* [PATCH v2] staging: r8188eu: Use strndup_user instead of kmalloc/copy_from_user
@ 2021-12-10 9:37 Jiapeng Chong
2021-12-10 10:04 ` Dan Carpenter
0 siblings, 1 reply; 2+ messages in thread
From: Jiapeng Chong @ 2021-12-10 9:37 UTC (permalink / raw)
To: Larry.Finger
Cc: phil, gregkh, linux-staging, linux-kernel, Jiapeng Chong, Abaci Robot
This code assumes that the user is going to give us a NULL terminated
string which is not necessarily true. The original code was buggy too.
Fix following coccicheck warning:
./drivers/staging/r8188eu/os_dep/ioctl_linux.c:4253:8-15: WARNING
opportunity for memdup_user.
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Fixes: 7bdedfef085b ("staging: r8188eu: Remove mp, a.k.a. manufacturing process, code")
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
---
Changes in v2:
-For the follow advice:https://lore.kernel.org/lkml/20211210083010.GM1956@kadam/
drivers/staging/r8188eu/os_dep/ioctl_linux.c | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
index 56adfe4087a8..5d26dffe5c0d 100644
--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
@@ -4250,17 +4250,12 @@ static int rtw_test(
DBG_88E("+%s\n", __func__);
len = wrqu->data.length;
- pbuf = kzalloc(len, GFP_KERNEL);
- if (!pbuf) {
- DBG_88E("%s: no memory!\n", __func__);
- return -ENOMEM;
- }
-
- if (copy_from_user(pbuf, wrqu->data.pointer, len)) {
- kfree(pbuf);
+ pbuf = strndup_user(wrqu->data.pointer, len);
+ if (IS_ERR(pbuf)) {
DBG_88E("%s: copy from user fail!\n", __func__);
- return -EFAULT;
+ return PTR_ERR(pbuf);
}
+
DBG_88E("%s: string =\"%s\"\n", __func__, pbuf);
ptmp = (char *)pbuf;
--
2.20.1.7.g153144c
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] staging: r8188eu: Use strndup_user instead of kmalloc/copy_from_user
2021-12-10 9:37 [PATCH v2] staging: r8188eu: Use strndup_user instead of kmalloc/copy_from_user Jiapeng Chong
@ 2021-12-10 10:04 ` Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2021-12-10 10:04 UTC (permalink / raw)
To: Jiapeng Chong
Cc: Larry.Finger, phil, gregkh, linux-staging, linux-kernel, Abaci Robot
On Fri, Dec 10, 2021 at 05:37:01PM +0800, Jiapeng Chong wrote:
> This code assumes that the user is going to give us a NULL terminated
I wouldn't comment on this except that the Fixes tag is wrong so it
needs to be resent anyway. NULL is a pointer. When it's a character
'\0'; then it's just one L "NUL terminated".
> string which is not necessarily true. The original code was buggy too.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Leave this out.
>
> Fix following coccicheck warning:
>
> ./drivers/staging/r8188eu/os_dep/ioctl_linux.c:4253:8-15: WARNING
> opportunity for memdup_user.
>
> Reported-by: Abaci Robot <abaci@linux.alibaba.com>
> Fixes: 7bdedfef085b ("staging: r8188eu: Remove mp, a.k.a. manufacturing process, code")
The fixes tag should be:
Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
> Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
> ---
> Changes in v2:
> -For the follow advice:https://lore.kernel.org/lkml/20211210083010.GM1956@kadam/
Don't put a link in the email. Just say what the difference is. No
one wants to have to click on a link.
>
> drivers/staging/r8188eu/os_dep/ioctl_linux.c | 13 ++++---------
> 1 file changed, 4 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
> index 56adfe4087a8..5d26dffe5c0d 100644
> --- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c
> +++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
> @@ -4250,17 +4250,12 @@ static int rtw_test(
> DBG_88E("+%s\n", __func__);
> len = wrqu->data.length;
>
> - pbuf = kzalloc(len, GFP_KERNEL);
> - if (!pbuf) {
> - DBG_88E("%s: no memory!\n", __func__);
> - return -ENOMEM;
> - }
> -
> - if (copy_from_user(pbuf, wrqu->data.pointer, len)) {
> - kfree(pbuf);
> + pbuf = strndup_user(wrqu->data.pointer, len);
> + if (IS_ERR(pbuf)) {
> DBG_88E("%s: copy from user fail!\n", __func__);
This printk is out of date now that we're not using the copy_from_user()
function. It doesn't add useful information. Just delete it.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-12-10 10:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-10 9:37 [PATCH v2] staging: r8188eu: Use strndup_user instead of kmalloc/copy_from_user Jiapeng Chong
2021-12-10 10:04 ` Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).