Commit d0e6a806 authored by Ivan Vecera's avatar Ivan Vecera Committed by David S. Miller

bna: use memdup_user to copy userspace buffers

Patch converts kzalloc->copy_from_user sequence to memdup_user. There
is also one useless assignment of NULL to bnad->regdata as it is followed
by assignment of kzalloc output.
Signed-off-by: default avatarIvan Vecera <ivecera@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 93719d26
...@@ -321,15 +321,10 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf, ...@@ -321,15 +321,10 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf,
unsigned long flags; unsigned long flags;
void *kern_buf; void *kern_buf;
/* Allocate memory to store the user space buf */ /* Copy the user space buf */
kern_buf = kzalloc(nbytes, GFP_KERNEL); kern_buf = memdup_user(buf, nbytes);
if (!kern_buf) if (IS_ERR(kern_buf))
return -ENOMEM; return PTR_ERR(kern_buf);
if (copy_from_user(kern_buf, (void __user *)buf, nbytes)) {
kfree(kern_buf);
return -ENOMEM;
}
rc = sscanf(kern_buf, "%x:%x", &addr, &len); rc = sscanf(kern_buf, "%x:%x", &addr, &len);
if (rc < 2) { if (rc < 2) {
...@@ -341,7 +336,6 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf, ...@@ -341,7 +336,6 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf,
kfree(kern_buf); kfree(kern_buf);
kfree(bnad->regdata); kfree(bnad->regdata);
bnad->regdata = NULL;
bnad->reglen = 0; bnad->reglen = 0;
bnad->regdata = kzalloc(len << 2, GFP_KERNEL); bnad->regdata = kzalloc(len << 2, GFP_KERNEL);
...@@ -388,15 +382,10 @@ bnad_debugfs_write_regwr(struct file *file, const char __user *buf, ...@@ -388,15 +382,10 @@ bnad_debugfs_write_regwr(struct file *file, const char __user *buf,
unsigned long flags; unsigned long flags;
void *kern_buf; void *kern_buf;
/* Allocate memory to store the user space buf */ /* Copy the user space buf */
kern_buf = kzalloc(nbytes, GFP_KERNEL); kern_buf = memdup_user(buf, nbytes);
if (!kern_buf) if (IS_ERR(kern_buf))
return -ENOMEM; return PTR_ERR(kern_buf);
if (copy_from_user(kern_buf, (void __user *)buf, nbytes)) {
kfree(kern_buf);
return -ENOMEM;
}
rc = sscanf(kern_buf, "%x:%x", &addr, &val); rc = sscanf(kern_buf, "%x:%x", &addr, &val);
if (rc < 2) { if (rc < 2) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment