Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

fs/autofs4: use memdup_user

Use memdup_user when user data is immediately copied into the allocated
region. Elimination of the variable ads, which is no longer useful.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
position p;
identifier l1,l2;
@@

- to = \(kmalloc@p\|kzalloc@p\)(size,flag);
+ to = memdup_user(from,size);
if (
- to==NULL
+ IS_ERR(to)
|| ...) {
<+... when != goto l1;
- -ENOMEM
+ PTR_ERR(to)
...+>
}
- if (copy_from_user(to, from, size) != 0) {
- <+... when != goto l2;
- -EFAULT
- ...+>
- }
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Cc: Ian Kent <raven@themaw.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Julia Lawall and committed by
Linus Torvalds
7ca5ca60 b81d67a5

+2 -11
+2 -11
fs/autofs4/dev-ioctl.c
··· 95 95 */ 96 96 static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in) 97 97 { 98 - struct autofs_dev_ioctl tmp, *ads; 98 + struct autofs_dev_ioctl tmp; 99 99 100 100 if (copy_from_user(&tmp, in, sizeof(tmp))) 101 101 return ERR_PTR(-EFAULT); ··· 103 103 if (tmp.size < sizeof(tmp)) 104 104 return ERR_PTR(-EINVAL); 105 105 106 - ads = kmalloc(tmp.size, GFP_KERNEL); 107 - if (!ads) 108 - return ERR_PTR(-ENOMEM); 109 - 110 - if (copy_from_user(ads, in, tmp.size)) { 111 - kfree(ads); 112 - return ERR_PTR(-EFAULT); 113 - } 114 - 115 - return ads; 106 + return memdup_user(in, tmp.size); 116 107 } 117 108 118 109 static inline void free_dev_ioctl(struct autofs_dev_ioctl *param)