linux-kernel - [PATCH] staging/easycap: Use memdup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sat, 13 Aug 2011 11:09:26 +0200
From:	Thomas Meyer <thomas@...3r.de>
To:	Greg Kroah-Hartman <gregkh@...e.de>,
	Tomas Winkler <tomas.winkler@...el.com>,
	devel@...verdev.osuosl.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: [PATCH] staging/easycap: Use memdup_user

From: Thomas Meyer <thomas@...3r.de>

 Use kmemdup_user rather than duplicating its implementation
 This is a little bit restricted to reduce false positives

 The semantic patch that makes this output is available
 in scripts/coccinelle/api/memdup_user.cocci.

 More information about semantic patching is available at
 http://coccinelle.lip6.fr/

Signed-off-by: Thomas Meyer <thomas@...3r.de>
---

diff --git a/drivers/staging/easycap/easycap_ioctl.c b/drivers/staging/easycap/easycap_ioctl.c
index 0accab9..91262fb 100644
--- a/drivers/staging/easycap/easycap_ioctl.c
+++ b/drivers/staging/easycap/easycap_ioctl.c
@@ -1317,17 +1317,12 @@ long easycap_unlocked_ioctl(struct file *file,
 		struct v4l2_control *pv4l2_control;
 
 		JOM(8, "VIDIOC_G_CTRL\n");
-		pv4l2_control = kzalloc(sizeof(struct v4l2_control), GFP_KERNEL);
-		if (!pv4l2_control) {
-			SAM("ERROR: out of memory\n");
+		pv4l2_control = memdup_user((void __user *)arg,
+					    sizeof(struct v4l2_control));
+		if (IS_ERR(pv4l2_control)) {
+			SAM("ERROR: copy from user failed\n");
 			mutex_unlock(&easycapdc60_dongle[kd].mutex_video);
-			return -ENOMEM;
-		}
-		if (0 != copy_from_user(pv4l2_control, (void __user *)arg,
-				sizeof(struct v4l2_control))) {
-			kfree(pv4l2_control);
-			mutex_unlock(&easycapdc60_dongle[kd].mutex_video);
-			return -EFAULT;
+			return PTR_ERR(pv4l2_control);
 		}
 
 		switch (pv4l2_control->id) {
@@ -2356,17 +2351,12 @@ long easycap_unlocked_ioctl(struct file *file,
 		struct v4l2_streamparm *pv4l2_streamparm;
 
 		JOM(8, "VIDIOC_G_PARM\n");
-		pv4l2_streamparm = kzalloc(sizeof(struct v4l2_streamparm), GFP_KERNEL);
-		if (!pv4l2_streamparm) {
-			SAM("ERROR: out of memory\n");
-			mutex_unlock(&easycapdc60_dongle[kd].mutex_video);
-			return -ENOMEM;
-		}
-		if (copy_from_user(pv4l2_streamparm,
-			(void __user *)arg, sizeof(struct v4l2_streamparm))) {
-			kfree(pv4l2_streamparm);
+		pv4l2_streamparm = memdup_user((void __user *)arg,
+					       sizeof(struct v4l2_streamparm));
+		if (IS_ERR(pv4l2_streamparm)) {
+			SAM("ERROR: copy from user failed\n");
 			mutex_unlock(&easycapdc60_dongle[kd].mutex_video);
-			return -EFAULT;
+			return PTR_ERR(pv4l2_streamparm);
 		}
 
 		if (pv4l2_streamparm->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) {



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/