diff options
| author | Markus Elfring <elfring@users.sourceforge.net> | 2024-01-28 17:50:43 +0100 |
|---|---|---|
| committer | Juergen Gross <jgross@suse.com> | 2024-02-13 08:58:21 +0100 |
| commit | b2c52b8c128ea07f1632c516cec0d72cb63b5599 (patch) | |
| tree | 7fc648a04da656f441be6e10f104881a80b05982 | |
| parent | 3693bb4465e6e32a204a5b86d3ec7e6b9f7e67c2 (diff) | |
| download | linux-b2c52b8c128ea07f1632c516cec0d72cb63b5599.tar.gz | |
xen/privcmd: Use memdup_array_user() in alloc_ioreq()
* The function “memdup_array_user” was added with the
commit 313ebe47d75558511aa1237b6e35c663b5c0ec6f ("string.h: add
array-wrappers for (v)memdup_user()").
Thus use it accordingly.
This issue was detected by using the Coccinelle software.
* Delete a label which became unnecessary with this refactoring.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/41e333f7-1f3a-41b6-a121-a3c0ae54e36f@web.de
Signed-off-by: Juergen Gross <jgross@suse.com>
| -rw-r--r-- | drivers/xen/privcmd.c | 15 |
1 files changed, 5 insertions, 10 deletions
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c index 35b6e306026a4b..67dfa477886493 100644 --- a/drivers/xen/privcmd.c +++ b/drivers/xen/privcmd.c @@ -1223,18 +1223,13 @@ struct privcmd_kernel_ioreq *alloc_ioreq(struct privcmd_ioeventfd *ioeventfd) kioreq->ioreq = (struct ioreq *)(page_to_virt(pages[0])); mmap_write_unlock(mm); - size = sizeof(*ports) * kioreq->vcpus; - ports = kzalloc(size, GFP_KERNEL); - if (!ports) { - ret = -ENOMEM; + ports = memdup_array_user(u64_to_user_ptr(ioeventfd->ports), + kioreq->vcpus, sizeof(*ports)); + if (IS_ERR(ports)) { + ret = PTR_ERR(ports); goto error_kfree; } - if (copy_from_user(ports, u64_to_user_ptr(ioeventfd->ports), size)) { - ret = -EFAULT; - goto error_kfree_ports; - } - for (i = 0; i < kioreq->vcpus; i++) { kioreq->ports[i].vcpu = i; kioreq->ports[i].port = ports[i]; @@ -1256,7 +1251,7 @@ struct privcmd_kernel_ioreq *alloc_ioreq(struct privcmd_ioeventfd *ioeventfd) error_unbind: while (--i >= 0) unbind_from_irqhandler(irq_from_evtchn(ports[i]), &kioreq->ports[i]); -error_kfree_ports: + kfree(ports); error_kfree: kfree(kioreq); |