提交 aac870a8 编写于 作者: D Dan Carpenter 提交者: Mauro Carvalho Chehab

V4L/DVB: media/radio: fix copy_to_user to user handling

copy_to/from_user() returns the number of bytes remaining to be copied
but the code here was testing for negative returns.  I modified it to
return -EFAULT.  These functions are called from si4713_s_ext_ctrls() and
that only tests for negative error codes.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
上级 398630e4
...@@ -1009,8 +1009,10 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev, ...@@ -1009,8 +1009,10 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev,
goto exit; goto exit;
} }
rval = copy_from_user(ps_name, control->string, len); rval = copy_from_user(ps_name, control->string, len);
if (rval < 0) if (rval) {
rval = -EFAULT;
goto exit; goto exit;
}
ps_name[len] = '\0'; ps_name[len] = '\0';
if (strlen(ps_name) % vqc.step) { if (strlen(ps_name) % vqc.step) {
...@@ -1031,8 +1033,10 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev, ...@@ -1031,8 +1033,10 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev,
goto exit; goto exit;
} }
rval = copy_from_user(radio_text, control->string, len); rval = copy_from_user(radio_text, control->string, len);
if (rval < 0) if (rval) {
rval = -EFAULT;
goto exit; goto exit;
}
radio_text[len] = '\0'; radio_text[len] = '\0';
if (strlen(radio_text) % vqc.step) { if (strlen(radio_text) % vqc.step) {
...@@ -1367,6 +1371,8 @@ static int si4713_read_econtrol_string(struct si4713_device *sdev, ...@@ -1367,6 +1371,8 @@ static int si4713_read_econtrol_string(struct si4713_device *sdev,
} }
rval = copy_to_user(control->string, sdev->rds_info.ps_name, rval = copy_to_user(control->string, sdev->rds_info.ps_name,
strlen(sdev->rds_info.ps_name) + 1); strlen(sdev->rds_info.ps_name) + 1);
if (rval)
rval = -EFAULT;
break; break;
case V4L2_CID_RDS_TX_RADIO_TEXT: case V4L2_CID_RDS_TX_RADIO_TEXT:
...@@ -1377,6 +1383,8 @@ static int si4713_read_econtrol_string(struct si4713_device *sdev, ...@@ -1377,6 +1383,8 @@ static int si4713_read_econtrol_string(struct si4713_device *sdev,
} }
rval = copy_to_user(control->string, sdev->rds_info.radio_text, rval = copy_to_user(control->string, sdev->rds_info.radio_text,
strlen(sdev->rds_info.radio_text) + 1); strlen(sdev->rds_info.radio_text) + 1);
if (rval)
rval = -EFAULT;
break; break;
default: default:
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册