Skip to contentSkip to conversation

ks390/keyboard: use memdup_user_nul().

PATCH In review Muhammad Falak R Wani 2 participants 2 messages May 20, 2016 s390

lore
Share & tools
lore

Muhammad Falak R Wani

author
#0 lore raw

PATCH v2 1/1 ks390/keyboard: use memdup_user_nul().

Use memdup_user_nul to duplicate a memory region from user-space to kernel-space and terminate with a NULL, instead of open coding using kmalloc + copy_from_user and explicitly NULL terminating.

Signed-off-by Muhammad Falak R Wani <[email protected]>
---
 drivers/s390/char/keyboard.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/s390/char/keyboard.c +3 -8
index ef04a9f..f82a7dc 100644
@@ -438,18 +438,13 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
 			return -EFAULT;
 		if (len > sizeof(u_kbs->kb_string))
 			return -EINVAL;
-		p = kmalloc(len, GFP_KERNEL);
-		if (!p)
-			return -ENOMEM;
-		if (copy_from_user(p, u_kbs->kb_string, len)) {
-			kfree(p);
-			return -EFAULT;
-		}
+		p = memdup_user_nul(u_kbs->kb_string, len);
+		if (IS_ERR(p))
+			return PTR_ERR(p);
 		/*
 		 * Make sure the string is terminated by 0. User could have
 		 * modified it between us running strnlen_user() and copying it.
 		 */
-		p[len - 1] = 0;
 		kfree(kbd->func_table[kb_func]);
 		kbd->func_table[kb_func] = p;
 		break;
Signature · 1 line
1.9.1
#1 lore raw
Quoted 22 lines · Muhammad Falak R Wani

Use memdup_user_nul to duplicate a memory region from user-space to kernel-space and terminate with a NULL, instead of open coding using kmalloc + copy_from_user and explicitly NULL terminating.

Signed-off-by Muhammad Falak R Wani <[email protected]>
---
 drivers/s390/char/keyboard.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/s390/char/keyboard.c +0 -5
index ef04a9f..f82a7dc 100644
@@ -438,18 +438,13 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
 			return -EFAULT;
 		if (len > sizeof(u_kbs->kb_string))
 			return -EINVAL;
-		p = kmalloc(len, GFP_KERNEL);
-		if (!p)
-			return -ENOMEM;
-		if (copy_from_user(p, u_kbs->kb_string, len)) {
-			kfree(p);

drivers/s390/char/keyboard.c do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs, · line 452

Quoted 10 lines
drivers/s390/char/keyboard.c +3 -3
-			return -EFAULT;
-		}
+		p = memdup_user_nul(u_kbs->kb_string, len);
+		if (IS_ERR(p))
+			return PTR_ERR(p);
 		/*
 		 * Make sure the string is terminated by 0. User could have
 		 * modified it between us running strnlen_user() and copying it.
 		 */
-		p[len - 1] = 0;

I removed the comment above as well and folded that into your patch. Applied, thanks!