|
@@ -489,17 +489,12 @@ xfs_attrmulti_attr_set(
|
|
if (len > XATTR_SIZE_MAX)
|
|
if (len > XATTR_SIZE_MAX)
|
|
return EINVAL;
|
|
return EINVAL;
|
|
|
|
|
|
- kbuf = kmalloc(len, GFP_KERNEL);
|
|
|
|
- if (!kbuf)
|
|
|
|
- return ENOMEM;
|
|
|
|
-
|
|
|
|
- if (copy_from_user(kbuf, ubuf, len))
|
|
|
|
- goto out_kfree;
|
|
|
|
|
|
+ kbuf = memdup_user(ubuf, len);
|
|
|
|
+ if (IS_ERR(kbuf))
|
|
|
|
+ return PTR_ERR(kbuf);
|
|
|
|
|
|
error = xfs_attr_set(XFS_I(inode), name, kbuf, len, flags);
|
|
error = xfs_attr_set(XFS_I(inode), name, kbuf, len, flags);
|
|
|
|
|
|
- out_kfree:
|
|
|
|
- kfree(kbuf);
|
|
|
|
return error;
|
|
return error;
|
|
}
|
|
}
|
|
|
|
|
|
@@ -540,20 +535,16 @@ xfs_attrmulti_by_handle(
|
|
if (!size || size > 16 * PAGE_SIZE)
|
|
if (!size || size > 16 * PAGE_SIZE)
|
|
goto out_dput;
|
|
goto out_dput;
|
|
|
|
|
|
- error = ENOMEM;
|
|
|
|
- ops = kmalloc(size, GFP_KERNEL);
|
|
|
|
- if (!ops)
|
|
|
|
|
|
+ ops = memdup_user(am_hreq.ops, size);
|
|
|
|
+ if (IS_ERR(ops)) {
|
|
|
|
+ error = PTR_ERR(ops);
|
|
goto out_dput;
|
|
goto out_dput;
|
|
-
|
|
|
|
- error = EFAULT;
|
|
|
|
- if (copy_from_user(ops, am_hreq.ops, size))
|
|
|
|
- goto out_kfree_ops;
|
|
|
|
|
|
+ }
|
|
|
|
|
|
attr_name = kmalloc(MAXNAMELEN, GFP_KERNEL);
|
|
attr_name = kmalloc(MAXNAMELEN, GFP_KERNEL);
|
|
if (!attr_name)
|
|
if (!attr_name)
|
|
goto out_kfree_ops;
|
|
goto out_kfree_ops;
|
|
|
|
|
|
-
|
|
|
|
error = 0;
|
|
error = 0;
|
|
for (i = 0; i < am_hreq.opcount; i++) {
|
|
for (i = 0; i < am_hreq.opcount; i++) {
|
|
ops[i].am_error = strncpy_from_user(attr_name,
|
|
ops[i].am_error = strncpy_from_user(attr_name,
|