Commit 7114f51f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'work.memdup_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 

Pull memdup_user() conversions from Al Viro:
 "A fairly self-contained series - hunting down open-coded memdup_user()
  and memdup_user_nul() instances"

* 'work.memdup_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  bpf: don't open-code memdup_user()
  kimage_file_prepare_segments(): don't open-code memdup_user()
  ethtool: don't open-code memdup_user()
  do_ip_setsockopt(): don't open-code memdup_user()
  do_ipv6_setsockopt(): don't open-code memdup_user()
  irda: don't open-code memdup_user()
  xfrm_user_policy(): don't open-code memdup_user()
  ima_write_policy(): don't open-code memdup_user_nul()
  sel_write_validatetrans(): don't open-code memdup_user_nul()
parents ea3b25e1 e4448ed8

kernel/bpf/syscall.c

+16 −29
Original line number Diff line number Diff line
@@ -410,14 +410,11 @@ static int map_lookup_elem(union bpf_attr *attr) 
	if (IS_ERR(map))

		return PTR_ERR(map);



	err = -ENOMEM;

	key = kmalloc(map->key_size, GFP_USER);

	if (!key)

	key = memdup_user(ukey, map->key_size);

	if (IS_ERR(key)) {

		err = PTR_ERR(key);

		goto err_put;



	err = -EFAULT;

	if (copy_from_user(key, ukey, map->key_size) != 0)

		goto free_key;

	}



	if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||

	    map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH ||
@@ -493,14 +490,11 @@ static int map_update_elem(union bpf_attr *attr) 
	if (IS_ERR(map))

		return PTR_ERR(map);



	err = -ENOMEM;

	key = kmalloc(map->key_size, GFP_USER);

	if (!key)

	key = memdup_user(ukey, map->key_size);

	if (IS_ERR(key)) {

		err = PTR_ERR(key);

		goto err_put;



	err = -EFAULT;

	if (copy_from_user(key, ukey, map->key_size) != 0)

		goto free_key;

	}



	if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||

	    map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH ||
@@ -579,14 +573,11 @@ static int map_delete_elem(union bpf_attr *attr) 
	if (IS_ERR(map))

		return PTR_ERR(map);



	err = -ENOMEM;

	key = kmalloc(map->key_size, GFP_USER);

	if (!key)

	key = memdup_user(ukey, map->key_size);

	if (IS_ERR(key)) {

		err = PTR_ERR(key);

		goto err_put;



	err = -EFAULT;

	if (copy_from_user(key, ukey, map->key_size) != 0)

		goto free_key;

	}



	preempt_disable();

	__this_cpu_inc(bpf_prog_active);
@@ -598,7 +589,6 @@ static int map_delete_elem(union bpf_attr *attr) 


	if (!err)

		trace_bpf_map_delete_elem(map, ufd, key);

free_key:

	kfree(key);

err_put:

	fdput(f);
@@ -627,14 +617,11 @@ static int map_get_next_key(union bpf_attr *attr) 
		return PTR_ERR(map);



	if (ukey) {

		err = -ENOMEM;

		key = kmalloc(map->key_size, GFP_USER);

		if (!key)

		key = memdup_user(ukey, map->key_size);

		if (IS_ERR(key)) {

			err = PTR_ERR(key);

			goto err_put;



		err = -EFAULT;

		if (copy_from_user(key, ukey, map->key_size) != 0)

			goto free_key;

		}

	} else {

		key = NULL;

	}

kernel/kexec_file.c

+4 −10
Original line number Diff line number Diff line
@@ -162,16 +162,10 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, 
	}



	if (cmdline_len) {

		image->cmdline_buf = kzalloc(cmdline_len, GFP_KERNEL);

		if (!image->cmdline_buf) {

			ret = -ENOMEM;

			goto out;

		}



		ret = copy_from_user(image->cmdline_buf, cmdline_ptr,

				     cmdline_len);

		if (ret) {

			ret = -EFAULT;

		image->cmdline_buf = memdup_user(cmdline_ptr, cmdline_len);

		if (IS_ERR(image->cmdline_buf)) {

			ret = PTR_ERR(image->cmdline_buf);

			image->cmdline_buf = NULL;

			goto out;

		}

net/core/ethtool.c

+6 −14
Original line number Diff line number Diff line
@@ -2322,16 +2322,12 @@ static int ethtool_set_tunable(struct net_device *dev, void __user *useraddr) 
	ret = ethtool_tunable_valid(&tuna);

	if (ret)

		return ret;

	data = kmalloc(tuna.len, GFP_USER);

	if (!data)

		return -ENOMEM;

	useraddr += sizeof(tuna);

	ret = -EFAULT;

	if (copy_from_user(data, useraddr, tuna.len))

		goto out;

	data = memdup_user(useraddr, tuna.len);

	if (IS_ERR(data))

		return PTR_ERR(data);

	ret = ops->set_tunable(dev, &tuna, data);



out:

	kfree(data);

	return ret;

}
@@ -2507,18 +2503,14 @@ static int set_phy_tunable(struct net_device *dev, void __user *useraddr) 
	ret = ethtool_phy_tunable_valid(&tuna);

	if (ret)

		return ret;

	data = kmalloc(tuna.len, GFP_USER);

	if (!data)

		return -ENOMEM;

	useraddr += sizeof(tuna);

	ret = -EFAULT;

	if (copy_from_user(data, useraddr, tuna.len))

		goto out;

	data = memdup_user(useraddr, tuna.len);

	if (IS_ERR(data))

		return PTR_ERR(data);

	mutex_lock(&phydev->lock);

	ret = phydev->drv->set_tunable(phydev, &tuna, data);

	mutex_unlock(&phydev->lock);



out:

	kfree(data);

	return ret;

}

net/ipv4/ip_sockglue.c

+6 −14
Original line number Diff line number Diff line
@@ -934,14 +934,9 @@ static int do_ip_setsockopt(struct sock *sk, int level, 
			err = -ENOBUFS;

			break;

		}

		msf = kmalloc(optlen, GFP_KERNEL);

		if (!msf) {

			err = -ENOBUFS;

			break;

		}

		err = -EFAULT;

		if (copy_from_user(msf, optval, optlen)) {

			kfree(msf);

		msf = memdup_user(optval, optlen);

		if (IS_ERR(msf)) {

			err = PTR_ERR(msf);

			break;

		}

		/* numsrc >= (1G-4) overflow in 32 bits */
@@ -1090,14 +1085,11 @@ static int do_ip_setsockopt(struct sock *sk, int level, 
			err = -ENOBUFS;

			break;

		}

		gsf = kmalloc(optlen, GFP_KERNEL);

		if (!gsf) {

			err = -ENOBUFS;

		gsf = memdup_user(optval, optlen);

		if (IS_ERR(gsf)) {

			err = PTR_ERR(gsf);

			break;

		}

		err = -EFAULT;

		if (copy_from_user(gsf, optval, optlen))

			goto mc_msf_out;



		/* numsrc >= (4G-140)/128 overflow in 32 bits */

		if (gsf->gf_numsrc >= 0x1ffffff ||

net/ipv6/ipv6_sockglue.c

+3 −8
Original line number Diff line number Diff line
@@ -735,14 +735,9 @@ done: 
			retv = -ENOBUFS;

			break;

		}

		gsf = kmalloc(optlen, GFP_KERNEL);

		if (!gsf) {

			retv = -ENOBUFS;

			break;

		}

		retv = -EFAULT;

		if (copy_from_user(gsf, optval, optlen)) {

			kfree(gsf);

		gsf = memdup_user(optval, optlen);

		if (IS_ERR(gsf)) {

			retv = PTR_ERR(gsf);

			break;

		}

		/* numsrc >= (4G-140)/128 overflow in 32 bits */

CRA Git | Maintained and supported by SUSTech CRA and CCSE