lkml.org 
[lkml]   [2016]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH v2 2/2] KVM: s390: Use memdup_user() rather than duplicating code
    Hi Markus,

    On Wed, Aug 24, 2016 at 8:40 PM, SF Markus Elfring
    <elfring@users.sourceforge.net> wrote:
    > From: Markus Elfring <elfring@users.sourceforge.net>
    > Date: Wed, 24 Aug 2016 20:10:09 +0200
    >
    > * Reuse existing functionality from memdup_user() instead of keeping
    > duplicate source code.
    >
    > This issue was detected by using the Coccinelle software.
    >
    > * Return directly if this copy operation failed.
    >
    > Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
    > Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
    > ---
    >
    > v2: Rebased on source files from "Linux next-20160824".
    >
    > arch/s390/kvm/guestdbg.c | 18 ++++--------------
    > 1 file changed, 4 insertions(+), 14 deletions(-)
    >
    > diff --git a/arch/s390/kvm/guestdbg.c b/arch/s390/kvm/guestdbg.c
    > index 70b71ac..d7c6a7f 100644
    > --- a/arch/s390/kvm/guestdbg.c
    > +++ b/arch/s390/kvm/guestdbg.c
    > @@ -216,20 +216,10 @@ int kvm_s390_import_bp_data(struct kvm_vcpu *vcpu,
    > else if (dbg->arch.nr_hw_bp > MAX_BP_COUNT)
    > return -EINVAL;
    >
    > - bp_data = kmalloc_array(dbg->arch.nr_hw_bp,
    > - sizeof(*bp_data),
    > - GFP_KERNEL);

    Probably not an issue here, but if "sizeof(*bp_data) * dbg->arch.nr_hw_bp"
    overflows, kmalloc_array() would have returned NULL here...

    > - if (!bp_data) {
    > - ret = -ENOMEM;
    > - goto error;
    > - }
    > -
    > - if (copy_from_user(bp_data,
    > - dbg->arch.hw_bp,
    > - sizeof(*bp_data) * dbg->arch.nr_hw_bp)) {
    > - ret = -EFAULT;
    > - goto error;
    > - }
    > + bp_data = memdup_user(dbg->arch.hw_bp,
    > + sizeof(*bp_data) * dbg->arch.nr_hw_bp);

    ... while this would continue silently, and corrupt memory.

    > + if (IS_ERR(bp_data))
    > + return PTR_ERR(bp_data);

    Gr{oetje,eeting}s,

    Geert

    --
    Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

    In personal conversations with technical people, I call myself a hacker. But
    when I'm talking to journalists I just say "programmer" or something like that.
    -- Linus Torvalds

    \
     
     \ /
      Last update: 2016-10-03 14:12    [W:3.385 / U:0.192 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site