linux-kernel - [PATCH] s390/hypfs_sprp: Replace kzalloc() + copy_from_user() with memdup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250911214539.1483234-2-thorsten.blum@linux.dev>
Date: Thu, 11 Sep 2025 23:45:38 +0200
From: Thorsten Blum <thorsten.blum@...ux.dev>
To: Heiko Carstens <hca@...ux.ibm.com>,
	Vasily Gorbik <gor@...ux.ibm.com>,
	Alexander Gordeev <agordeev@...ux.ibm.com>,
	Christian Borntraeger <borntraeger@...ux.ibm.com>,
	Sven Schnelle <svens@...ux.ibm.com>
Cc: Thorsten Blum <thorsten.blum@...ux.dev>,
	linux-s390@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] s390/hypfs_sprp: Replace kzalloc() + copy_from_user() with memdup_user()

Replace kzalloc() followed by copy_from_user() with memdup_user() to
improve and simplify __hypfs_sprp_ioctl().

Return early if an error occurs instead of trying to allocate memory for
'diag304' when memory allocation for 'data' already failed.

No functional changes intended.

Signed-off-by: Thorsten Blum <thorsten.blum@...ux.dev>
---
 arch/s390/hypfs/hypfs_sprp.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/arch/s390/hypfs/hypfs_sprp.c b/arch/s390/hypfs/hypfs_sprp.c
index 9fc3f0dae8f0..be11634bc7db 100644
--- a/arch/s390/hypfs/hypfs_sprp.c
+++ b/arch/s390/hypfs/hypfs_sprp.c
@@ -73,15 +73,16 @@ static int __hypfs_sprp_ioctl(void __user *user_area)
 	void *data;
 	int rc;
 
-	rc = -ENOMEM;
 	data = (void *)get_zeroed_page(GFP_KERNEL);
-	diag304 = kzalloc(sizeof(*diag304), GFP_KERNEL);
-	if (!data || !diag304)
-		goto out;
+	if (!data)
+		return -ENOMEM;
 
-	rc = -EFAULT;
-	if (copy_from_user(diag304, user_area, sizeof(*diag304)))
+	diag304 = memdup_user(user_area, sizeof(*diag304));
+	if (IS_ERR(diag304)) {
+		rc = PTR_ERR(diag304);
 		goto out;
+	}
+
 	rc = -EINVAL;
 	if ((diag304->args[0] >> 8) != 0 || diag304->args[1] > DIAG304_CMD_MAX)
 		goto out;
-- 
2.51.0