Commit 8f507c8b authored by Dmitry Torokhov's avatar Dmitry Torokhov Committed by Jiri Kosina
Browse files

HID: hidraw: switch to using memdup_user 



Instead of open-coding memory allocation and copying form user memory
sequence let's use memdup_user().

Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent d66435cc

drivers/hid/hidraw.c

+4 −9
Original line number Diff line number Diff line
@@ -34,6 +34,7 @@ 
#include <linux/hid.h>

#include <linux/mutex.h>

#include <linux/sched.h>

#include <linux/string.h>



#include <linux/hidraw.h>
@@ -123,7 +124,6 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer, 


	dev = hidraw_table[minor]->hid;





	if (count > HID_MAX_BUFFER_SIZE) {

		hid_warn(dev, "pid %d passed too large report\n",

			 task_pid_nr(current));
@@ -138,17 +138,12 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer, 
		goto out;

	}



	buf = kmalloc(count * sizeof(__u8), GFP_KERNEL);

	if (!buf) {

		ret = -ENOMEM;

	buf = memdup_user(buffer, count);

	if (IS_ERR(buf)) {

		ret = PTR_ERR(buf);

		goto out;

	}



	if (copy_from_user(buf, buffer, count)) {

		ret = -EFAULT;

		goto out_free;

	}



	if ((report_type == HID_OUTPUT_REPORT) &&

	    !(dev->quirks & HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP)) {

		ret = hid_hw_output_report(dev, buf, count);