; struct snd_info_entry *entry = data->entry; - if (entry->c.text.read) { + if (!entry->c.text.read) { + return -EIO; + } else { data->rbuffer->buffer = (char *)seq; /* XXX hack! */ entry->c.text.read(entry, data->rbuffer); } |