OSDN Git Service

s390 keyboard.c: don't open-code strndup_user()
authorAl Viro <viro@zeniv.linux.org.uk>
Wed, 26 Apr 2017 21:28:25 +0000 (17:28 -0400)
committerAl Viro <viro@zeniv.linux.org.uk>
Tue, 16 May 2017 03:41:50 +0000 (23:41 -0400)
... especially not with off-by-ones (strnlen_user() already includes NUL
into its count).

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
drivers/s390/char/keyboard.c

index ba0e4f9..186d05e 100644 (file)
@@ -433,12 +433,7 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
        case KDSKBSENT:
                if (!perm)
                        return -EPERM;
-               len = strnlen_user(u_kbs->kb_string, sizeof(u_kbs->kb_string));
-               if (!len)
-                       return -EFAULT;
-               if (len > sizeof(u_kbs->kb_string))
-                       return -EINVAL;
-               p = memdup_user_nul(u_kbs->kb_string, len);
+               p = strndup_user(u_kbs->kb_string, sizeof(u_kbs->kb_string));
                if (IS_ERR(p))
                        return PTR_ERR(p);
                kfree(kbd->func_table[kb_func]);