diff mbox

ASoC: Intel: Skylake: pointer math issue

Message ID 20151208055321.GA5597@mwanda (mailing list archive)
State Accepted
Commit e8bc3c99fa982f616e74aec4445945400a9c56f3
Headers show

Commit Message

Dan Carpenter Dec. 8, 2015, 5:53 a.m. UTC 
"data" is a u32 pointer so this copies the information to wrong place
entirely.

Fixes: 140adfba5280 ('ASoC: Intel: Skylake: Add tlv byte kcontrols')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Vinod Koul Dec. 9, 2015, 4:02 p.m. UTC | #1 
On Tue, Dec 08, 2015 at 08:53:22AM +0300, Dan Carpenter wrote:
> "data" is a u32 pointer so this copies the information to wrong place
> entirely.

Thanks this patch makes sense, I will test this tomorrow and get back

> 
> Fixes: 140adfba5280 ('ASoC: Intel: Skylake: Add tlv byte kcontrols')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
> index dde8d3c..2c4405e 100644
> --- a/sound/soc/intel/skylake/skl-topology.c
> +++ b/sound/soc/intel/skylake/skl-topology.c
> @@ -885,9 +885,9 @@ static int skl_tplg_tlv_control_get(struct snd_kcontrol *kcontrol,
>  	if (bc->params) {
>  		if (copy_to_user(data, &bc->param_id, sizeof(u32)))
>  			return -EFAULT;
> -		if (copy_to_user(data + sizeof(u32), &size, sizeof(u32)))
> +		if (copy_to_user(data + 1, &size, sizeof(u32)))
>  			return -EFAULT;
> -		if (copy_to_user(data + 2 * sizeof(u32), bc->params, size))
> +		if (copy_to_user(data + 2, bc->params, size))
>  			return -EFAULT;
>  	}
>
Vinod Koul Dec. 16, 2015, 2:41 p.m. UTC | #2 
On Wed, Dec 09, 2015 at 09:32:13PM +0530, Vinod Koul wrote:
> On Tue, Dec 08, 2015 at 08:53:22AM +0300, Dan Carpenter wrote:
> > "data" is a u32 pointer so this copies the information to wrong place
> > entirely.
> 
> Thanks this patch makes sense, I will test this tomorrow and get back

Sorry this took a little while longer but this works

Acked-by: Vinod Koul <vinod.koul@intel.com>
Tested-by: Dharageswari R <dharageswari.r@intel.com>


> > 
> > Fixes: 140adfba5280 ('ASoC: Intel: Skylake: Add tlv byte kcontrols')
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > 
> > diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
> > index dde8d3c..2c4405e 100644
> > --- a/sound/soc/intel/skylake/skl-topology.c
> > +++ b/sound/soc/intel/skylake/skl-topology.c
> > @@ -885,9 +885,9 @@ static int skl_tplg_tlv_control_get(struct snd_kcontrol *kcontrol,
> >  	if (bc->params) {
> >  		if (copy_to_user(data, &bc->param_id, sizeof(u32)))
> >  			return -EFAULT;
> > -		if (copy_to_user(data + sizeof(u32), &size, sizeof(u32)))
> > +		if (copy_to_user(data + 1, &size, sizeof(u32)))
> >  			return -EFAULT;
> > -		if (copy_to_user(data + 2 * sizeof(u32), bc->params, size))
> > +		if (copy_to_user(data + 2, bc->params, size))
> >  			return -EFAULT;
> >  	}
> >  
> 
> -- 
> ~Vinod
diff mbox

Patch

diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index dde8d3c..2c4405e 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -885,9 +885,9 @@  static int skl_tplg_tlv_control_get(struct snd_kcontrol *kcontrol,
 	if (bc->params) {
 		if (copy_to_user(data, &bc->param_id, sizeof(u32)))
 			return -EFAULT;
-		if (copy_to_user(data + sizeof(u32), &size, sizeof(u32)))
+		if (copy_to_user(data + 1, &size, sizeof(u32)))
 			return -EFAULT;
-		if (copy_to_user(data + 2 * sizeof(u32), bc->params, size))
+		if (copy_to_user(data + 2, bc->params, size))
 			return -EFAULT;
 	}