|
@@ -937,13 +937,10 @@ static long vop_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
|
|
|
dd.num_vq > MIC_MAX_VRINGS)
|
|
|
return -EINVAL;
|
|
|
|
|
|
- dd_config = kzalloc(mic_desc_size(&dd), GFP_KERNEL);
|
|
|
- if (!dd_config)
|
|
|
- return -ENOMEM;
|
|
|
- if (copy_from_user(dd_config, argp, mic_desc_size(&dd))) {
|
|
|
- ret = -EFAULT;
|
|
|
- goto free_ret;
|
|
|
- }
|
|
|
+ dd_config = memdup_user(argp, mic_desc_size(&dd));
|
|
|
+ if (IS_ERR(dd_config))
|
|
|
+ return PTR_ERR(dd_config);
|
|
|
+
|
|
|
/* Ensure desc has not changed between the two reads */
|
|
|
if (memcmp(&dd, dd_config, sizeof(dd))) {
|
|
|
ret = -EINVAL;
|
|
@@ -995,15 +992,11 @@ _unlock_ret:
|
|
|
ret = vop_vdev_inited(vdev);
|
|
|
if (ret)
|
|
|
goto __unlock_ret;
|
|
|
- buf = kzalloc(vdev->dd->config_len, GFP_KERNEL);
|
|
|
- if (!buf) {
|
|
|
- ret = -ENOMEM;
|
|
|
+ buf = memdup_user(argp, vdev->dd->config_len);
|
|
|
+ if (IS_ERR(buf)) {
|
|
|
+ ret = PTR_ERR(buf);
|
|
|
goto __unlock_ret;
|
|
|
}
|
|
|
- if (copy_from_user(buf, argp, vdev->dd->config_len)) {
|
|
|
- ret = -EFAULT;
|
|
|
- goto done;
|
|
|
- }
|
|
|
ret = vop_virtio_config_change(vdev, buf);
|
|
|
done:
|
|
|
kfree(buf);
|