X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=sound%2Foss%2Femu10k1%2Fpassthrough.c;h=6d21d4368decbe08aef8cdfd5c6745d7122c2bc1;hb=refs%2Fheads%2Fvserver;hp=805840eb13601bce8b4efee181686ee9525f4216;hpb=5273a3df6485dc2ad6aa7ddd441b9a21970f003b;p=linux-2.6.git

diff --git a/sound/oss/emu10k1/passthrough.c b/sound/oss/emu10k1/passthrough.c
index 805840eb1..6d21d4368 100644
--- a/sound/oss/emu10k1/passthrough.c
+++ b/sound/oss/emu10k1/passthrough.c
@@ -131,7 +131,7 @@ int emu10k1_pt_setup(struct emu10k1_wavedevice *wave_dev)
 	return 0;
 }
 
-ssize_t emu10k1_pt_write(struct file *file, const char *buffer, size_t count)
+ssize_t emu10k1_pt_write(struct file *file, const char __user *buffer, size_t count)
 {
 	struct emu10k1_wavedevice *wave_dev = (struct emu10k1_wavedevice *) file->private_data;
 	struct emu10k1_card *card = wave_dev->card;
@@ -162,12 +162,15 @@ ssize_t emu10k1_pt_write(struct file *file, const char *buffer, size_t count)
 
 		DPD(3, "prepend size %d, prepending %d bytes\n", pt->prepend_size, needed);
 		if (count < needed) {
-			copy_from_user(pt->buf + pt->prepend_size, buffer, count);
+			if (copy_from_user(pt->buf + pt->prepend_size,
+					   buffer, count))
+				return -EFAULT;
 			pt->prepend_size += count;
 			DPD(3, "prepend size now %d\n", pt->prepend_size);
 			return count;
 		}
-		copy_from_user(pt->buf + pt->prepend_size, buffer, needed);
+		if (copy_from_user(pt->buf + pt->prepend_size, buffer, needed))
+			return -EFAULT;
 		r = pt_putblock(wave_dev, (u16 *) pt->buf, nonblock);
 		if (r)
 			return r;
@@ -177,10 +180,10 @@ ssize_t emu10k1_pt_write(struct file *file, const char *buffer, size_t count)
 	blocks = (count-bytes_copied)/PT_BLOCKSIZE;
 	blocks_copied = 0;
 	while (blocks > 0) {
-		u16 *bufptr = (u16 *) buffer + (bytes_copied/2);
-		copy_from_user(pt->buf, bufptr, PT_BLOCKSIZE);
-		bufptr = (u16 *) pt->buf;
-		r = pt_putblock(wave_dev, bufptr, nonblock);
+		u16 __user *bufptr = (u16 __user *) buffer + (bytes_copied/2);
+		if (copy_from_user(pt->buf, bufptr, PT_BLOCKSIZE))
+			return -EFAULT;
+		r = pt_putblock(wave_dev, (u16 *)pt->buf, nonblock);
 		if (r) {
 			if (bytes_copied)
 				return bytes_copied;
@@ -194,7 +197,8 @@ ssize_t emu10k1_pt_write(struct file *file, const char *buffer, size_t count)
 	i = count - bytes_copied;
 	if (i) {
 		pt->prepend_size = i;
-		copy_from_user(pt->buf, buffer + bytes_copied, i);
+		if (copy_from_user(pt->buf, buffer + bytes_copied, i))
+			return -EFAULT;
 		bytes_copied += i;
 		DPD(3, "filling prepend buffer with %d bytes", i);
 	}
@@ -214,8 +218,7 @@ void emu10k1_pt_stop(struct emu10k1_card *card)
 				sblive_writeptr(card, SPCS0 + i, 0, pt->old_spcs[i]);
 		}
 		pt->state = PT_STATE_INACTIVE;
-		if(pt->buf)
-			kfree(pt->buf);
+		kfree(pt->buf);
 	}
 }