Messages in this thread |  | | From | Geert Uytterhoeven <> | Date | Mon, 3 Oct 2016 14:11:18 +0200 | Subject | Re: [PATCH v2 2/2] KVM: s390: Use memdup_user() rather than duplicating code |
| |
Hi Markus,
On Wed, Aug 24, 2016 at 8:40 PM, SF Markus Elfring <elfring@users.sourceforge.net> wrote: > From: Markus Elfring <elfring@users.sourceforge.net> > Date: Wed, 24 Aug 2016 20:10:09 +0200 > > * Reuse existing functionality from memdup_user() instead of keeping > duplicate source code. > > This issue was detected by using the Coccinelle software. > > * Return directly if this copy operation failed. > > Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> > Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> > --- > > v2: Rebased on source files from "Linux next-20160824". > > arch/s390/kvm/guestdbg.c | 18 ++++-------------- > 1 file changed, 4 insertions(+), 14 deletions(-) > > diff --git a/arch/s390/kvm/guestdbg.c b/arch/s390/kvm/guestdbg.c > index 70b71ac..d7c6a7f 100644 > --- a/arch/s390/kvm/guestdbg.c > +++ b/arch/s390/kvm/guestdbg.c > @@ -216,20 +216,10 @@ int kvm_s390_import_bp_data(struct kvm_vcpu *vcpu, > else if (dbg->arch.nr_hw_bp > MAX_BP_COUNT) > return -EINVAL; > > - bp_data = kmalloc_array(dbg->arch.nr_hw_bp, > - sizeof(*bp_data), > - GFP_KERNEL);
Probably not an issue here, but if "sizeof(*bp_data) * dbg->arch.nr_hw_bp" overflows, kmalloc_array() would have returned NULL here...
> - if (!bp_data) { > - ret = -ENOMEM; > - goto error; > - } > - > - if (copy_from_user(bp_data, > - dbg->arch.hw_bp, > - sizeof(*bp_data) * dbg->arch.nr_hw_bp)) { > - ret = -EFAULT; > - goto error; > - } > + bp_data = memdup_user(dbg->arch.hw_bp, > + sizeof(*bp_data) * dbg->arch.nr_hw_bp);
... while this would continue silently, and corrupt memory.
> + if (IS_ERR(bp_data)) > + return PTR_ERR(bp_data);
Gr{oetje,eeting}s,
Geert
-- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds
|  |