linux-kernel - [PATCH] scsi: bfa: Replace kzalloc + copy_from_user with memdup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250918144031.175148-2-thorsten.blum@linux.dev>
Date: Thu, 18 Sep 2025 16:40:32 +0200
From: Thorsten Blum <thorsten.blum@...ux.dev>
To: Anil Gurumurthy <anil.gurumurthy@...gic.com>,
	Sudarsana Kalluru <sudarsana.kalluru@...gic.com>,
	"James E.J. Bottomley" <James.Bottomley@...senPartnership.com>,
	"Martin K. Petersen" <martin.petersen@...cle.com>
Cc: Thorsten Blum <thorsten.blum@...ux.dev>,
	linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] scsi: bfa: Replace kzalloc + copy_from_user with memdup_user

Replace kzalloc() followed by copy_from_user() with memdup_user() to
improve and simplify bfad_im_bsg_els_ct_request(). memdup_user() returns
either -ENOMEM or -EFAULT (instead of -EIO) if an error occurs.

Use u64_to_user_ptr() instead of manually casting 'bsg_data->payload'.

No functional changes intended other than returning the more idiomatic
error code -EFAULT.

Signed-off-by: Thorsten Blum <thorsten.blum@...ux.dev>
---
 drivers/scsi/bfa/bfad_bsg.c | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
index 54bd11e6d593..d90dfee95160 100644
--- a/drivers/scsi/bfa/bfad_bsg.c
+++ b/drivers/scsi/bfa/bfad_bsg.c
@@ -3392,21 +3392,10 @@ bfad_im_bsg_els_ct_request(struct bsg_job *job)
 	if (bsg_data == NULL)
 		goto out;
 
-	/*
-	 * Allocate buffer for bsg_fcpt and do a copy_from_user op for payload
-	 * buffer of size bsg_data->payload_len
-	 */
-	bsg_fcpt = kzalloc(bsg_data->payload_len, GFP_KERNEL);
-	if (!bsg_fcpt) {
-		rc = -ENOMEM;
-		goto out;
-	}
-
-	if (copy_from_user((uint8_t *)bsg_fcpt,
-				(void *)(unsigned long)bsg_data->payload,
-				bsg_data->payload_len)) {
-		kfree(bsg_fcpt);
-		rc = -EIO;
+	bsg_fcpt = memdup_user(u64_to_user_ptr(bsg_data->payload),
+			       bsg_data->payload_len);
+	if (IS_ERR(bsg_fcpt)) {
+		rc = PTR_ERR(bsg_fcpt);
 		goto out;
 	}
 
-- 
2.51.0