aboutsummaryrefslogtreecommitdiff
path: root/drivers/s390/net
diff options
context:
space:
mode:
authorJulia Lawall <julia@diku.dk>2010-07-22 23:15:09 +0000
committerDavid S. Miller <davem@davemloft.net>2010-07-23 12:36:25 -0700
commit4986f3f01aca9a332fa8e0fc9fdf3338791ee374 (patch)
tree6e721db6a2ebe00901725fd0bc1889339d736943 /drivers/s390/net
parentbbb822a8c032813148888fcec85e89edb17286d3 (diff)
downloadlinux-linaro-android-4986f3f01aca9a332fa8e0fc9fdf3338791ee374.tar.gz
qeth: Use memdup_user when user data is immediately copied into the allocated region.
The semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression from,to,size,flag; position p; identifier l1,l2; @@ - to = \(kmalloc@p\|kzalloc@p\)(size,flag); + to = memdup_user(from,size); if ( - to==NULL + IS_ERR(to) || ...) { <+... when != goto l1; - -ENOMEM + PTR_ERR(to) ...+> } - if (copy_from_user(to, from, size) != 0) { - <+... when != goto l2; - -EFAULT - ...+> - } // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/s390/net')
-rw-r--r--drivers/s390/net/qeth_core_main.c11
1 files changed, 3 insertions, 8 deletions
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 6d51494a7f2..3a5a18a0fc2 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -3748,15 +3748,10 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
/* skip 4 bytes (data_len struct member) to get req_len */
if (copy_from_user(&req_len, udata + sizeof(int), sizeof(int)))
return -EFAULT;
- ureq = kmalloc(req_len+sizeof(struct qeth_snmp_ureq_hdr), GFP_KERNEL);
- if (!ureq) {
+ ureq = memdup_user(udata, req_len + sizeof(struct qeth_snmp_ureq_hdr));
+ if (IS_ERR(ureq)) {
QETH_CARD_TEXT(card, 2, "snmpnome");
- return -ENOMEM;
- }
- if (copy_from_user(ureq, udata,
- req_len + sizeof(struct qeth_snmp_ureq_hdr))) {
- kfree(ureq);
- return -EFAULT;
+ return PTR_ERR(ureq);
}
qinfo.udata_len = ureq->hdr.data_len;
qinfo.udata = kzalloc(qinfo.udata_len, GFP_KERNEL);