Hi Markus,
On Wed, Aug 24, 2016 at 8:40 PM, SF Markus Elfring
<elfring@xxxxxxxxxxxxxxxxxxxxx> wrote:
> From: Markus Elfring <elfring@xxxxxxxxxxxxxxxxxxxxx>
> Date: Wed, 24 Aug 2016 20:10:09 +0200
>
> * Reuse existing functionality from memdup_user() instead of keeping
> duplicate source code.
>
> This issue was detected by using the Coccinelle software.
>
> * Return directly if this copy operation failed.
>
> Reviewed-by: David Hildenbrand <dahi@xxxxxxxxxxxxxxxxxx>
> Signed-off-by: Markus Elfring <elfring@xxxxxxxxxxxxxxxxxxxxx>
> ---
>
> v2: Rebased on source files from "Linux next-20160824".
>
> arch/s390/kvm/guestdbg.c | 18 ++++--------------
> 1 file changed, 4 insertions(+), 14 deletions(-)
>
> diff --git a/arch/s390/kvm/guestdbg.c b/arch/s390/kvm/guestdbg.c
> index 70b71ac..d7c6a7f 100644
> --- a/arch/s390/kvm/guestdbg.c
> +++ b/arch/s390/kvm/guestdbg.c
> @@ -216,20 +216,10 @@ int kvm_s390_import_bp_data(struct kvm_vcpu *vcpu,
> else if (dbg->arch.nr_hw_bp > MAX_BP_COUNT)
> return -EINVAL;
>
> - bp_data = kmalloc_array(dbg->arch.nr_hw_bp,
> - sizeof(*bp_data),
> - GFP_KERNEL);
Probably not an issue here, but if "sizeof(*bp_data) * dbg->arch.nr_hw_bp"
overflows, kmalloc_array() would have returned NULL here...
> - if (!bp_data) {
> - ret = -ENOMEM;
> - goto error;
> - }
> -
> - if (copy_from_user(bp_data,
> - dbg->arch.hw_bp,
> - sizeof(*bp_data) * dbg->arch.nr_hw_bp)) {
> - ret = -EFAULT;
> - goto error;
> - }
> + bp_data = memdup_user(dbg->arch.hw_bp,
> + sizeof(*bp_data) * dbg->arch.nr_hw_bp);
... while this would continue silently, and corrupt memory.
> + if (IS_ERR(bp_data))
> + return PTR_ERR(bp_data);
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
