Messages in this thread | | | Subject | Re: [PATCH] staging: comedi: use memdup_user | From | Joe Perches <> | Date | Fri, 28 Apr 2017 18:53:32 -0700 |
| |
On Sat, 2017-04-29 at 09:45 +0800, Geliang Tang wrote: > Use memdup_user() helper instead of open-coding to simplify the code.
While I doubt this is a problem, this loses the multiplication overflow check for sizeof(*insns) * insnlist.n_isns
> diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c [] > @@ -1450,22 +1450,14 @@ static int do_insnlist_ioctl(struct comedi_device *dev, > return -EFAULT; > > data = kmalloc_array(MAX_SAMPLES, sizeof(unsigned int), GFP_KERNEL); > - if (!data) { > - ret = -ENOMEM; > - goto error; > - } > - > - insns = kcalloc(insnlist.n_insns, sizeof(*insns), GFP_KERNEL); > - if (!insns) { > - ret = -ENOMEM; > - goto error; > - } > + if (!data) > + return -ENOMEM; > > - if (copy_from_user(insns, insnlist.insns, > - sizeof(*insns) * insnlist.n_insns)) { > - dev_dbg(dev->class_dev, "copy_from_user failed\n"); > - ret = -EFAULT; > - goto error; > + insns = memdup_user(insnlist.insns, sizeof(*insns) * insnlist.n_insns); > + if (IS_ERR(insns)) { > + dev_dbg(dev->class_dev, "memdup_user failed\n"); > + kfree(data); > + return PTR_ERR(insns); > } > > for (i = 0; i < insnlist.n_insns; i++) {
| |