* [PATCH] misc: fastrpc: Use memdup_user()
@ 2024-05-07 20:12 Thorsten Blum
2024-05-07 20:48 ` Arnd Bergmann
0 siblings, 1 reply; 6+ messages in thread
From: Thorsten Blum @ 2024-05-07 20:12 UTC (permalink / raw
To: Srinivas Kandagatla, Amol Maheshwari, Arnd Bergmann,
Greg Kroah-Hartman
Cc: linux-arm-msm, linux-kernel, Thorsten Blum
Switching to memdup_user() overwrites the allocated memory only once,
whereas kzalloc() followed by copy_from_user() initializes the allocated
memory to zero and then immediately overwrites it.
Fixes the following Coccinelle/coccicheck warning reported by
memdup_user.cocci:
WARNING opportunity for memdup_user
Signed-off-by: Thorsten Blum <thorsten.blum@toblux.com>
---
drivers/misc/fastrpc.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 4c67e2c5a82e..2857cddaf812 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1259,17 +1259,12 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl,
goto err;
}
- name = kzalloc(init.namelen, GFP_KERNEL);
- if (!name) {
- err = -ENOMEM;
+ name = memdup_user((void __user *)(uintptr_t)init.name, init.namelen);
+ if (IS_ERR(name)) {
+ err = PTR_ERR(name);
goto err;
}
- if (copy_from_user(name, (void __user *)(uintptr_t)init.name, init.namelen)) {
- err = -EFAULT;
- goto err_name;
- }
-
if (!fl->cctx->remote_heap) {
err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen,
&fl->cctx->remote_heap);
--
2.45.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] misc: fastrpc: Use memdup_user()
2024-05-07 20:12 [PATCH] misc: fastrpc: Use memdup_user() Thorsten Blum
@ 2024-05-07 20:48 ` Arnd Bergmann
2024-05-07 22:22 ` [PATCH v2] " Thorsten Blum
0 siblings, 1 reply; 6+ messages in thread
From: Arnd Bergmann @ 2024-05-07 20:48 UTC (permalink / raw
To: Thorsten Blum, Srinivas Kandagatla, Amol Maheshwari,
Greg Kroah-Hartman
Cc: linux-arm-msm, linux-kernel
On Tue, May 7, 2024, at 22:12, Thorsten Blum wrote:
> Switching to memdup_user() overwrites the allocated memory only once,
> whereas kzalloc() followed by copy_from_user() initializes the allocated
> memory to zero and then immediately overwrites it.
>
> Fixes the following Coccinelle/coccicheck warning reported by
> memdup_user.cocci:
>
> WARNING opportunity for memdup_user
>
> Signed-off-by: Thorsten Blum <thorsten.blum@toblux.com>
The patch looks correct to me.
> ---
> drivers/misc/fastrpc.c | 11 +++--------
> 1 file changed, 3 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
> index 4c67e2c5a82e..2857cddaf812 100644
> --- a/drivers/misc/fastrpc.c
> +++ b/drivers/misc/fastrpc.c
> @@ -1259,17 +1259,12 @@ static int
> fastrpc_init_create_static_process(struct fastrpc_user *fl,
> goto err;
> }
>
> - name = kzalloc(init.namelen, GFP_KERNEL);
> - if (!name) {
> - err = -ENOMEM;
> + name = memdup_user((void __user *)(uintptr_t)init.name, init.namelen);
> + if (IS_ERR(name)) {
> + err = PTR_ERR(name);
> goto err;
> }
There is also a chance to simplify this further using u64_to_user_ptr()
instead of the double cast if you want.
Acked-by: Arnd Bergmann <arnd@arndb.de>
Arnd
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] misc: fastrpc: Use memdup_user()
2024-05-07 20:48 ` Arnd Bergmann
@ 2024-05-07 22:22 ` Thorsten Blum
2024-05-27 8:44 ` [RESEND PATCH " Thorsten Blum
2024-05-28 11:45 ` [PATCH " Srinivas Kandagatla
0 siblings, 2 replies; 6+ messages in thread
From: Thorsten Blum @ 2024-05-07 22:22 UTC (permalink / raw
To: arnd
Cc: amahesh, gregkh, linux-arm-msm, linux-kernel, srinivas.kandagatla,
thorsten.blum
Switching to memdup_user() overwrites the allocated memory only once,
whereas kzalloc() followed by copy_from_user() initializes the allocated
memory to zero and then immediately overwrites it.
Fixes the following Coccinelle/coccicheck warning reported by
memdup_user.cocci:
WARNING opportunity for memdup_user
Signed-off-by: Thorsten Blum <thorsten.blum@toblux.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
---
Changes in v2:
- Use u64_to_user_ptr() as suggested by Arnd Bergmann (thanks!)
- Preserve Acked-by: tag
---
drivers/misc/fastrpc.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 4c67e2c5a82e..694fc083b1bd 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1259,17 +1259,12 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl,
goto err;
}
- name = kzalloc(init.namelen, GFP_KERNEL);
- if (!name) {
- err = -ENOMEM;
+ name = memdup_user(u64_to_user_ptr(init.name), init.namelen);
+ if (IS_ERR(name)) {
+ err = PTR_ERR(name);
goto err;
}
- if (copy_from_user(name, (void __user *)(uintptr_t)init.name, init.namelen)) {
- err = -EFAULT;
- goto err_name;
- }
-
if (!fl->cctx->remote_heap) {
err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen,
&fl->cctx->remote_heap);
--
2.45.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [RESEND PATCH v2] misc: fastrpc: Use memdup_user()
2024-05-07 22:22 ` [PATCH v2] " Thorsten Blum
@ 2024-05-27 8:44 ` Thorsten Blum
2024-05-28 11:45 ` Srinivas Kandagatla
2024-05-28 11:45 ` [PATCH " Srinivas Kandagatla
1 sibling, 1 reply; 6+ messages in thread
From: Thorsten Blum @ 2024-05-27 8:44 UTC (permalink / raw
To: thorsten.blum
Cc: amahesh, arnd, gregkh, linux-arm-msm, linux-kernel,
srinivas.kandagatla
Switching to memdup_user() overwrites the allocated memory only once,
whereas kzalloc() followed by copy_from_user() initializes the allocated
memory to zero and then immediately overwrites it.
Fixes the following Coccinelle/coccicheck warning reported by
memdup_user.cocci:
WARNING opportunity for memdup_user
Signed-off-by: Thorsten Blum <thorsten.blum@toblux.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
---
Changes in v2:
- Use u64_to_user_ptr() as suggested by Arnd Bergmann (thanks!)
- Preserve Acked-by: tag
---
drivers/misc/fastrpc.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 4c67e2c5a82e..694fc083b1bd 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1259,17 +1259,12 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl,
goto err;
}
- name = kzalloc(init.namelen, GFP_KERNEL);
- if (!name) {
- err = -ENOMEM;
+ name = memdup_user(u64_to_user_ptr(init.name), init.namelen);
+ if (IS_ERR(name)) {
+ err = PTR_ERR(name);
goto err;
}
- if (copy_from_user(name, (void __user *)(uintptr_t)init.name, init.namelen)) {
- err = -EFAULT;
- goto err_name;
- }
-
if (!fl->cctx->remote_heap) {
err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen,
&fl->cctx->remote_heap);
--
2.45.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] misc: fastrpc: Use memdup_user()
2024-05-07 22:22 ` [PATCH v2] " Thorsten Blum
2024-05-27 8:44 ` [RESEND PATCH " Thorsten Blum
@ 2024-05-28 11:45 ` Srinivas Kandagatla
1 sibling, 0 replies; 6+ messages in thread
From: Srinivas Kandagatla @ 2024-05-28 11:45 UTC (permalink / raw
To: arnd, Thorsten Blum; +Cc: amahesh, gregkh, linux-arm-msm, linux-kernel
On Wed, 08 May 2024 00:22:27 +0200, Thorsten Blum wrote:
> Switching to memdup_user() overwrites the allocated memory only once,
> whereas kzalloc() followed by copy_from_user() initializes the allocated
> memory to zero and then immediately overwrites it.
>
> Fixes the following Coccinelle/coccicheck warning reported by
> memdup_user.cocci:
>
> [...]
Applied, thanks!
[1/1] misc: fastrpc: Use memdup_user()
commit: a16833330e2fa60912af6abebde711bf2c672cf9
Best regards,
--
Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [RESEND PATCH v2] misc: fastrpc: Use memdup_user()
2024-05-27 8:44 ` [RESEND PATCH " Thorsten Blum
@ 2024-05-28 11:45 ` Srinivas Kandagatla
0 siblings, 0 replies; 6+ messages in thread
From: Srinivas Kandagatla @ 2024-05-28 11:45 UTC (permalink / raw
To: Thorsten Blum; +Cc: amahesh, arnd, gregkh, linux-arm-msm, linux-kernel
On Mon, 27 May 2024 10:44:30 +0200, Thorsten Blum wrote:
> Switching to memdup_user() overwrites the allocated memory only once,
> whereas kzalloc() followed by copy_from_user() initializes the allocated
> memory to zero and then immediately overwrites it.
>
> Fixes the following Coccinelle/coccicheck warning reported by
> memdup_user.cocci:
>
> [...]
Applied, thanks!
[1/1] misc: fastrpc: Use memdup_user()
commit: a16833330e2fa60912af6abebde711bf2c672cf9
Best regards,
--
Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2024-05-28 11:45 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-05-07 20:12 [PATCH] misc: fastrpc: Use memdup_user() Thorsten Blum
2024-05-07 20:48 ` Arnd Bergmann
2024-05-07 22:22 ` [PATCH v2] " Thorsten Blum
2024-05-27 8:44 ` [RESEND PATCH " Thorsten Blum
2024-05-28 11:45 ` Srinivas Kandagatla
2024-05-28 11:45 ` [PATCH " Srinivas Kandagatla
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).