Commit 4dfcc271 authored by Dmitry Torokhov's avatar Dmitry Torokhov

Input: uinput - use memdup_user() and friends

Instead of open-coding copying of data structures from userspace use
memdup_user() and strndup_user(). Note that this introduces change in
behavior because driver used to truncate 'phys' longer than 1024 bytes,
but now it will refuse to set 'phys' that long. Arguably trying to set
such 'phys' is suspect anyways.
Signed-off-by: default avatarDmitry Torokhov <dtor@mail.ru>
parent 5d9d6e91
...@@ -361,14 +361,9 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu ...@@ -361,14 +361,9 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu
dev = udev->dev; dev = udev->dev;
user_dev = kmalloc(sizeof(struct uinput_user_dev), GFP_KERNEL); user_dev = memdup_user(buffer, sizeof(struct uinput_user_dev));
if (!user_dev) if (!IS_ERR(user_dev))
return -ENOMEM; return PTR_ERR(user_dev);
if (copy_from_user(user_dev, buffer, sizeof(struct uinput_user_dev))) {
retval = -EFAULT;
goto exit;
}
udev->ff_effects_max = user_dev->ff_effects_max; udev->ff_effects_max = user_dev->ff_effects_max;
...@@ -621,7 +616,6 @@ static long uinput_ioctl_handler(struct file *file, unsigned int cmd, ...@@ -621,7 +616,6 @@ static long uinput_ioctl_handler(struct file *file, unsigned int cmd,
struct uinput_ff_upload ff_up; struct uinput_ff_upload ff_up;
struct uinput_ff_erase ff_erase; struct uinput_ff_erase ff_erase;
struct uinput_request *req; struct uinput_request *req;
int length;
char *phys; char *phys;
retval = mutex_lock_interruptible(&udev->mutex); retval = mutex_lock_interruptible(&udev->mutex);
...@@ -688,24 +682,15 @@ static long uinput_ioctl_handler(struct file *file, unsigned int cmd, ...@@ -688,24 +682,15 @@ static long uinput_ioctl_handler(struct file *file, unsigned int cmd,
retval = -EINVAL; retval = -EINVAL;
goto out; goto out;
} }
length = strnlen_user(p, 1024);
if (length <= 0) { phys = strndup_user(p, 1024);
retval = -EFAULT; if (IS_ERR(phys)) {
break; retval = PTR_ERR(phys);
goto out;
} }
kfree(udev->dev->phys); kfree(udev->dev->phys);
udev->dev->phys = phys = kmalloc(length, GFP_KERNEL); udev->dev->phys = phys;
if (!phys) {
retval = -ENOMEM;
break;
}
if (copy_from_user(phys, p, length)) {
udev->dev->phys = NULL;
kfree(phys);
retval = -EFAULT;
break;
}
phys[length - 1] = '\0';
break; break;
case UI_BEGIN_FF_UPLOAD: case UI_BEGIN_FF_UPLOAD:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment