ALSA: control: Fix memory corruption risk in snd_ctl_elem_read

[sfrench/cifs-2.6.git] / sound / core / control.c

diff --git a/sound/core/control.c b/sound/core/control.c
index 50fa16022f1fe67eb88881f2a8f4d4544934ea90..8a77620a38548ef8ad36d5b9bf154a14a785f568 100644 (file)
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -889,7 +889,7 @@ static int snd_ctl_elem_read(struct snd_card *card,
 
        index_offset = snd_ctl_get_ioff(kctl, &control->id);
        vd = &kctl->vd[index_offset];
-       if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) && kctl->get == NULL)
+       if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL)
                return -EPERM;
 
        snd_ctl_build_ioff(&control->id, kctl, index_offset);
@@ -1679,7 +1679,7 @@ static __poll_t snd_ctl_poll(struct file *file, poll_table * wait)
 
        mask = 0;
        if (!list_empty(&ctl->events))
-               mask |= POLLIN | POLLRDNORM;
+               mask |= EPOLLIN | EPOLLRDNORM;
 
        return mask;
 }