On Wed, Jan 18, 2023 at 05:58:23PM +0800, Jiapeng Chong wrote: > Use memdup_user rather than duplicating its implementation, this is a > little bit restricted to reduce false positives. > > ./drivers/s390/cio/chsc_sch.c:703:7-14: WARNING opportunity for > memdup_user. > > Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3785 > Reported-by: Abaci Robot <abaci@xxxxxxxxxxxxxxxxx> > Signed-off-by: Jiapeng Chong <jiapeng.chong@xxxxxxxxxxxxxxxxx> > --- > Changes in v2: > -Add free_page((unsigned long)sccl_area); > > drivers/s390/cio/chsc_sch.c | 14 ++++++-------- > 1 file changed, 6 insertions(+), 8 deletions(-) > > diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c > index 180ab899289c..09dcce7ff24b 100644 > --- a/drivers/s390/cio/chsc_sch.c > +++ b/drivers/s390/cio/chsc_sch.c > @@ -700,15 +700,13 @@ static int chsc_ioctl_conf_comp_list(void __user *user_ccl) > sccl_area = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA); > if (!sccl_area) > return -ENOMEM; > - ccl = kzalloc(sizeof(*ccl), GFP_KERNEL); > - if (!ccl) { > - ret = -ENOMEM; > - goto out_free; > - } > - if (copy_from_user(ccl, user_ccl, sizeof(*ccl))) { > - ret = -EFAULT; > - goto out_free; > + > + ccl = memdup_user(user_ccl, sizeof(*ccl)); > + if (IS_ERR(ccl)) { > + free_page((unsigned long)sccl_area); > + return PTR_ERR(ccl); > } > + > sccl_area->request.length = 0x0020; > sccl_area->request.code = 0x0030; > sccl_area->fmt = ccl->req.fmt; Such a change would have to address other similar patterns in this source. Besides, it is not that obvious that swapping GFP_KERNEL for GFP_USER (memdup_user() is called with) is issue-free.
