forked from Minki/linux
V4L/DVB: media/radio: fix copy_to_user to user handling
copy_to/from_user() returns the number of bytes remaining to be copied but the code here was testing for negative returns. I modified it to return -EFAULT. These functions are called from si4713_s_ext_ctrls() and that only tests for negative error codes. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
parent
398630e4ed
commit
aac870a877
@ -1009,8 +1009,10 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev,
|
|||||||
goto exit;
|
goto exit;
|
||||||
}
|
}
|
||||||
rval = copy_from_user(ps_name, control->string, len);
|
rval = copy_from_user(ps_name, control->string, len);
|
||||||
if (rval < 0)
|
if (rval) {
|
||||||
|
rval = -EFAULT;
|
||||||
goto exit;
|
goto exit;
|
||||||
|
}
|
||||||
ps_name[len] = '\0';
|
ps_name[len] = '\0';
|
||||||
|
|
||||||
if (strlen(ps_name) % vqc.step) {
|
if (strlen(ps_name) % vqc.step) {
|
||||||
@ -1031,8 +1033,10 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev,
|
|||||||
goto exit;
|
goto exit;
|
||||||
}
|
}
|
||||||
rval = copy_from_user(radio_text, control->string, len);
|
rval = copy_from_user(radio_text, control->string, len);
|
||||||
if (rval < 0)
|
if (rval) {
|
||||||
|
rval = -EFAULT;
|
||||||
goto exit;
|
goto exit;
|
||||||
|
}
|
||||||
radio_text[len] = '\0';
|
radio_text[len] = '\0';
|
||||||
|
|
||||||
if (strlen(radio_text) % vqc.step) {
|
if (strlen(radio_text) % vqc.step) {
|
||||||
@ -1367,6 +1371,8 @@ static int si4713_read_econtrol_string(struct si4713_device *sdev,
|
|||||||
}
|
}
|
||||||
rval = copy_to_user(control->string, sdev->rds_info.ps_name,
|
rval = copy_to_user(control->string, sdev->rds_info.ps_name,
|
||||||
strlen(sdev->rds_info.ps_name) + 1);
|
strlen(sdev->rds_info.ps_name) + 1);
|
||||||
|
if (rval)
|
||||||
|
rval = -EFAULT;
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case V4L2_CID_RDS_TX_RADIO_TEXT:
|
case V4L2_CID_RDS_TX_RADIO_TEXT:
|
||||||
@ -1377,6 +1383,8 @@ static int si4713_read_econtrol_string(struct si4713_device *sdev,
|
|||||||
}
|
}
|
||||||
rval = copy_to_user(control->string, sdev->rds_info.radio_text,
|
rval = copy_to_user(control->string, sdev->rds_info.radio_text,
|
||||||
strlen(sdev->rds_info.radio_text) + 1);
|
strlen(sdev->rds_info.radio_text) + 1);
|
||||||
|
if (rval)
|
||||||
|
rval = -EFAULT;
|
||||||
break;
|
break;
|
||||||
|
|
||||||
default:
|
default:
|
||||||
|
Loading…
Reference in New Issue
Block a user