diff options
| author | Julia Lawall <julia@diku.dk> | 2010-05-22 05:21:02 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2010-08-02 15:20:28 -0300 |
| commit | c6cfe05532cf6e9858d60ee699c51b906842489d (patch) | |
| tree | bc3dc3f1fd92ad0100bd88ec373a9524e20205c8 | |
| parent | 3e9442c6f1d50bce083c5870f293647efbd6f828 (diff) | |
V4L/DVB: drivers/media: Use memdup_user
Use memdup_user when user data is immediately copied into the
allocated region.
The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)
// <smpl>
@@
expression from,to,size,flag;
position p;
identifier l1,l2;
@@
- to = \(kmalloc@p\|kzalloc@p\)(size,flag);
+ to = memdup_user(from,size);
if (
- to==NULL
+ IS_ERR(to)
|| ...) {
<+... when != goto l1;
- -ENOMEM
+ PTR_ERR(to)
...+>
}
- if (copy_from_user(to, from, size) != 0) {
- <+... when != goto l2;
- -EFAULT
- ...+>
- }
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| -rw-r--r-- | drivers/media/dvb/dvb-core/dvb_demux.c | 10 | ||||
| -rw-r--r-- | drivers/media/video/dabusb.c | 13 |
2 files changed, 7 insertions, 16 deletions
diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c index 977ddba3e23..4a88a3e4db2 100644 --- a/drivers/media/dvb/dvb-core/dvb_demux.c +++ b/drivers/media/dvb/dvb-core/dvb_demux.c @@ -1130,13 +1130,9 @@ static int dvbdmx_write(struct dmx_demux *demux, const char __user *buf, size_t if ((!demux->frontend) || (demux->frontend->source != DMX_MEMORY_FE)) return -EINVAL; - p = kmalloc(count, GFP_USER); - if (!p) - return -ENOMEM; - if (copy_from_user(p, buf, count)) { - kfree(p); - return -EFAULT; - } + p = memdup_user(buf, count); + if (IS_ERR(p)) + return PTR_ERR(p); if (mutex_lock_interruptible(&dvbdemux->mutex)) { kfree(p); return -ERESTARTSYS; diff --git a/drivers/media/video/dabusb.c b/drivers/media/video/dabusb.c index 0f505086774..5b176bd7afd 100644 --- a/drivers/media/video/dabusb.c +++ b/drivers/media/video/dabusb.c @@ -706,16 +706,11 @@ static long dabusb_ioctl (struct file *file, unsigned int cmd, unsigned long arg switch (cmd) { case IOCTL_DAB_BULK: - pbulk = kmalloc(sizeof (bulk_transfer_t), GFP_KERNEL); + pbulk = memdup_user((void __user *)arg, + sizeof(bulk_transfer_t)); - if (!pbulk) { - ret = -ENOMEM; - break; - } - - if (copy_from_user (pbulk, (void __user *) arg, sizeof (bulk_transfer_t))) { - ret = -EFAULT; - kfree (pbulk); + if (IS_ERR(pbulk)) { + ret = PTR_ERR(pbulk); break; } |