diff options
Diffstat (limited to 'sound/core')
| -rw-r--r-- | sound/core/control.c | 4 | ||||
| -rw-r--r-- | sound/core/hwdep.c | 9 |
2 files changed, 10 insertions, 3 deletions
diff --git a/sound/core/control.c b/sound/core/control.c index 49721f5a2ee..819a5c579a3 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -1082,12 +1082,12 @@ static int snd_ctl_elem_init_enum_names(struct user_element *ue) char *names, *p; size_t buf_len, name_len; unsigned int i; + const uintptr_t user_ptrval = ue->info.value.enumerated.names_ptr; if (ue->info.value.enumerated.names_length > 64 * 1024) return -EINVAL; - names = memdup_user( - (const void __user *)ue->info.value.enumerated.names_ptr, + names = memdup_user((const void __user *)user_ptrval, ue->info.value.enumerated.names_length); if (IS_ERR(names)) return PTR_ERR(names); diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c index c7ceb28d885..75ea16f35b1 100644 --- a/sound/core/hwdep.c +++ b/sound/core/hwdep.c @@ -273,7 +273,14 @@ static int snd_hwdep_control_ioctl(struct snd_card *card, if (get_user(device, (int __user *)arg)) return -EFAULT; mutex_lock(®ister_mutex); - device = device < 0 ? 0 : device + 1; + + if (device < 0) + device = 0; + else if (device < SNDRV_MINOR_HWDEPS) + device++; + else + device = SNDRV_MINOR_HWDEPS; + while (device < SNDRV_MINOR_HWDEPS) { if (snd_hwdep_search(card, device)) break; |