Commit 16e5c1fc authored by Al Viro's avatar Al Viro
Browse files

convert a bunch of open-coded instances of memdup_user_nul() 



A _lot_ of ->write() instances were open-coding it; some are
converted to memdup_user_nul(), a lot more remain...

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 7e935c7c

arch/xtensa/platforms/iss/simdisk.c

+3 −9
Original line number Diff line number Diff line
@@ -227,16 +227,12 @@ static ssize_t proc_read_simdisk(struct file *file, char __user *buf, 
static ssize_t proc_write_simdisk(struct file *file, const char __user *buf,

			size_t count, loff_t *ppos)

{

	char *tmp = kmalloc(count + 1, GFP_KERNEL);

	char *tmp = memdup_user_nul(buf, count);

	struct simdisk *dev = PDE_DATA(file_inode(file));

	int err;



	if (tmp == NULL)

		return -ENOMEM;

	if (copy_from_user(tmp, buf, count)) {

		err = -EFAULT;

		goto out_free;

	}

	if (IS_ERR(tmp))

		return PTR_ERR(tmp);



	err = simdisk_detach(dev);

	if (err != 0)
@@ -244,8 +240,6 @@ static ssize_t proc_write_simdisk(struct file *file, const char __user *buf, 


	if (count > 0 && tmp[count - 1] == '\n')

		tmp[count - 1] = 0;

	else

		tmp[count] = 0;



	if (tmp[0])

		err = simdisk_attach(dev, tmp);

drivers/net/wireless/ath/wil6210/debugfs.c

+3 −9
Original line number Diff line number Diff line
@@ -580,16 +580,10 @@ static ssize_t wil_write_file_rxon(struct file *file, const char __user *buf, 
	long channel;

	bool on;



	char *kbuf = kmalloc(len + 1, GFP_KERNEL);



	if (!kbuf)

		return -ENOMEM;

	if (copy_from_user(kbuf, buf, len)) {

		kfree(kbuf);

		return -EIO;

	}

	char *kbuf = memdup_user_nul(buf, len);



	kbuf[len] = '\0';

	if (IS_ERR(kbuf))

		return PTR_ERR(kbuf);

	rc = kstrtol(kbuf, 0, &channel);

	kfree(kbuf);

	if (rc)

drivers/s390/char/vmcp.c

+3 −8
Original line number Diff line number Diff line
@@ -88,14 +88,9 @@ vmcp_write(struct file *file, const char __user *buff, size_t count, 


	if (count > 240)

		return -EINVAL;

	cmd = kmalloc(count + 1, GFP_KERNEL);

	if (!cmd)

		return -ENOMEM;

	if (copy_from_user(cmd, buff, count)) {

		kfree(cmd);

		return -EFAULT;

	}

	cmd[count] = '\0';

	cmd = memdup_user_nul(buff, count);

	if (IS_ERR(cmd))

		return PTR_ERR(cmd);

	session = file->private_data;

	if (mutex_lock_interruptible(&session->mutex)) {

		kfree(cmd);

drivers/sbus/char/openprom.c

+3 −10
Original line number Diff line number Diff line
@@ -390,16 +390,9 @@ static int copyin_string(char __user *user, size_t len, char **ptr) 
	if ((ssize_t)len < 0 || (ssize_t)(len + 1) < 0)

		return -EINVAL;



	tmp = kmalloc(len + 1, GFP_KERNEL);

	if (!tmp)

		return -ENOMEM;



	if (copy_from_user(tmp, user, len)) {

		kfree(tmp);

		return -EFAULT;

	}



	tmp[len] = '\0';

	tmp = memdup_user_nul(user, len);

	if (IS_ERR(tmp))

		return PTR_ERR(tmp);



	*ptr = tmp;

fs/afs/proc.c

+6 −19
Original line number Diff line number Diff line
@@ -230,14 +230,9 @@ static ssize_t afs_proc_cells_write(struct file *file, const char __user *buf, 
	if (size <= 1 || size >= PAGE_SIZE)

		return -EINVAL;



	kbuf = kmalloc(size + 1, GFP_KERNEL);

	if (!kbuf)

		return -ENOMEM;



	ret = -EFAULT;

	if (copy_from_user(kbuf, buf, size) != 0)

		goto done;

	kbuf[size] = 0;

	kbuf = memdup_user_nul(buf, size);

	if (IS_ERR(kbuf))

		return PTR_ERR(kbuf);



	/* trim to first NL */

	name = memchr(kbuf, '\n', size);
@@ -315,15 +310,9 @@ static ssize_t afs_proc_rootcell_write(struct file *file, 
	if (size <= 1 || size >= PAGE_SIZE)

		return -EINVAL;



	ret = -ENOMEM;

	kbuf = kmalloc(size + 1, GFP_KERNEL);

	if (!kbuf)

		goto nomem;



	ret = -EFAULT;

	if (copy_from_user(kbuf, buf, size) != 0)

		goto infault;

	kbuf[size] = 0;

	kbuf = memdup_user_nul(buf, size);

	if (IS_ERR(kbuf))

		return PTR_ERR(kbuf);



	/* trim to first NL */

	s = memchr(kbuf, '\n', size);
@@ -337,9 +326,7 @@ static ssize_t afs_proc_rootcell_write(struct file *file, 
	if (ret >= 0)

		ret = size;	/* consume everything, always */



infault:

	kfree(kbuf);

nomem:

	_leave(" = %d", ret);

	return ret;

}