diff options
| -rw-r--r-- | drivers/md/dm-ioctl.c | 25 |
1 files changed, 11 insertions, 14 deletions
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 6d12775a106..3a8f6a0e6eb 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1501,11 +1501,6 @@ static int check_version(unsigned int cmd, struct dm_ioctl __user *user) return r; } -static void free_params(struct dm_ioctl *param) -{ - vfree(param); -} - static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl **param) { struct dm_ioctl tmp, *dmi; @@ -1520,13 +1515,15 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl **param) if (!dmi) return -ENOMEM; - if (copy_from_user(dmi, user, tmp.data_size)) { - vfree(dmi); - return -EFAULT; - } + if (copy_from_user(dmi, user, tmp.data_size)) + goto bad; *param = dmi; return 0; + +bad: + vfree(dmi); + return -EFAULT; } static int validate_params(uint cmd, struct dm_ioctl *param) @@ -1564,7 +1561,7 @@ static int ctl_ioctl(uint command, struct dm_ioctl __user *user) unsigned int cmd; struct dm_ioctl *uninitialized_var(param); ioctl_fn fn = NULL; - size_t param_size; + size_t input_param_size; /* only root can play with this */ if (!capable(CAP_SYS_ADMIN)) @@ -1605,6 +1602,7 @@ static int ctl_ioctl(uint command, struct dm_ioctl __user *user) * Copy the parameters into kernel space. */ r = copy_params(user, ¶m); + input_param_size = param->data_size; current->flags &= ~PF_MEMALLOC; @@ -1615,9 +1613,8 @@ static int ctl_ioctl(uint command, struct dm_ioctl __user *user) if (r) goto out; - param_size = param->data_size; param->data_size = sizeof(*param); - r = fn(param, param_size); + r = fn(param, input_param_size); /* * Copy the results back to userland. @@ -1625,8 +1622,8 @@ static int ctl_ioctl(uint command, struct dm_ioctl __user *user) if (!r && copy_to_user(user, param, param->data_size)) r = -EFAULT; - out: - free_params(param); +out: + vfree(param); return r; } |