drivers/mtd: Use memdup_user

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=df1f1d1cb43b4ffdef5ba5f0623e2f73e94ce030
Commit:     df1f1d1cb43b4ffdef5ba5f0623e2f73e94ce030
Parent:     39c5837d7968ffd68e1d3c79efba1631b7f513d9
Author:     Julia Lawall <julia at diku.dk>
AuthorDate: Sat May 22 10:22:49 2010 +0200
Committer:  David Woodhouse <David.Woodhouse at intel.com>
CommitDate: Sat May 22 11:49:37 2010 +0100

    drivers/mtd: Use memdup_user
    
    Use memdup_user when user data is immediately copied into the
    allocated region.
    
    The semantic patch that makes this change is as follows:
    (http://coccinelle.lip6.fr/)
    
    // <smpl>
    @@
    expression from,to,size,flag;
    position p;
    identifier l1,l2;
    @@
    
    -  to = \(kmalloc at p\|kzalloc at p\)(size,flag);
    +  to = memdup_user(from,size);
       if (
    -      to==NULL
    +      IS_ERR(to)
                     || ...) {
       <+... when != goto l1;
    -  -ENOMEM
    +  PTR_ERR(to)
       ...+>
       }
    -  if (copy_from_user(to, from, size) != 0) {
    -    <+... when != goto l2;
    -    -EFAULT
    -    ...+>
    -  }
    // </smpl>
    
    Signed-off-by: Julia Lawall <julia at diku.dk>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
---
 drivers/mtd/mtdchar.c |   11 +++--------
 1 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 8bb5e4a..8b223c0 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -404,14 +404,9 @@ static int mtd_do_writeoob(struct file *file, struct mtd_info *mtd,
 	if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
 		return -EINVAL;
 
-	ops.oobbuf = kmalloc(length, GFP_KERNEL);
-	if (!ops.oobbuf)
-		return -ENOMEM;
-
-	if (copy_from_user(ops.oobbuf, ptr, length)) {
-		kfree(ops.oobbuf);
-		return -EFAULT;
-	}
+	ops.oobbuf = memdup_user(ptr, length);
+	if (IS_ERR(ops.oobbuf))
+		return PTR_ERR(ops.oobbuf);
 
 	start &= ~((uint64_t)mtd->oobsize - 1);
 	ret = mtd->write_oob(mtd, start, &ops);