[PATCH] s390/hypfs_sprp: Replace kzalloc() + copy_from_user() with memdup_user()

[PATCH] s390/hypfs_sprp: Replace kzalloc() + copy_from_user() with memdup_user()

[Thorsten Blum]

Replace kzalloc() followed by copy_from_user() with memdup_user() to
improve and simplify __hypfs_sprp_ioctl().

Return early if an error occurs instead of trying to allocate memory for
'diag304' when memory allocation for 'data' already failed.

No functional changes intended.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
 arch/s390/hypfs/hypfs_sprp.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/arch/s390/hypfs/hypfs_sprp.c b/arch/s390/hypfs/hypfs_sprp.c
index 9fc3f0dae8f0..be11634bc7db 100644
--- a/arch/s390/hypfs/hypfs_sprp.c
+++ b/arch/s390/hypfs/hypfs_sprp.c
@@ -73,15 +73,16 @@ static int __hypfs_sprp_ioctl(void __user *user_area)
 	void *data;
 	int rc;
 
-	rc = -ENOMEM;
 	data = (void *)get_zeroed_page(GFP_KERNEL);
-	diag304 = kzalloc(sizeof(*diag304), GFP_KERNEL);
-	if (!data || !diag304)
-		goto out;
+	if (!data)
+		return -ENOMEM;
 
-	rc = -EFAULT;
-	if (copy_from_user(diag304, user_area, sizeof(*diag304)))
+	diag304 = memdup_user(user_area, sizeof(*diag304));
+	if (IS_ERR(diag304)) {
+		rc = PTR_ERR(diag304);
 		goto out;
+	}
+
 	rc = -EINVAL;
 	if ((diag304->args[0] >> 8) != 0 || diag304->args[1] > DIAG304_CMD_MAX)
 		goto out;
-- 
2.51.0

Re: [PATCH] s390/hypfs_sprp: Replace kzalloc() + copy_from_user() with memdup_user()

[Heiko Carstens]

On Thu, Sep 11, 2025 at 11:45:38PM +0200, Thorsten Blum wrote:
> Replace kzalloc() followed by copy_from_user() with memdup_user() to
> improve and simplify __hypfs_sprp_ioctl().
> 
> Return early if an error occurs instead of trying to allocate memory for
> 'diag304' when memory allocation for 'data' already failed.
> 
> No functional changes intended.
> 
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> ---
>  arch/s390/hypfs/hypfs_sprp.c | 13 +++++++------
>  1 file changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/arch/s390/hypfs/hypfs_sprp.c b/arch/s390/hypfs/hypfs_sprp.c
> index 9fc3f0dae8f0..be11634bc7db 100644
> --- a/arch/s390/hypfs/hypfs_sprp.c
> +++ b/arch/s390/hypfs/hypfs_sprp.c
> @@ -73,15 +73,16 @@ static int __hypfs_sprp_ioctl(void __user *user_area)
>  	void *data;
>  	int rc;
>  
> -	rc = -ENOMEM;
>  	data = (void *)get_zeroed_page(GFP_KERNEL);
> -	diag304 = kzalloc(sizeof(*diag304), GFP_KERNEL);
> -	if (!data || !diag304)
> -		goto out;
> +	if (!data)
> +		return -ENOMEM;
>  
> -	rc = -EFAULT;
> -	if (copy_from_user(diag304, user_area, sizeof(*diag304)))
> +	diag304 = memdup_user(user_area, sizeof(*diag304));
> +	if (IS_ERR(diag304)) {
> +		rc = PTR_ERR(diag304);
>  		goto out;
> +	}

This is not an improvement and also incorrect, since kfree() may now
be called with an error pointer. Please don't send patches like this
which aren't a real improvement. This is just pointless code churn,
and a waste of time.

Re: [PATCH] s390/hypfs_sprp: Replace kzalloc() + copy_from_user() with memdup_user()

[Thorsten Blum]

On 12. Sep 2025, at 11:56, Heiko Carstens wrote:
> This is not an improvement and also incorrect, since kfree() may now
> be called with an error pointer.

Unless I'm missing something, kfree() works just fine with error
pointers. See linux/slab.h:

DEFINE_FREE(kfree, void *, if (!IS_ERR_OR_NULL(_T)) kfree(_T))

Re: [PATCH] s390/hypfs_sprp: Replace kzalloc() + copy_from_user() with memdup_user()

[Thorsten Blum]

On 12. Sep 2025, at 12:09, Thorsten Blum wrote:
> On 12. Sep 2025, at 11:56, Heiko Carstens wrote:
>> This is not an improvement and also incorrect, since kfree() may now
>> be called with an error pointer.
> 
> Unless I'm missing something, kfree() works just fine with error
> pointers. See linux/slab.h:
> 
> DEFINE_FREE(kfree, void *, if (!IS_ERR_OR_NULL(_T)) kfree(_T))

And unless kzalloc() is required here, memdup_user() is an improvement,
since it uses kmalloc() internally and avoids unnecessarily zeroing the
memory before overwriting it with copy_from_user().

Thanks,
Thorsten

Re: [PATCH] s390/hypfs_sprp: Replace kzalloc() + copy_from_user() with memdup_user()

[Heiko Carstens]

On Fri, Sep 12, 2025 at 12:51:05PM +0200, Thorsten Blum wrote:
> On 12. Sep 2025, at 12:09, Thorsten Blum wrote:
> > On 12. Sep 2025, at 11:56, Heiko Carstens wrote:
> >> This is not an improvement and also incorrect, since kfree() may now
> >> be called with an error pointer.
> > 
> > Unless I'm missing something, kfree() works just fine with error
> > pointers. See linux/slab.h:
> > 
> > DEFINE_FREE(kfree, void *, if (!IS_ERR_OR_NULL(_T)) kfree(_T))
> 
> And unless kzalloc() is required here, memdup_user() is an improvement,
> since it uses kmalloc() internally and avoids unnecessarily zeroing the
> memory before overwriting it with copy_from_user().

Again, there are gazillions of similar trivial cleanup patches possible. The
additional zeroing in this case doesn't matter at all, since this code is
executed once a year.

Reviewing and integrating such patches could keep us busy all day long.
So, please don't send such patches.

Patches which fix (potential) bugs are welcome however.

Re: [PATCH] s390/hypfs_sprp: Replace kzalloc() + copy_from_user() with memdup_user()

[Heiko Carstens]

On Fri, Sep 12, 2025 at 12:09:43PM +0200, Thorsten Blum wrote:
> On 12. Sep 2025, at 11:56, Heiko Carstens wrote:
> > This is not an improvement and also incorrect, since kfree() may now
> > be called with an error pointer.
> 
> Unless I'm missing something, kfree() works just fine with error
> pointers. See linux/slab.h:
> 
> DEFINE_FREE(kfree, void *, if (!IS_ERR_OR_NULL(_T)) kfree(_T))

This is for automatically freed memory, but not for the generic case.
See cd7eb8f83fcf ("mm/slab: make __free(kfree) accept error pointers").

Re: [PATCH] s390/hypfs_sprp: Replace kzalloc() + copy_from_user() with memdup_user()

[Thorsten Blum]

On 12. Sep 2025, at 13:06, Heiko Carstens wrote:
> On Fri, Sep 12, 2025 at 12:09:43PM +0200, Thorsten Blum wrote:
>> On 12. Sep 2025, at 11:56, Heiko Carstens wrote:
>>> This is not an improvement and also incorrect, since kfree() may now
>>> be called with an error pointer.
>> 
>> Unless I'm missing something, kfree() works just fine with error
>> pointers. See linux/slab.h:
>> 
>> DEFINE_FREE(kfree, void *, if (!IS_ERR_OR_NULL(_T)) kfree(_T))
> 
> This is for automatically freed memory, but not for the generic case.
> See cd7eb8f83fcf ("mm/slab: make __free(kfree) accept error pointers").

Interesting, I didn't know this doesn't work for the generic kfree().

Thanks,
Thorsten