Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1bb0d7b7 authored by Michael J. Ruhl's avatar Michael J. Ruhl Committed by Doug Ledford
Browse files

IB/hfi1: Code reuse with memdup_copy 



Update several usages of kmalloc/user_copy to memdup_copy and
memdup_copy_nul.

Reviewed-by: default avatarDennis Dalessandro <dennis.dalessandro@intel.com>
Reviewed-by: default avatarMike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: default avatarMichael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: default avatarDennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 832666c1

drivers/infiniband/hw/hfi1/debugfs.c

+11 −28
Original line number Diff line number Diff line
@@ -50,6 +50,7 @@ 
#include <linux/kernel.h>

#include <linux/export.h>

#include <linux/module.h>

#include <linux/string.h>



#include "hfi.h"

#include "debugfs.h"
@@ -503,18 +504,11 @@ static ssize_t asic_flags_write(struct file *file, const char __user *buf, 
	ppd = private2ppd(file);

	dd = ppd->dd;



	buff = kmalloc(count + 1, GFP_KERNEL);

	if (!buff)

		return -ENOMEM;



	ret = copy_from_user(buff, buf, count);

	if (ret > 0) {

		ret = -EFAULT;

		goto do_free;

	}



	/* zero terminate and read the expected integer */

	buff[count] = 0;

	buff = memdup_user_nul(buf, count);

	if (IS_ERR(buff))

		return PTR_ERR(buff);



	ret = kstrtoull(buff, 0, &value);

	if (ret)

		goto do_free;
@@ -692,15 +686,9 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf, 
	if (i2c_addr == 0)

		return -EINVAL;



	buff = kmalloc(count, GFP_KERNEL);

	if (!buff)

		return -ENOMEM;



	ret = copy_from_user(buff, buf, count);

	if (ret > 0) {

		ret = -EFAULT;

		goto _free;

	}

	buff = memdup_user(buf, count);

	if (IS_ERR(buff))

		return PTR_ERR(buff);



	total_written = i2c_write(ppd, target, i2c_addr, offset, buff, count);

	if (total_written < 0) {
@@ -805,15 +793,10 @@ static ssize_t __qsfp_debugfs_write(struct file *file, const char __user *buf, 


	ppd = private2ppd(file);



	buff = kmalloc(count, GFP_KERNEL);

	if (!buff)

		return -ENOMEM;

	buff = memdup_user(buf, count);

	if (IS_ERR(buff))

		return PTR_ERR(buff);



	ret = copy_from_user(buff, buf, count);

	if (ret > 0) {

		ret = -EFAULT;

		goto _free;

	}

	total_written = qsfp_write(ppd, target, *ppos, buff, count);

	if (total_written < 0) {

		ret = total_written;

drivers/infiniband/hw/hfi1/user_exp_rcv.c

+6 −11
Original line number Diff line number Diff line
@@ -45,6 +45,7 @@ 
 *

 */

#include <asm/page.h>

#include <linux/string.h>



#include "user_exp_rcv.h"

#include "trace.h"
@@ -577,16 +578,10 @@ int hfi1_user_exp_rcv_clear(struct file *fp, struct hfi1_tid_info *tinfo) 
	u32 *tidinfo;

	unsigned tididx;



	tidinfo = kcalloc(tinfo->tidcnt, sizeof(*tidinfo), GFP_KERNEL);

	if (!tidinfo)

		return -ENOMEM;



	if (copy_from_user(tidinfo, (void __user *)(unsigned long)

			   tinfo->tidlist, sizeof(tidinfo[0]) *

			   tinfo->tidcnt)) {

		ret = -EFAULT;

		goto done;

	}

	tidinfo = memdup_user((void __user *)(unsigned long)tinfo->tidlist,

			      sizeof(tidinfo[0]) * tinfo->tidcnt);

	if (IS_ERR(tidinfo))

		return PTR_ERR(tidinfo);



	mutex_lock(&uctxt->exp_lock);

	for (tididx = 0; tididx < tinfo->tidcnt; tididx++) {
@@ -602,7 +597,7 @@ int hfi1_user_exp_rcv_clear(struct file *fp, struct hfi1_tid_info *tinfo) 
	spin_unlock(&fd->tid_lock);

	tinfo->tidcnt = tididx;

	mutex_unlock(&uctxt->exp_lock);

done:



	kfree(tidinfo);

	return ret;

}

drivers/infiniband/hw/hfi1/user_sdma.c

+8 −9
Original line number Diff line number Diff line
@@ -60,6 +60,7 @@ 
#include <linux/mmu_context.h>

#include <linux/module.h>

#include <linux/vmalloc.h>

#include <linux/string.h>



#include "hfi.h"

#include "sdma.h"
@@ -725,30 +726,28 @@ int hfi1_user_sdma_process_request(struct file *fp, struct iovec *iovec, 
	 */

	if (req_opcode(req->info.ctrl) == EXPECTED) {

		u16 ntids = iovec[idx].iov_len / sizeof(*req->tids);

		u32 *tmp;



		if (!ntids || ntids > MAX_TID_PAIR_ENTRIES) {

			ret = -EINVAL;

			goto free_req;

		}

		req->tids = kcalloc(ntids, sizeof(*req->tids), GFP_KERNEL);

		if (!req->tids) {

			ret = -ENOMEM;

			goto free_req;

		}



		/*

		 * We have to copy all of the tids because they may vary

		 * in size and, therefore, the TID count might not be

		 * equal to the pkt count. However, there is no way to

		 * tell at this point.

		 */

		ret = copy_from_user(req->tids, iovec[idx].iov_base,

		tmp = memdup_user(iovec[idx].iov_base,

				  ntids * sizeof(*req->tids));

		if (ret) {

		if (IS_ERR(tmp)) {

			ret = PTR_ERR(tmp);

			SDMA_DBG(req, "Failed to copy %d TIDs (%d)",

				 ntids, ret);

			ret = -EFAULT;

			goto free_req;

		}

		req->tids = tmp;

		req->n_tids = ntids;

		idx++;

	}