Skip to content

Commit b2c52b8

Browse files
elfringjgross1
authored andcommitted
xen/privcmd: Use memdup_array_user() in alloc_ioreq()
* The function “memdup_array_user” was added with the commit 313ebe4 ("string.h: add array-wrappers for (v)memdup_user()"). Thus use it accordingly. This issue was detected by using the Coccinelle software. * Delete a label which became unnecessary with this refactoring. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://lore.kernel.org/r/41e333f7-1f3a-41b6-a121-a3c0ae54e36f@web.de Signed-off-by: Juergen Gross <jgross@suse.com>
1 parent 3693bb4 commit b2c52b8

File tree

1 file changed

+5
-10
lines changed

1 file changed

+5
-10
lines changed

drivers/xen/privcmd.c

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1223,18 +1223,13 @@ struct privcmd_kernel_ioreq *alloc_ioreq(struct privcmd_ioeventfd *ioeventfd)
12231223
kioreq->ioreq = (struct ioreq *)(page_to_virt(pages[0]));
12241224
mmap_write_unlock(mm);
12251225

1226-
size = sizeof(*ports) * kioreq->vcpus;
1227-
ports = kzalloc(size, GFP_KERNEL);
1228-
if (!ports) {
1229-
ret = -ENOMEM;
1226+
ports = memdup_array_user(u64_to_user_ptr(ioeventfd->ports),
1227+
kioreq->vcpus, sizeof(*ports));
1228+
if (IS_ERR(ports)) {
1229+
ret = PTR_ERR(ports);
12301230
goto error_kfree;
12311231
}
12321232

1233-
if (copy_from_user(ports, u64_to_user_ptr(ioeventfd->ports), size)) {
1234-
ret = -EFAULT;
1235-
goto error_kfree_ports;
1236-
}
1237-
12381233
for (i = 0; i < kioreq->vcpus; i++) {
12391234
kioreq->ports[i].vcpu = i;
12401235
kioreq->ports[i].port = ports[i];
@@ -1256,7 +1251,7 @@ struct privcmd_kernel_ioreq *alloc_ioreq(struct privcmd_ioeventfd *ioeventfd)
12561251
error_unbind:
12571252
while (--i >= 0)
12581253
unbind_from_irqhandler(irq_from_evtchn(ports[i]), &kioreq->ports[i]);
1259-
error_kfree_ports:
1254+
12601255
kfree(ports);
12611256
error_kfree:
12621257
kfree(kioreq);

0 commit comments

Comments
 (0)