diff options
| author |   Clemens Ladisch <clemens@ladisch.de> | 2009-08-17 12:28:09 +0200 |
|---|---|---|
| committer |   Takashi Iwai <tiwai@suse.de> | 2009-08-17 12:48:21 +0200 |
| commit | 18dd0aa5afea7dc33953aa87de696e39074bbf78 (patch) | |
| tree | 59c3304f340c8ba180002c99c8961b388bf84fb0 /sound/core/control.c | |
| parent | sound: snd_ctl_remove_unlocked_id: simplify user control counting (diff) | |
| download | linux-dev-18dd0aa5afea7dc33953aa87de696e39074bbf78.tar.xz linux-dev-18dd0aa5afea7dc33953aa87de696e39074bbf78.zip | |
sound: snd_ctl_remove_user_ctl: prevent removal of kernel controls
Ensure that userspace can remove only user controls. Controls created
by kernel drivers must not be removed because they might be referenced
in calls to snd_ctl_notify().
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/core/control.c')
| -rw-r--r-- | sound/core/control.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sound/core/control.c b/sound/core/control.c index bc64b723415b..a8b7fabe645e 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -436,6 +436,10 @@ static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file, ret = -ENOENT; goto error; } + if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER)) { + ret = -EINVAL; + goto error; + } for (idx = 0; idx < kctl->count; idx++) if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file) { ret = -EBUSY; |