提交 a2c841d9 编写于 作者: A Al Viro

do_ip_setsockopt(): don't open-code memdup_user()

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
上级 43727da9
...@@ -934,14 +934,9 @@ static int do_ip_setsockopt(struct sock *sk, int level, ...@@ -934,14 +934,9 @@ static int do_ip_setsockopt(struct sock *sk, int level,
err = -ENOBUFS; err = -ENOBUFS;
break; break;
} }
msf = kmalloc(optlen, GFP_KERNEL); msf = memdup_user(optval, optlen);
if (!msf) { if (IS_ERR(msf)) {
err = -ENOBUFS; err = PTR_ERR(msf);
break;
}
err = -EFAULT;
if (copy_from_user(msf, optval, optlen)) {
kfree(msf);
break; break;
} }
/* numsrc >= (1G-4) overflow in 32 bits */ /* numsrc >= (1G-4) overflow in 32 bits */
...@@ -1090,14 +1085,11 @@ static int do_ip_setsockopt(struct sock *sk, int level, ...@@ -1090,14 +1085,11 @@ static int do_ip_setsockopt(struct sock *sk, int level,
err = -ENOBUFS; err = -ENOBUFS;
break; break;
} }
gsf = kmalloc(optlen, GFP_KERNEL); gsf = memdup_user(optval, optlen);
if (!gsf) { if (IS_ERR(gsf)) {
err = -ENOBUFS; err = PTR_ERR(gsf);
break; break;
} }
err = -EFAULT;
if (copy_from_user(gsf, optval, optlen))
goto mc_msf_out;
/* numsrc >= (4G-140)/128 overflow in 32 bits */ /* numsrc >= (4G-140)/128 overflow in 32 bits */
if (gsf->gf_numsrc >= 0x1ffffff || if (gsf->gf_numsrc >= 0x1ffffff ||
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册