Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1636930 > unrolled thread

[PATCH] agp: use memdup_user

Back to article view | Back to linux.kernel

Contents

  [PATCH] agp: use memdup_user Geliang Tang <geliangtang@gmail.com> - 2017-05-06 17:50 +0200
    [PATCH] wil6210: use memdup_user Geliang Tang <geliangtang@gmail.com> - 2017-05-06 17:50 +0200
    [PATCH] wlcore: use memdup_user Geliang Tang <geliangtang@gmail.com> - 2017-05-06 17:50 +0200
    [PATCH] usb: cdc-wdm: use memdup_user Geliang Tang <geliangtang@gmail.com> - 2017-05-06 17:50 +0200
      Re: [PATCH] usb: cdc-wdm: use memdup_user Bjørn Mork <bjorn@mork.no> - 2017-05-06 19:50 +0200
        [PATCH v2] usb: cdc-wdm: use memdup_user Geliang Tang <geliangtang@gmail.com> - 2017-05-08 17:20 +0200
          Re: [PATCH v2] usb: cdc-wdm: use memdup_user Oliver Neukum <oneukum@suse.com> - 2017-05-09 10:00 +0200
    [PATCH] net/hippi/rrunner: use memdup_user Geliang Tang <geliangtang@gmail.com> - 2017-05-06 17:50 +0200
      Re: [PATCH] net/hippi/rrunner: use memdup_user David Miller <davem@davemloft.net> - 2017-05-08 21:10 +0200
    [PATCH] yam: use memdup_user Geliang Tang <geliangtang@gmail.com> - 2017-05-06 17:50 +0200
      Re: [PATCH] yam: use memdup_user David Miller <davem@davemloft.net> - 2017-05-08 21:10 +0200
    [PATCH] spi: spidev: use memdup_user Geliang Tang <geliangtang@gmail.com> - 2017-05-06 17:50 +0200
      Re: [PATCH] spi: spidev: use memdup_user Geert Uytterhoeven <geert@linux-m68k.org> - 2017-05-08 11:30 +0200
    [PATCH] xfrm: use memdup_user Geliang Tang <geliangtang@gmail.com> - 2017-05-06 17:50 +0200

#1636930 — [PATCH] agp: use memdup_user

Use memdup_user() helper instead of open-coding to simplify the code.

Signed-off-by: Geliang Tang <geliangtang@gmail.com>
---
 drivers/char/agp/compat_ioctl.c | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/drivers/char/agp/compat_ioctl.c b/drivers/char/agp/compat_ioctl.c
index 2053f70..a0a3cf0 100644
--- a/drivers/char/agp/compat_ioctl.c
+++ b/drivers/char/agp/compat_ioctl.c
@@ -98,9 +98,10 @@ static int compat_agpioc_reserve_wrap(struct agp_file_private *priv, void __user
 		if (ureserve.seg_count >= 16384)
 			return -EINVAL;
 
-		usegment = kmalloc(sizeof(*usegment) * ureserve.seg_count, GFP_KERNEL);
-		if (!usegment)
-			return -ENOMEM;
+		usegment = memdup_user((void __user *)ureserve.seg_list,
+				       sizeof(*usegment) * ureserve.seg_count);
+		if (IS_ERR(usegment))
+			return PTR_ERR(usegment);
 
 		ksegment = kmalloc(sizeof(*ksegment) * kreserve.seg_count, GFP_KERNEL);
 		if (!ksegment) {
@@ -108,13 +109,6 @@ static int compat_agpioc_reserve_wrap(struct agp_file_private *priv, void __user
 			return -ENOMEM;
 		}
 
-		if (copy_from_user(usegment, (void __user *) ureserve.seg_list,
-				   sizeof(*usegment) * ureserve.seg_count)) {
-			kfree(usegment);
-			kfree(ksegment);
-			return -EFAULT;
-		}
-
 		for (seg = 0; seg < ureserve.seg_count; seg++) {
 			ksegment[seg].pg_start = usegment[seg].pg_start;
 			ksegment[seg].pg_count = usegment[seg].pg_count;
-- 
2.9.3

[toc] | [next] | [standalone]

#1636932 — [PATCH] wil6210: use memdup_user

Use memdup_user() helper instead of open-coding to simplify the code.

Signed-off-by: Geliang Tang <geliangtang@gmail.com>
---
 drivers/net/wireless/ath/wil6210/debugfs.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 5648ebb..5b0f9fc 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -795,15 +795,11 @@ static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf,
 	struct wireless_dev *wdev = wil_to_wdev(wil);
 	struct cfg80211_mgmt_tx_params params;
 	int rc;
-	void *frame = kmalloc(len, GFP_KERNEL);
+	void *frame;
 
-	if (!frame)
-		return -ENOMEM;
-
-	if (copy_from_user(frame, buf, len)) {
-		kfree(frame);
-		return -EIO;
-	}
+	frame = memdup_user(buf, len);
+	if (IS_ERR(frame))
+		return PTR_ERR(frame);
 
 	params.buf = frame;
 	params.len = len;
-- 
2.9.3

[toc] | [prev] | [next] | [standalone]

#1636934 — [PATCH] wlcore: use memdup_user

Use memdup_user() helper instead of open-coding to simplify the code.

Signed-off-by: Geliang Tang <geliangtang@gmail.com>
---
 drivers/net/wireless/ti/wlcore/debugfs.c | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/drivers/net/wireless/ti/wlcore/debugfs.c b/drivers/net/wireless/ti/wlcore/debugfs.c
index de7e2a5..a2cb408 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.c
+++ b/drivers/net/wireless/ti/wlcore/debugfs.c
@@ -1149,15 +1149,9 @@ static ssize_t dev_mem_write(struct file *file, const char __user *user_buf,
 	part.mem.start = *ppos;
 	part.mem.size = bytes;
 
-	buf = kmalloc(bytes, GFP_KERNEL);
-	if (!buf)
-		return -ENOMEM;
-
-	ret = copy_from_user(buf, user_buf, bytes);
-	if (ret) {
-		ret = -EFAULT;
-		goto err_out;
-	}
+	buf = memdup_user(user_buf, bytes);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
 
 	mutex_lock(&wl->mutex);
 
@@ -1197,7 +1191,6 @@ static ssize_t dev_mem_write(struct file *file, const char __user *user_buf,
 	if (ret == 0)
 		*ppos += bytes;
 
-err_out:
 	kfree(buf);
 
 	return ((ret == 0) ? bytes : ret);
-- 
2.9.3

[toc] | [prev] | [next] | [standalone]

#1636935 — [PATCH] usb: cdc-wdm: use memdup_user

Use memdup_user() helper instead of open-coding to simplify the code.

Signed-off-by: Geliang Tang <geliangtang@gmail.com>
---
 drivers/usb/class/cdc-wdm.c | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 08669fe..0e4f18c 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -361,17 +361,9 @@ static ssize_t wdm_write
 	if (we < 0)
 		return usb_translate_errors(we);
 
-	buf = kmalloc(count, GFP_KERNEL);
-	if (!buf) {
-		rv = -ENOMEM;
-		goto outnl;
-	}
-
-	r = copy_from_user(buf, buffer, count);
-	if (r > 0) {
-		rv = -EFAULT;
-		goto out_free_mem;
-	}
+	buf = memdup_user(buffer, count);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
 
 	/* concurrent writes and disconnect */
 	r = mutex_lock_interruptible(&desc->wlock);
@@ -441,7 +433,6 @@ static ssize_t wdm_write
 
 	usb_autopm_put_interface(desc->intf);
 	mutex_unlock(&desc->wlock);
-outnl:
 	return rv < 0 ? rv : count;
 
 out_free_mem_pm:
-- 
2.9.3

[toc] | [prev] | [next] | [standalone]

#1636958 — Re: [PATCH] usb: cdc-wdm: use memdup_user

Geliang Tang <geliangtang@gmail.com> writes:

> Use memdup_user() helper instead of open-coding to simplify the code.
>
> Signed-off-by: Geliang Tang <geliangtang@gmail.com>
> ---
>  drivers/usb/class/cdc-wdm.c | 15 +++------------
>  1 file changed, 3 insertions(+), 12 deletions(-)
>
> diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
> index 08669fe..0e4f18c 100644
> --- a/drivers/usb/class/cdc-wdm.c
> +++ b/drivers/usb/class/cdc-wdm.c
> @@ -361,17 +361,9 @@ static ssize_t wdm_write
>  	if (we < 0)
>  		return usb_translate_errors(we);
>  
> -	buf = kmalloc(count, GFP_KERNEL);
> -	if (!buf) {
> -		rv = -ENOMEM;
> -		goto outnl;
> -	}
> -
> -	r = copy_from_user(buf, buffer, count);
> -	if (r > 0) {
> -		rv = -EFAULT;
> -		goto out_free_mem;
> -	}
> +	buf = memdup_user(buffer, count);
> +	if (IS_ERR(buf))
> +		return PTR_ERR(buf);
>  
>  	/* concurrent writes and disconnect */
>  	r = mutex_lock_interruptible(&desc->wlock);
> @@ -441,7 +433,6 @@ static ssize_t wdm_write
>  
>  	usb_autopm_put_interface(desc->intf);
>  	mutex_unlock(&desc->wlock);
> -outnl:
>  	return rv < 0 ? rv : count;
>  
>  out_free_mem_pm:

Nice!

Please check this, but I believe you can simplify that last return as
well. There is no way to end up there with rv < 0 after you've removed
the label. So

  return count;

should do.


Bjørn

[toc] | [prev] | [next] | [standalone]

#1637501 — [PATCH v2] usb: cdc-wdm: use memdup_user

Use memdup_user() helper instead of open-coding to simplify the code.

Signed-off-by: Geliang Tang <geliangtang@gmail.com>
---
Changes in v2:
 - return count instead of "rv < 0 ? rv : count".
---
 drivers/usb/class/cdc-wdm.c | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 08669fe..8f97224 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -361,17 +361,9 @@ static ssize_t wdm_write
 	if (we < 0)
 		return usb_translate_errors(we);
 
-	buf = kmalloc(count, GFP_KERNEL);
-	if (!buf) {
-		rv = -ENOMEM;
-		goto outnl;
-	}
-
-	r = copy_from_user(buf, buffer, count);
-	if (r > 0) {
-		rv = -EFAULT;
-		goto out_free_mem;
-	}
+	buf = memdup_user(buffer, count);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
 
 	/* concurrent writes and disconnect */
 	r = mutex_lock_interruptible(&desc->wlock);
@@ -441,8 +433,7 @@ static ssize_t wdm_write
 
 	usb_autopm_put_interface(desc->intf);
 	mutex_unlock(&desc->wlock);
-outnl:
-	return rv < 0 ? rv : count;
+	return count;
 
 out_free_mem_pm:
 	usb_autopm_put_interface(desc->intf);
-- 
2.9.3

[toc] | [prev] | [next] | [standalone]

#1637950 — Re: [PATCH v2] usb: cdc-wdm: use memdup_user

Am Montag, den 08.05.2017, 23:14 +0800 schrieb Geliang Tang:
> Use memdup_user() helper instead of open-coding to simplify the code.
> 
> Signed-off-by: Geliang Tang <geliangtang@gmail.com>
Acked-by: Oliver Neukum <oneukum@suse.com>

[toc] | [prev] | [next] | [standalone]

#1636937 — [PATCH] net/hippi/rrunner: use memdup_user

Use memdup_user() helper instead of open-coding to simplify the code.

Signed-off-by: Geliang Tang <geliangtang@gmail.com>
---
 drivers/net/hippi/rrunner.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
index 9b0d614..1ce6239 100644
--- a/drivers/net/hippi/rrunner.c
+++ b/drivers/net/hippi/rrunner.c
@@ -1616,17 +1616,14 @@ static int rr_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 			return -EPERM;
 		}
 
-		image = kmalloc(EEPROM_WORDS * sizeof(u32), GFP_KERNEL);
-		oldimage = kmalloc(EEPROM_WORDS * sizeof(u32), GFP_KERNEL);
-		if (!image || !oldimage) {
-			error = -ENOMEM;
-			goto wf_out;
-		}
+		image = memdup_user(rq->ifr_data, EEPROM_BYTES);
+		if (IS_ERR(image))
+			return PTR_ERR(image);
 
-		error = copy_from_user(image, rq->ifr_data, EEPROM_BYTES);
-		if (error) {
-			error = -EFAULT;
-			goto wf_out;
+		oldimage = kmalloc(EEPROM_BYTES, GFP_KERNEL);
+		if (!oldimage) {
+			kfree(image);
+			return -ENOMEM;
 		}
 
 		if (rrpriv->fw_running){
-- 
2.9.3

[toc] | [prev] | [next] | [standalone]

#1637650 — Re: [PATCH] net/hippi/rrunner: use memdup_user

From: Geliang Tang <geliangtang@gmail.com>
Date: Sat,  6 May 2017 23:42:16 +0800

> Use memdup_user() helper instead of open-coding to simplify the code.
> 
> Signed-off-by: Geliang Tang <geliangtang@gmail.com>

Applied.

[toc] | [prev] | [next] | [standalone]

#1636939 — [PATCH] yam: use memdup_user

Use memdup_user() helper instead of open-coding to simplify the code.

Signed-off-by: Geliang Tang <geliangtang@gmail.com>
---
 drivers/net/hamradio/yam.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index b6891ad..7a7c522 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -976,12 +976,10 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 	case SIOCYAMSMCS:
 		if (netif_running(dev))
 			return -EINVAL;		/* Cannot change this parameter when up */
-		if ((ym = kmalloc(sizeof(struct yamdrv_ioctl_mcs), GFP_KERNEL)) == NULL)
-			return -ENOBUFS;
-		if (copy_from_user(ym, ifr->ifr_data, sizeof(struct yamdrv_ioctl_mcs))) {
-			kfree(ym);
-			return -EFAULT;
-		}
+		ym = memdup_user(ifr->ifr_data,
+				 sizeof(struct yamdrv_ioctl_mcs));
+		if (IS_ERR(ym))
+			return PTR_ERR(ym);
 		if (ym->bitrate > YAM_MAXBITRATE) {
 			kfree(ym);
 			return -EINVAL;
-- 
2.9.3

[toc] | [prev] | [next] | [standalone]

#1637648 — Re: [PATCH] yam: use memdup_user

From: Geliang Tang <geliangtang@gmail.com>
Date: Sat,  6 May 2017 23:42:22 +0800

> Use memdup_user() helper instead of open-coding to simplify the code.
> 
> Signed-off-by: Geliang Tang <geliangtang@gmail.com>

Applied.

[toc] | [prev] | [next] | [standalone]

#1636941 — [PATCH] spi: spidev: use memdup_user

Use memdup_user() helper instead of open-coding to simplify the code.

Signed-off-by: Geliang Tang <geliangtang@gmail.com>
---
 drivers/spi/spidev.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index 9a2a79a..b00a88f 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -325,7 +325,6 @@ static struct spi_ioc_transfer *
 spidev_get_ioc_message(unsigned int cmd, struct spi_ioc_transfer __user *u_ioc,
 		unsigned *n_ioc)
 {
-	struct spi_ioc_transfer	*ioc;
 	u32	tmp;
 
 	/* Check type, command number and direction */
@@ -342,14 +341,7 @@ spidev_get_ioc_message(unsigned int cmd, struct spi_ioc_transfer __user *u_ioc,
 		return NULL;
 
 	/* copy into scratch area */
-	ioc = kmalloc(tmp, GFP_KERNEL);
-	if (!ioc)
-		return ERR_PTR(-ENOMEM);
-	if (__copy_from_user(ioc, u_ioc, tmp)) {
-		kfree(ioc);
-		return ERR_PTR(-EFAULT);
-	}
-	return ioc;
+	return memdup_user(u_ioc, tmp);
 }
 
 static long
-- 
2.9.3

[toc] | [prev] | [next] | [standalone]

#1637327 — Re: [PATCH] spi: spidev: use memdup_user

On Sat, May 6, 2017 at 5:42 PM, Geliang Tang <geliangtang@gmail.com> wrote:
> Use memdup_user() helper instead of open-coding to simplify the code.
>
> Signed-off-by: Geliang Tang <geliangtang@gmail.com>

Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>

> --- a/drivers/spi/spidev.c
> +++ b/drivers/spi/spidev.c
> @@ -325,7 +325,6 @@ static struct spi_ioc_transfer *
>  spidev_get_ioc_message(unsigned int cmd, struct spi_ioc_transfer __user *u_ioc,
>                 unsigned *n_ioc)
>  {
> -       struct spi_ioc_transfer *ioc;
>         u32     tmp;
>
>         /* Check type, command number and direction */
> @@ -342,14 +341,7 @@ spidev_get_ioc_message(unsigned int cmd, struct spi_ioc_transfer __user *u_ioc,
>                 return NULL;
>
>         /* copy into scratch area */
> -       ioc = kmalloc(tmp, GFP_KERNEL);
> -       if (!ioc)
> -               return ERR_PTR(-ENOMEM);
> -       if (__copy_from_user(ioc, u_ioc, tmp)) {

Note that as memdup_user() calls copy_from_user(), it repeats the access_ok()
check already done by spidev_ioctl().

> -               kfree(ioc);
> -               return ERR_PTR(-EFAULT);
> -       }
> -       return ioc;
> +       return memdup_user(u_ioc, tmp);

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

[toc] | [prev] | [next] | [standalone]

#1636943 — [PATCH] xfrm: use memdup_user

Use memdup_user() helper instead of open-coding to simplify the code.

Signed-off-by: Geliang Tang <geliangtang@gmail.com>
---
 net/xfrm/xfrm_state.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index fc3c5aa..5780cda 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2023,13 +2023,9 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen
 	if (optlen <= 0 || optlen > PAGE_SIZE)
 		return -EMSGSIZE;
 
-	data = kmalloc(optlen, GFP_KERNEL);
-	if (!data)
-		return -ENOMEM;
-
-	err = -EFAULT;
-	if (copy_from_user(data, optval, optlen))
-		goto out;
+	data = memdup_user(optval, optlen);
+	if (IS_ERR(data))
+		return PTR_ERR(data);
 
 	err = -EINVAL;
 	rcu_read_lock();
@@ -2047,7 +2043,6 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen
 		err = 0;
 	}
 
-out:
 	kfree(data);
 	return err;
 }
-- 
2.9.3

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web