Skip to content

Commit

Permalink
selinuxfs: switch to memdup_user_nul()
Browse files Browse the repository at this point in the history 
Nothing in there gives a damn about the buffer alignment - it
just parses its contents.  So the use of get_zeroed_page()
doesn't buy us anything - might as well had been kmalloc(),
which makes that code equivalent to open-coded memdup_user_nul()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  • Loading branch information
Al Viro committed Jan 4, 2016
1 parent 16e5c1f commit 8365a71
Showing 1 changed file with 41 additions and 73 deletions.
114 changes: 41 additions & 73 deletions security/selinux/selinuxfs.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -147,23 +147,16 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
ssize_t length;
int new_value;

length = -ENOMEM;
if (count >= PAGE_SIZE)
goto out;
return -ENOMEM;

/* No partial writes. */
length = -EINVAL;
if (*ppos != 0)
goto out;

length = -ENOMEM;
page = (char *)get_zeroed_page(GFP_KERNEL);
if (!page)
goto out;
return -EINVAL;

length = -EFAULT;
if (copy_from_user(page, buf, count))
goto out;
page = memdup_user_nul(buf, count);
if (IS_ERR(page))
return PTR_ERR(page);

length = -EINVAL;
if (sscanf(page, "%d", &new_value) != 1)
Expand All @@ -186,7 +179,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
}
length = count;
out:
free_page((unsigned long) page);
kfree(page);
return length;
}
#else
Expand Down Expand Up @@ -275,27 +268,20 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf,
size_t count, loff_t *ppos)

{
char *page = NULL;
char *page;
ssize_t length;
int new_value;

length = -ENOMEM;
if (count >= PAGE_SIZE)
goto out;
return -ENOMEM;

/* No partial writes. */
length = -EINVAL;
if (*ppos != 0)
goto out;

length = -ENOMEM;
page = (char *)get_zeroed_page(GFP_KERNEL);
if (!page)
goto out;
return -EINVAL;

length = -EFAULT;
if (copy_from_user(page, buf, count))
goto out;
page = memdup_user_nul(buf, count);
if (IS_ERR(page))
return PTR_ERR(page);

length = -EINVAL;
if (sscanf(page, "%d", &new_value) != 1)
Expand All @@ -313,7 +299,7 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf,

length = count;
out:
free_page((unsigned long) page);
kfree(page);
return length;
}
#else
Expand Down Expand Up @@ -611,31 +597,24 @@ static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf,
static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
size_t count, loff_t *ppos)
{
char *page = NULL;
char *page;
ssize_t length;
unsigned int new_value;

length = task_has_security(current, SECURITY__SETCHECKREQPROT);
if (length)
goto out;
return length;

length = -ENOMEM;
if (count >= PAGE_SIZE)
goto out;
return -ENOMEM;

/* No partial writes. */
length = -EINVAL;
if (*ppos != 0)
goto out;

length = -ENOMEM;
page = (char *)get_zeroed_page(GFP_KERNEL);
if (!page)
goto out;
return -EINVAL;

length = -EFAULT;
if (copy_from_user(page, buf, count))
goto out;
page = memdup_user_nul(buf, count);
if (IS_ERR(page))
return PTR_ERR(page);

length = -EINVAL;
if (sscanf(page, "%u", &new_value) != 1)
Expand All @@ -644,7 +623,7 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
selinux_checkreqprot = new_value ? 1 : 0;
length = count;
out:
free_page((unsigned long) page);
kfree(page);
return length;
}
static const struct file_operations sel_checkreqprot_ops = {
Expand Down Expand Up @@ -1100,14 +1079,12 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
if (*ppos != 0)
goto out;

length = -ENOMEM;
page = (char *)get_zeroed_page(GFP_KERNEL);
if (!page)
goto out;

length = -EFAULT;
if (copy_from_user(page, buf, count))
page = memdup_user_nul(buf, count);
if (IS_ERR(page)) {
length = PTR_ERR(page);
page = NULL;
goto out;
}

length = -EINVAL;
if (sscanf(page, "%d", &new_value) != 1)
Expand All @@ -1121,7 +1098,7 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,

out:
mutex_unlock(&sel_mutex);
free_page((unsigned long) page);
kfree(page);
return length;
}

Expand Down Expand Up @@ -1154,14 +1131,12 @@ static ssize_t sel_commit_bools_write(struct file *filep,
if (*ppos != 0)
goto out;

length = -ENOMEM;
page = (char *)get_zeroed_page(GFP_KERNEL);
if (!page)
goto out;

length = -EFAULT;
if (copy_from_user(page, buf, count))
page = memdup_user_nul(buf, count);
if (IS_ERR(page)) {
length = PTR_ERR(page);
page = NULL;
goto out;
}

length = -EINVAL;
if (sscanf(page, "%d", &new_value) != 1)
Expand All @@ -1176,7 +1151,7 @@ static ssize_t sel_commit_bools_write(struct file *filep,

out:
mutex_unlock(&sel_mutex);
free_page((unsigned long) page);
kfree(page);
return length;
}

Expand Down Expand Up @@ -1292,31 +1267,24 @@ static ssize_t sel_write_avc_cache_threshold(struct file *file,
size_t count, loff_t *ppos)

{
char *page = NULL;
char *page;
ssize_t ret;
int new_value;

ret = task_has_security(current, SECURITY__SETSECPARAM);
if (ret)
goto out;
return ret;

ret = -ENOMEM;
if (count >= PAGE_SIZE)
goto out;
return -ENOMEM;

/* No partial writes. */
ret = -EINVAL;
if (*ppos != 0)
goto out;

ret = -ENOMEM;
page = (char *)get_zeroed_page(GFP_KERNEL);
if (!page)
goto out;
return -EINVAL;

ret = -EFAULT;
if (copy_from_user(page, buf, count))
goto out;
page = memdup_user_nul(buf, count);
if (IS_ERR(page))
return PTR_ERR(page);

ret = -EINVAL;
if (sscanf(page, "%u", &new_value) != 1)
Expand All @@ -1326,7 +1294,7 @@ static ssize_t sel_write_avc_cache_threshold(struct file *file,

ret = count;
out:
free_page((unsigned long)page);
kfree(page);
return ret;
}

Expand Down

0 comments on commit 8365a71

Please sign in to comment.