Re: [PATCH v2 2/2] KVM: s390: Use memdup_user() rather than duplicating code

Geert Uytterhoeven
2016-10-03T12:11:18Z

Hi Markus,

On Wed, Aug 24, 2016 at 8:40 PM, SF Markus Elfring
<elfring@users.sourceforge.net> wrote:
> From: Markus Elfring <elfring@users.sourceforge.net>
> Date: Wed, 24 Aug 2016 20:10:09 +0200
>
> * Reuse existing functionality from memdup_user() instead of keeping
> duplicate source code.
>
> This issue was detected by using the Coccinelle software.
>
> * Return directly if this copy operation failed.
>
> Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
> Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
> ---
>
> v2: Rebased on source files from "Linux next-20160824".
>
> arch/s390/kvm/guestdbg.c | 18 ++++--------------
> 1 file changed, 4 insertions(+), 14 deletions(-)
>
> diff --git a/arch/s390/kvm/guestdbg.c b/arch/s390/kvm/guestdbg.c
> index 70b71ac..d7c6a7f 100644
> --- a/arch/s390/kvm/guestdbg.c
> +++ b/arch/s390/kvm/guestdbg.c
> @@ -216,20 +216,10 @@ int kvm_s390_import_bp_data(struct kvm_vcpu *vcpu,
> else if (dbg->arch.nr_hw_bp > MAX_BP_COUNT)
> return -EINVAL;
>
> - bp_data = kmalloc_array(dbg->arch.nr_hw_bp,
> - sizeof(*bp_data),
> - GFP_KERNEL);

Probably not an issue here, but if "sizeof(*bp_data) * dbg->arch.nr_hw_bp"
overflows, kmalloc_array() would have returned NULL here...

> - if (!bp_data) {
> - ret = -ENOMEM;
> - goto error;
> - }
> -
> - if (copy_from_user(bp_data,
> - dbg->arch.hw_bp,
> - sizeof(*bp_data) * dbg->arch.nr_hw_bp)) {
> - ret = -EFAULT;
> - goto error;
> - }
> + bp_data = memdup_user(dbg->arch.hw_bp,
> + sizeof(*bp_data) * dbg->arch.nr_hw_bp);

... while this would continue silently, and corrupt memory.

> + if (IS_ERR(bp_data))
> + return PTR_ERR(bp_data);

Gr{oetje,eeting}s,

Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds