linux-kernel - Re: [PATCH] s390/hypfs_sprp: Replace kzalloc() + copy_from_user() with memdup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250912095620.10147A01-hca@linux.ibm.com>
Date: Fri, 12 Sep 2025 11:56:20 +0200
From: Heiko Carstens <hca@...ux.ibm.com>
To: Thorsten Blum <thorsten.blum@...ux.dev>
Cc: Vasily Gorbik <gor@...ux.ibm.com>,
        Alexander Gordeev <agordeev@...ux.ibm.com>,
        Christian Borntraeger <borntraeger@...ux.ibm.com>,
        Sven Schnelle <svens@...ux.ibm.com>, linux-s390@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] s390/hypfs_sprp: Replace kzalloc() + copy_from_user()
 with memdup_user()

On Thu, Sep 11, 2025 at 11:45:38PM +0200, Thorsten Blum wrote:
> Replace kzalloc() followed by copy_from_user() with memdup_user() to
> improve and simplify __hypfs_sprp_ioctl().
> 
> Return early if an error occurs instead of trying to allocate memory for
> 'diag304' when memory allocation for 'data' already failed.
> 
> No functional changes intended.
> 
> Signed-off-by: Thorsten Blum <thorsten.blum@...ux.dev>
> ---
>  arch/s390/hypfs/hypfs_sprp.c | 13 +++++++------
>  1 file changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/arch/s390/hypfs/hypfs_sprp.c b/arch/s390/hypfs/hypfs_sprp.c
> index 9fc3f0dae8f0..be11634bc7db 100644
> --- a/arch/s390/hypfs/hypfs_sprp.c
> +++ b/arch/s390/hypfs/hypfs_sprp.c
> @@ -73,15 +73,16 @@ static int __hypfs_sprp_ioctl(void __user *user_area)
>  	void *data;
>  	int rc;
>  
> -	rc = -ENOMEM;
>  	data = (void *)get_zeroed_page(GFP_KERNEL);
> -	diag304 = kzalloc(sizeof(*diag304), GFP_KERNEL);
> -	if (!data || !diag304)
> -		goto out;
> +	if (!data)
> +		return -ENOMEM;
>  
> -	rc = -EFAULT;
> -	if (copy_from_user(diag304, user_area, sizeof(*diag304)))
> +	diag304 = memdup_user(user_area, sizeof(*diag304));
> +	if (IS_ERR(diag304)) {
> +		rc = PTR_ERR(diag304);
>  		goto out;
> +	}

This is not an improvement and also incorrect, since kfree() may now
be called with an error pointer. Please don't send patches like this
which aren't a real improvement. This is just pointless code churn,
and a waste of time.