ALSA: seq: fix to copy from/to user space

When checking value of request for copy operation, current implementation
compares shifted value to macros, while these macros are already shifted.
As a result, it never performs to copy from/to user space.

This commit fixes the bug.

Fixes: 8ce8eb601c71('ALSA: seq: add an alternative way to handle ioctl requests'
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 811b95b6f6fd37e06b90dac9857d2c8ee35eccd8..4c935202ce23be4fc57c9d79c3fe0a160d9b8a89 100644 (file)
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -2122,7 +2122,7 @@ static long snd_seq_ioctl(struct file *file, unsigned int cmd,
         * within 13 bits. We can safely pick up the size from the command.
         */
        size = _IOC_SIZE(handler->cmd);
-       if (_IOC_DIR(handler->cmd) & IOC_IN) {
+       if (handler->cmd & IOC_IN) {
                if (copy_from_user(&buf, (const void __user *)arg, size))
                        return -EFAULT;
        }
@@ -2132,7 +2132,7 @@ static long snd_seq_ioctl(struct file *file, unsigned int cmd,
                /* Some commands includes a bug in 'dir' field. */
                if (handler->cmd == SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT ||
                    handler->cmd == SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ||
-                   (_IOC_DIR(handler->cmd) & IOC_OUT))
+                   (handler->cmd & IOC_OUT))
                        if (copy_to_user((void __user *)arg, &buf, size))
                                return -EFAULT;
        }