Commit bcdf91c9 authored by Justin Stitt's avatar Justin Stitt Committed by Greg Kroah-Hartman

eeprom: idt_89hpesx: replace open-coded kmemdup_nul

A malloc + strncpy + manual NUL_termination is just kmemdup_nul. Let's use
this interface as it is less error-prone and more readable.

Also drop `csraddr_len` as it is just used in a single place and we can
just do the arithmetic in-line.

Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1]
Link: https://github.com/KSPP/linux/issues/90
Cc: linux-hardening@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: default avatarJustin Stitt <justinstitt@google.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230927-strncpy-drivers-misc-eeprom-idt_89hpesx-c-v1-1-08e3d45b8c05@google.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 78510a4d
...@@ -905,7 +905,7 @@ static ssize_t idt_dbgfs_csr_write(struct file *filep, const char __user *ubuf, ...@@ -905,7 +905,7 @@ static ssize_t idt_dbgfs_csr_write(struct file *filep, const char __user *ubuf,
{ {
struct idt_89hpesx_dev *pdev = filep->private_data; struct idt_89hpesx_dev *pdev = filep->private_data;
char *colon_ch, *csraddr_str, *csrval_str; char *colon_ch, *csraddr_str, *csrval_str;
int ret, csraddr_len; int ret;
u32 csraddr, csrval; u32 csraddr, csrval;
char *buf; char *buf;
...@@ -927,21 +927,16 @@ static ssize_t idt_dbgfs_csr_write(struct file *filep, const char __user *ubuf, ...@@ -927,21 +927,16 @@ static ssize_t idt_dbgfs_csr_write(struct file *filep, const char __user *ubuf,
* no new CSR value * no new CSR value
*/ */
if (colon_ch != NULL) { if (colon_ch != NULL) {
csraddr_len = colon_ch - buf; /* Copy the register address to the substring buffer */
csraddr_str = csraddr_str = kmemdup_nul(buf, colon_ch - buf, GFP_KERNEL);
kmalloc(csraddr_len + 1, GFP_KERNEL);
if (csraddr_str == NULL) { if (csraddr_str == NULL) {
ret = -ENOMEM; ret = -ENOMEM;
goto free_buf; goto free_buf;
} }
/* Copy the register address to the substring buffer */
strncpy(csraddr_str, buf, csraddr_len);
csraddr_str[csraddr_len] = '\0';
/* Register value must follow the colon */ /* Register value must follow the colon */
csrval_str = colon_ch + 1; csrval_str = colon_ch + 1;
} else /* if (str_colon == NULL) */ { } else /* if (str_colon == NULL) */ {
csraddr_str = (char *)buf; /* Just to shut warning up */ csraddr_str = (char *)buf; /* Just to shut warning up */
csraddr_len = strnlen(csraddr_str, count);
csrval_str = NULL; csrval_str = NULL;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment