diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2017-04-26 17:28:25 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2017-05-15 23:41:50 -0400 |
| commit | b7310105ab2cd9168fe50564d8b9d248325a326e (patch) | |
| tree | c29df758c5f6831c37a59e05af794e8b0c99eada /drivers/s390 | |
| parent | 8f3ba02decc943815b6a1bacfbbd39f9850a7def (diff) | |
| download | linux-b7310105ab2cd9168fe50564d8b9d248325a326e.tar.gz linux-b7310105ab2cd9168fe50564d8b9d248325a326e.tar.bz2 linux-b7310105ab2cd9168fe50564d8b9d248325a326e.zip | |
s390 keyboard.c: don't open-code strndup_user()
... especially not with off-by-ones (strnlen_user() already includes NUL
into its count).
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'drivers/s390')
| -rw-r--r-- | drivers/s390/char/keyboard.c | 7 |
1 files changed, 1 insertions, 6 deletions
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c index ba0e4f93503d..186d05e4c767 100644 --- a/drivers/s390/char/keyboard.c +++ b/drivers/s390/char/keyboard.c @@ -433,12 +433,7 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs, case KDSKBSENT: if (!perm) return -EPERM; - len = strnlen_user(u_kbs->kb_string, sizeof(u_kbs->kb_string)); - if (!len) - return -EFAULT; - if (len > sizeof(u_kbs->kb_string)) - return -EINVAL; - p = memdup_user_nul(u_kbs->kb_string, len); + p = strndup_user(u_kbs->kb_string, sizeof(u_kbs->kb_string)); if (IS_ERR(p)) return PTR_ERR(p); kfree(kbd->func_table[kb_func]); |