Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

drivers/message/i2o/i2o_config.c: use memdup_user

Use memdup_user when user data is immediately copied into the
allocated region.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
position p;
identifier l1,l2;
@@

- to = \(kmalloc@p\|kzalloc@p\)(size,flag);
+ to = memdup_user(from,size);
if (
- to==NULL
+ IS_ERR(to)
|| ...) {
<+... when != goto l1;
- -ENOMEM
+ PTR_ERR(to)
...+>
}
- if (copy_from_user(to, from, size) != 0) {
- <+... when != goto l2;
- -EFAULT
- ...+>
- }
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Julia Lawall and committed by
Linus Torvalds
b81d67a5 9b71ca20

+3 -8
+3 -8
drivers/message/i2o/i2o_config.c
··· 186 186 if (!dev) 187 187 return -ENXIO; 188 188 189 - ops = kmalloc(kcmd.oplen, GFP_KERNEL); 190 - if (!ops) 191 - return -ENOMEM; 192 - 193 - if (copy_from_user(ops, kcmd.opbuf, kcmd.oplen)) { 194 - kfree(ops); 195 - return -EFAULT; 196 - } 189 + ops = memdup_user(kcmd.opbuf, kcmd.oplen); 190 + if (IS_ERR(ops)) 191 + return PTR_ERR(ops); 197 192 198 193 /* 199 194 * It's possible to have a _very_ large table