fedora core 6 1.2949 + vserver 2.2.0

[linux-2.6.git] / sound / oss / emu10k1 / passthrough.c

diff --git a/sound/oss/emu10k1/passthrough.c b/sound/oss/emu10k1/passthrough.c
index 805840e..6d21d43 100644 (file)
--- a/sound/oss/emu10k1/passthrough.c
+++ b/sound/oss/emu10k1/passthrough.c
@@ -131,7 +131,7 @@ int emu10k1_pt_setup(struct emu10k1_wavedevice *wave_dev)
        return 0;
 }
 
-ssize_t emu10k1_pt_write(struct file *file, const char *buffer, size_t count)
+ssize_t emu10k1_pt_write(struct file *file, const char __user *buffer, size_t count)
 {
        struct emu10k1_wavedevice *wave_dev = (struct emu10k1_wavedevice *) file->private_data;
        struct emu10k1_card *card = wave_dev->card;
@@ -162,12 +162,15 @@ ssize_t emu10k1_pt_write(struct file *file, const char *buffer, size_t count)
 
                DPD(3, "prepend size %d, prepending %d bytes\n", pt->prepend_size, needed);
                if (count < needed) {
-                       copy_from_user(pt->buf + pt->prepend_size, buffer, count);
+                       if (copy_from_user(pt->buf + pt->prepend_size,
+                                          buffer, count))
+                               return -EFAULT;
                        pt->prepend_size += count;
                        DPD(3, "prepend size now %d\n", pt->prepend_size);
                        return count;
                }
-               copy_from_user(pt->buf + pt->prepend_size, buffer, needed);
+               if (copy_from_user(pt->buf + pt->prepend_size, buffer, needed))
+                       return -EFAULT;
                r = pt_putblock(wave_dev, (u16 *) pt->buf, nonblock);
                if (r)
                        return r;
@@ -177,10 +180,10 @@ ssize_t emu10k1_pt_write(struct file *file, const char *buffer, size_t count)
        blocks = (count-bytes_copied)/PT_BLOCKSIZE;
        blocks_copied = 0;
        while (blocks > 0) {
-               u16 *bufptr = (u16 *) buffer + (bytes_copied/2);
-               copy_from_user(pt->buf, bufptr, PT_BLOCKSIZE);
-               bufptr = (u16 *) pt->buf;
-               r = pt_putblock(wave_dev, bufptr, nonblock);
+               u16 __user *bufptr = (u16 __user *) buffer + (bytes_copied/2);
+               if (copy_from_user(pt->buf, bufptr, PT_BLOCKSIZE))
+                       return -EFAULT;
+               r = pt_putblock(wave_dev, (u16 *)pt->buf, nonblock);
                if (r) {
                        if (bytes_copied)
                                return bytes_copied;
@@ -194,7 +197,8 @@ ssize_t emu10k1_pt_write(struct file *file, const char *buffer, size_t count)
        i = count - bytes_copied;
        if (i) {
                pt->prepend_size = i;
-               copy_from_user(pt->buf, buffer + bytes_copied, i);
+               if (copy_from_user(pt->buf, buffer + bytes_copied, i))
+                       return -EFAULT;
                bytes_copied += i;
                DPD(3, "filling prepend buffer with %d bytes", i);
        }
@@ -214,8 +218,7 @@ void emu10k1_pt_stop(struct emu10k1_card *card)
                                sblive_writeptr(card, SPCS0 + i, 0, pt->old_spcs[i]);
                }
                pt->state = PT_STATE_INACTIVE;
-               if(pt->buf)
-                       kfree(pt->buf);
+               kfree(pt->buf);
        }
 }