From: Clemens Ladisch <clemens@ladisch.de>
Date: Mon, 17 Aug 2009 10:28:09 +0000 (+0200)
Subject: sound: snd_ctl_remove_user_ctl: prevent removal of kernel controls
X-Git-Tag: v2.6.32-rc3~9^2~32^2
X-Git-Url: http://ftp.safe.ca/?p=safe%2Fjmp%2Flinux-2.6;a=commitdiff_plain;h=18dd0aa5afea7dc33953aa87de696e39074bbf78

sound: snd_ctl_remove_user_ctl: prevent removal of kernel controls

Ensure that userspace can remove only user controls.  Controls created
by kernel drivers must not be removed because they might be referenced
in calls to snd_ctl_notify().

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---

diff --git a/sound/core/control.c b/sound/core/control.c
index bc64b72..a8b7fab 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -436,6 +436,10 @@ static int snd_ctl_remove_user_ctl(struct snd_ctl_file * file,
 		ret = -ENOENT;
 		goto error;
 	}
+	if (!(kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_USER)) {
+		ret = -EINVAL;
+		goto error;
+	}
 	for (idx = 0; idx < kctl->count; idx++)
 		if (kctl->vd[idx].owner != NULL && kctl->vd[idx].owner != file) {
 			ret = -EBUSY;