summaryrefslogtreecommitdiff
path: root/fs/proc
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2015-12-24 08:16:30 +0300
committerAl Viro <viro@zeniv.linux.org.uk>2016-01-04 18:28:00 +0300
commitbb646cdb12e75d82258c2f2e7746d5952d3e321a (patch)
tree3ea70ea98962ca3f9344757cf1cde87b210a699e /fs/proc
parent70f6cbb6f9c95535acd327d1ac1ce5fd078cff1e (diff)
downloadlinux-bb646cdb12e75d82258c2f2e7746d5952d3e321a.tar.xz
proc_pid_attr_write(): switch to memdup_user()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/proc')
-rw-r--r--fs/proc/base.c17
1 files changed, 7 insertions, 10 deletions
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 4bd5d3118acd..1b0f470a3e35 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2359,7 +2359,7 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
size_t count, loff_t *ppos)
{
struct inode * inode = file_inode(file);
- char *page;
+ void *page;
ssize_t length;
struct task_struct *task = get_proc_task(inode);
@@ -2374,14 +2374,11 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
if (*ppos != 0)
goto out;
- length = -ENOMEM;
- page = (char*)__get_free_page(GFP_TEMPORARY);
- if (!page)
+ page = memdup_user(buf, count);
+ if (IS_ERR(page)) {
+ length = PTR_ERR(page);
goto out;
-
- length = -EFAULT;
- if (copy_from_user(page, buf, count))
- goto out_free;
+ }
/* Guard against adverse ptrace interaction */
length = mutex_lock_interruptible(&task->signal->cred_guard_mutex);
@@ -2390,10 +2387,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
length = security_setprocattr(task,
(char*)file->f_path.dentry->d_name.name,
- (void*)page, count);
+ page, count);
mutex_unlock(&task->signal->cred_guard_mutex);
out_free:
- free_page((unsigned long) page);
+ kfree(page);
out:
put_task_struct(task);
out_no_task: