提交 8f507c8b 编写于 作者: D Dmitry Torokhov 提交者: Jiri Kosina

HID: hidraw: switch to using memdup_user

Instead of open-coding memory allocation and copying form user memory
sequence let's use memdup_user().
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
上级 d66435cc
...@@ -34,6 +34,7 @@ ...@@ -34,6 +34,7 @@
#include <linux/hid.h> #include <linux/hid.h>
#include <linux/mutex.h> #include <linux/mutex.h>
#include <linux/sched.h> #include <linux/sched.h>
#include <linux/string.h>
#include <linux/hidraw.h> #include <linux/hidraw.h>
...@@ -123,7 +124,6 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer, ...@@ -123,7 +124,6 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
dev = hidraw_table[minor]->hid; dev = hidraw_table[minor]->hid;
if (count > HID_MAX_BUFFER_SIZE) { if (count > HID_MAX_BUFFER_SIZE) {
hid_warn(dev, "pid %d passed too large report\n", hid_warn(dev, "pid %d passed too large report\n",
task_pid_nr(current)); task_pid_nr(current));
...@@ -138,17 +138,12 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer, ...@@ -138,17 +138,12 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
goto out; goto out;
} }
buf = kmalloc(count * sizeof(__u8), GFP_KERNEL); buf = memdup_user(buffer, count);
if (!buf) { if (IS_ERR(buf)) {
ret = -ENOMEM; ret = PTR_ERR(buf);
goto out; goto out;
} }
if (copy_from_user(buf, buffer, count)) {
ret = -EFAULT;
goto out_free;
}
if ((report_type == HID_OUTPUT_REPORT) && if ((report_type == HID_OUTPUT_REPORT) &&
!(dev->quirks & HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP)) { !(dev->quirks & HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP)) {
ret = hid_hw_output_report(dev, buf, count); ret = hid_hw_output_report(dev, buf, count);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册