Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <41023c65-16db-5f8b-c2d9-c794b3536896@linux.ibm.com>
Date:   Tue, 17 Jan 2023 08:37:39 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.6.0
Subject: Re: [PATCH] s390/chsc: Switch over to memdup_user()
To:     Jiapeng Chong <jiapeng.chong@linux.alibaba.com>,
        vneethv@linux.ibm.com
Cc:     oberpar@linux.ibm.com, hca@linux.ibm.com, gor@linux.ibm.com,
        agordeev@linux.ibm.com, svens@linux.ibm.com,
        linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org,
        Abaci Robot <abaci@linux.alibaba.com>
References: <20230117060443.62153-1-jiapeng.chong@linux.alibaba.com>
Content-Language: en-US
From:   Christian Borntraeger <borntraeger@linux.ibm.com>
In-Reply-To: <20230117060443.62153-1-jiapeng.chong@linux.alibaba.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
Precedence: bulk


Am 17.01.23 um 07:04 schrieb Jiapeng Chong:
> Use memdup_user rather than duplicating its implementation, this is a
> little bit restricted to reduce false positives.
> 
> ./drivers/s390/cio/chsc_sch.c:703:7-14: WARNING opportunity for memdup_user.
> 
> Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3785
> Reported-by: Abaci Robot <abaci@linux.alibaba.com>
> Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
> ---
>   drivers/s390/cio/chsc_sch.c | 14 +++++---------
>   1 file changed, 5 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
> index 180ab899289c..097769a955c3 100644
> --- a/drivers/s390/cio/chsc_sch.c
> +++ b/drivers/s390/cio/chsc_sch.c
> @@ -700,15 +700,11 @@ static int chsc_ioctl_conf_comp_list(void __user *user_ccl)
>   	sccl_area = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
>   	if (!sccl_area)
>   		return -ENOMEM;
> -	ccl = kzalloc(sizeof(*ccl), GFP_KERNEL);
> -	if (!ccl) {
> -		ret = -ENOMEM;
> -		goto out_free;
> -	}
> -	if (copy_from_user(ccl, user_ccl, sizeof(*ccl))) {
> -		ret = -EFAULT;
> -		goto out_free;
> -	}
> +
> +	ccl = memdup_user(user_ccl, sizeof(*ccl));
> +	if (IS_ERR(ccl))
> +		return PTR_ERR(ccl);

The old code did free sccl_area your code does not.

> +
>   	sccl_area->request.length = 0x0020;
>   	sccl_area->request.code = 0x0030;
>   	sccl_area->fmt = ccl->req.fmt;