Ramirez Luna, Omar had written, on 01/11/2010 02:12 PM, the following:
[...]
diff --git a/drivers/dsp/bridge/pmgr/wcd.c b/drivers/dsp/bridge/pmgr/wcd.c
index 02def74..f52b7b8 100644
--- a/drivers/dsp/bridge/pmgr/wcd.c
+++ b/drivers/dsp/bridge/pmgr/wcd.c
[...]
static inline void __cp_fm_usr(void *to, const void __user *from,
@@ -273,13 +286,48 @@ static inline void __cp_to_usr(void __user *to, const void *from,
inline DSP_STATUS WCD_CallDevIOCtl(u32 cmd, union Trapped_Args *args,
u32 *result, void *pr_ctxt)
{
- if (cmd < ARRAY_SIZE(WCD_cmdTable)) {
- /* make the fxn call via the cmd table */
- *result = (*WCD_cmdTable[cmd].fxn) (args, pr_ctxt);
- return DSP_SOK;
+ u32(*ioctl_cmd)(union Trapped_Args *args, void *pr_ctxt);
+ int i;
+
+ if (_IOC_TYPE(cmd) != DB) {
+ pr_err("%s: Incompatible dspbridge ioctl number\n", __func__);
+ goto err;
}
- return DSP_EINVALIDARG;
+ /* Retrieve the fxn via the cmd table */
+ i = cmd & DB_IOC_MASK;
+ switch (cmd & DB_MODULE_MASK) {
+ case DB_MGR:
+ ioctl_cmd = mgr_cmd[i].fxn;
just realized we have a risk here. if i > sizeof(mgr_cmd), then we will
not catch the out of range error.
[...]
--
Regards,
Nishanth Menon
--
To unsubscribe from this list: send the line "unsubscribe linux-omap" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
