2023-01-17 06:29:41

by Jiapeng Chong

Subject: [PATCH] s390/chsc: Switch over to memdup_user()

Use memdup_user rather than duplicating its implementation, this is a
little bit restricted to reduce false positives.

./drivers/s390/cio/chsc_sch.c:703:7-14: WARNING opportunity for memdup_user.

Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3785
Reported-by: Abaci Robot <[email protected]>
Signed-off-by: Jiapeng Chong <[email protected]>
---
drivers/s390/cio/chsc_sch.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index 180ab899289c..097769a955c3 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -700,15 +700,11 @@ static int chsc_ioctl_conf_comp_list(void __user *user_ccl)
sccl_area = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
if (!sccl_area)
return -ENOMEM;
- ccl = kzalloc(sizeof(*ccl), GFP_KERNEL);
- if (!ccl) {
- ret = -ENOMEM;
- goto out_free;
- }
- if (copy_from_user(ccl, user_ccl, sizeof(*ccl))) {
- ret = -EFAULT;
- goto out_free;
- }
+
+ ccl = memdup_user(user_ccl, sizeof(*ccl));
+ if (IS_ERR(ccl))
+ return PTR_ERR(ccl);
+
sccl_area->request.length = 0x0020;
sccl_area->request.code = 0x0030;
sccl_area->fmt = ccl->req.fmt;
--
2.20.1.7.g153144c

2023-01-17 08:13:11

by Christian Borntraeger

Subject: Re: [PATCH] s390/chsc: Switch over to memdup_user()

Am 17.01.23 um 07:04 schrieb Jiapeng Chong:
> Use memdup_user rather than duplicating its implementation, this is a
> little bit restricted to reduce false positives.
>
> ./drivers/s390/cio/chsc_sch.c:703:7-14: WARNING opportunity for memdup_user.
>
> Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3785
> Reported-by: Abaci Robot <[email protected]>
> Signed-off-by: Jiapeng Chong <[email protected]>
> ---
> drivers/s390/cio/chsc_sch.c | 14 +++++---------
> 1 file changed, 5 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
> index 180ab899289c..097769a955c3 100644
> --- a/drivers/s390/cio/chsc_sch.c
> +++ b/drivers/s390/cio/chsc_sch.c
> @@ -700,15 +700,11 @@ static int chsc_ioctl_conf_comp_list(void __user *user_ccl)
> sccl_area = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
> if (!sccl_area)
> return -ENOMEM;
> - ccl = kzalloc(sizeof(*ccl), GFP_KERNEL);
> - if (!ccl) {
> - ret = -ENOMEM;
> - goto out_free;
> - }
> - if (copy_from_user(ccl, user_ccl, sizeof(*ccl))) {
> - ret = -EFAULT;
> - goto out_free;
> - }
> +
> + ccl = memdup_user(user_ccl, sizeof(*ccl));
> + if (IS_ERR(ccl))
> + return PTR_ERR(ccl);

The old code did free sccl_area your code does not.

> +
> sccl_area->request.length = 0x0020;
> sccl_area->request.code = 0x0030;
> sccl_area->fmt = ccl->req.fmt;