Skip to content

Commit

Permalink
convert a bunch of open-coded instances of memdup_user_nul()
Browse files Browse the repository at this point in the history 
A _lot_ of ->write() instances were open-coding it; some are
converted to memdup_user_nul(), a lot more remain...

Signed-off-by: Al Viro <[email protected]>
  • Loading branch information
Al Viro committed Jan 4, 2016
1 parent 7e935c7 commit 16e5c1f
Show file tree
Hide file tree
Showing 12 changed files with 71 additions and 197 deletions.
12 changes: 3 additions & 9 deletions arch/xtensa/platforms/iss/simdisk.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -227,25 +227,19 @@ static ssize_t proc_read_simdisk(struct file *file, char __user *buf,
static ssize_t proc_write_simdisk(struct file *file, const char __user *buf,
size_t count, loff_t *ppos)
{
char *tmp = kmalloc(count + 1, GFP_KERNEL);
char *tmp = memdup_user_nul(buf, count);
struct simdisk *dev = PDE_DATA(file_inode(file));
int err;

if (tmp == NULL)
return -ENOMEM;
if (copy_from_user(tmp, buf, count)) {
err = -EFAULT;
goto out_free;
}
if (IS_ERR(tmp))
return PTR_ERR(tmp);

err = simdisk_detach(dev);
if (err != 0)
goto out_free;

if (count > 0 && tmp[count - 1] == '\n')
tmp[count - 1] = 0;
else
tmp[count] = 0;

if (tmp[0])
err = simdisk_attach(dev, tmp);
Expand Down
12 changes: 3 additions & 9 deletions drivers/net/wireless/ath/wil6210/debugfs.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -580,16 +580,10 @@ static ssize_t wil_write_file_rxon(struct file *file, const char __user *buf,
long channel;
bool on;

char *kbuf = kmalloc(len + 1, GFP_KERNEL);

if (!kbuf)
return -ENOMEM;
if (copy_from_user(kbuf, buf, len)) {
kfree(kbuf);
return -EIO;
}
char *kbuf = memdup_user_nul(buf, len);

kbuf[len] = '\0';
if (IS_ERR(kbuf))
return PTR_ERR(kbuf);
rc = kstrtol(kbuf, 0, &channel);
kfree(kbuf);
if (rc)
Expand Down
11 changes: 3 additions & 8 deletions drivers/s390/char/vmcp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -88,14 +88,9 @@ vmcp_write(struct file *file, const char __user *buff, size_t count,

if (count > 240)
return -EINVAL;
cmd = kmalloc(count + 1, GFP_KERNEL);
if (!cmd)
return -ENOMEM;
if (copy_from_user(cmd, buff, count)) {
kfree(cmd);
return -EFAULT;
}
cmd[count] = '\0';
cmd = memdup_user_nul(buff, count);
if (IS_ERR(cmd))
return PTR_ERR(cmd);
session = file->private_data;
if (mutex_lock_interruptible(&session->mutex)) {
kfree(cmd);
Expand Down
13 changes: 3 additions & 10 deletions drivers/sbus/char/openprom.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -390,16 +390,9 @@ static int copyin_string(char __user *user, size_t len, char **ptr)
if ((ssize_t)len < 0 || (ssize_t)(len + 1) < 0)
return -EINVAL;

tmp = kmalloc(len + 1, GFP_KERNEL);
if (!tmp)
return -ENOMEM;

if (copy_from_user(tmp, user, len)) {
kfree(tmp);
return -EFAULT;
}

tmp[len] = '\0';
tmp = memdup_user_nul(user, len);
if (IS_ERR(tmp))
return PTR_ERR(tmp);

*ptr = tmp;

Expand Down
25 changes: 6 additions & 19 deletions fs/afs/proc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -230,14 +230,9 @@ static ssize_t afs_proc_cells_write(struct file *file, const char __user *buf,
if (size <= 1 || size >= PAGE_SIZE)
return -EINVAL;

kbuf = kmalloc(size + 1, GFP_KERNEL);
if (!kbuf)
return -ENOMEM;

ret = -EFAULT;
if (copy_from_user(kbuf, buf, size) != 0)
goto done;
kbuf[size] = 0;
kbuf = memdup_user_nul(buf, size);
if (IS_ERR(kbuf))
return PTR_ERR(kbuf);

/* trim to first NL */
name = memchr(kbuf, '\n', size);
Expand Down Expand Up @@ -315,15 +310,9 @@ static ssize_t afs_proc_rootcell_write(struct file *file,
if (size <= 1 || size >= PAGE_SIZE)
return -EINVAL;

ret = -ENOMEM;
kbuf = kmalloc(size + 1, GFP_KERNEL);
if (!kbuf)
goto nomem;

ret = -EFAULT;
if (copy_from_user(kbuf, buf, size) != 0)
goto infault;
kbuf[size] = 0;
kbuf = memdup_user_nul(buf, size);
if (IS_ERR(kbuf))
return PTR_ERR(kbuf);

/* trim to first NL */
s = memchr(kbuf, '\n', size);
Expand All @@ -337,9 +326,7 @@ static ssize_t afs_proc_rootcell_write(struct file *file,
if (ret >= 0)
ret = size; /* consume everything, always */

infault:
kfree(kbuf);
nomem:
_leave(" = %d", ret);
return ret;
}
Expand Down
12 changes: 3 additions & 9 deletions fs/cachefiles/daemon.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -226,15 +226,9 @@ static ssize_t cachefiles_daemon_write(struct file *file,
return -EOPNOTSUPP;

/* drag the command string into the kernel so we can parse it */
data = kmalloc(datalen + 1, GFP_KERNEL);
if (!data)
return -ENOMEM;

ret = -EFAULT;
if (copy_from_user(data, _data, datalen) != 0)
goto error;

data[datalen] = '\0';
data = memdup_user_nul(_data, datalen);
if (IS_ERR(data))
return PTR_ERR(data);

ret = -EINVAL;
if (memchr(data, '\0', datalen))
Expand Down
11 changes: 3 additions & 8 deletions fs/dlm/user.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -515,14 +515,9 @@ static ssize_t device_write(struct file *file, const char __user *buf,
if (count > sizeof(struct dlm_write_request) + DLM_RESNAME_MAXLEN)
return -EINVAL;

kbuf = kzalloc(count + 1, GFP_NOFS);
if (!kbuf)
return -ENOMEM;

if (copy_from_user(kbuf, buf, count)) {
error = -EFAULT;
goto out_free;
}
kbuf = memdup_user_nul(buf, count);
if (!IS_ERR(kbuf))
return PTR_ERR(kbuf);

if (check_version(kbuf)) {
error = -EBADE;
Expand Down
12 changes: 3 additions & 9 deletions kernel/trace/blktrace.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -349,16 +349,10 @@ static ssize_t blk_msg_write(struct file *filp, const char __user *buffer,
if (count >= BLK_TN_MAX_MSG)
return -EINVAL;

msg = kmalloc(count + 1, GFP_KERNEL);
if (msg == NULL)
return -ENOMEM;

if (copy_from_user(msg, buffer, count)) {
kfree(msg);
return -EFAULT;
}
msg = memdup_user_nul(buffer, count);
if (IS_ERR(msg))
return PTR_ERR(msg);

msg[count] = '\0';
bt = filp->private_data;
__trace_note_message(bt, "%s", msg);
kfree(msg);
Expand Down
11 changes: 3 additions & 8 deletions lib/dynamic_debug.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -657,14 +657,9 @@ static ssize_t ddebug_proc_write(struct file *file, const char __user *ubuf,
pr_warn("expected <%d bytes into control\n", USER_BUF_PAGE);
return -E2BIG;
}
tmpbuf = kmalloc(len + 1, GFP_KERNEL);
if (!tmpbuf)
return -ENOMEM;
if (copy_from_user(tmpbuf, ubuf, len)) {
kfree(tmpbuf);
return -EFAULT;
}
tmpbuf[len] = '\0';
tmpbuf = memdup_user_nul(ubuf, len);
if (IS_ERR(tmpbuf))
return PTR_ERR(tmpbuf);
vpr_info("read %d bytes from userspace\n", (int)len);

ret = ddebug_exec_queries(tmpbuf, NULL);
Expand Down
24 changes: 6 additions & 18 deletions net/rxrpc/ar-key.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -896,15 +896,9 @@ int rxrpc_request_key(struct rxrpc_sock *rx, char __user *optval, int optlen)
if (optlen <= 0 || optlen > PAGE_SIZE - 1)
return -EINVAL;

description = kmalloc(optlen + 1, GFP_KERNEL);
if (!description)
return -ENOMEM;

if (copy_from_user(description, optval, optlen)) {
kfree(description);
return -EFAULT;
}
description[optlen] = 0;
description = memdup_user_nul(optval, optlen);
if (IS_ERR(description))
return PTR_ERR(description);

key = request_key(&key_type_rxrpc, description, NULL);
if (IS_ERR(key)) {
Expand Down Expand Up @@ -933,15 +927,9 @@ int rxrpc_server_keyring(struct rxrpc_sock *rx, char __user *optval,
if (optlen <= 0 || optlen > PAGE_SIZE - 1)
return -EINVAL;

description = kmalloc(optlen + 1, GFP_KERNEL);
if (!description)
return -ENOMEM;

if (copy_from_user(description, optval, optlen)) {
kfree(description);
return -EFAULT;
}
description[optlen] = 0;
description = memdup_user_nul(optval, optlen);
if (IS_ERR(description))
return PTR_ERR(description);

key = request_key(&key_type_keyring, description, NULL);
if (IS_ERR(key)) {
Expand Down
Loading

0 comments on commit 16e5c1f

Please sign in to comment.