diff options
| author | Dmitry Torokhov | 2016-03-16 16:59:38 -0700 |
|---|---|---|
| committer | Jiri Kosina | 2016-03-24 15:21:54 +0100 |
| commit | 8f507c8b0fa5d679e2957aad0e5ecd47675fca9a (patch) | |
| tree | 427024c2176d6a4ab06b5178e1874dc24b0c6b74 | |
| parent | d66435cc7da95964cb386674bd82ec12ca66320a (diff) | |
HID: hidraw: switch to using memdup_user
Instead of open-coding memory allocation and copying form user memory
sequence let's use memdup_user().
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| -rw-r--r-- | drivers/hid/hidraw.c | 13 |
1 files changed, 4 insertions, 9 deletions
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c index 9c2d7c23f296..b9a76e3a7f17 100644 --- a/drivers/hid/hidraw.c +++ b/drivers/hid/hidraw.c @@ -34,6 +34,7 @@ #include <linux/hid.h> #include <linux/mutex.h> #include <linux/sched.h> +#include <linux/string.h> #include <linux/hidraw.h> @@ -123,7 +124,6 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer, dev = hidraw_table[minor]->hid; - if (count > HID_MAX_BUFFER_SIZE) { hid_warn(dev, "pid %d passed too large report\n", task_pid_nr(current)); @@ -138,17 +138,12 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer, goto out; } - buf = kmalloc(count * sizeof(__u8), GFP_KERNEL); - if (!buf) { - ret = -ENOMEM; + buf = memdup_user(buffer, count); + if (IS_ERR(buf)) { + ret = PTR_ERR(buf); goto out; } - if (copy_from_user(buf, buffer, count)) { - ret = -EFAULT; - goto out_free; - } - if ((report_type == HID_OUTPUT_REPORT) && !(dev->quirks & HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP)) { ret = hid_hw_output_report(dev, buf, count); |