summaryrefslogtreecommitdiffstats
path: root/drivers/mtd
diff options
context:
space:
mode:
authorMichał Kępień <kernel@kempniu.pl>2022-05-16 09:06:01 +0200
committerMiquel Raynal <miquel.raynal@bootlin.com>2022-06-09 15:03:32 +0200
commit83208e106a8e8a859110ebb04a5e927ced911afb (patch)
tree1d04b1dc0c641071ca082577817e90def7b2a488 /drivers/mtd
parentmtdchar: prevent integer overflow in a safety check (diff)
downloadlinux-83208e106a8e8a859110ebb04a5e927ced911afb.tar.xz
linux-83208e106a8e8a859110ebb04a5e927ced911afb.zip
mtdchar: use kvmalloc() for potentially large allocations
mtdchar_write_ioctl() calls kmalloc() with the 'size' argument set to the smaller of two values: the write request's data/OOB length provided by user space and the erase block size of the MTD device. If the latter is large, kmalloc() may not be able to serve such allocation requests. Use kvmalloc() instead. Correspondingly, replace kfree() calls with kvfree() calls. Suggested-by: Richard Weinberger <richard@nod.at> Signed-off-by: Michał Kępień <kernel@kempniu.pl> Acked-by: Richard Weinberger <richard@nod.at> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://lore.kernel.org/linux-mtd/20220516070601.11428-3-kernel@kempniu.pl
Diffstat (limited to 'drivers/mtd')
-rw-r--r--drivers/mtd/mtdchar.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index b2700f8467ff..05860288a7af 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -623,16 +623,16 @@ static int mtdchar_write_ioctl(struct mtd_info *mtd,
datbuf_len = min_t(size_t, req.len, mtd->erasesize);
if (datbuf_len > 0) {
- datbuf = kmalloc(datbuf_len, GFP_KERNEL);
+ datbuf = kvmalloc(datbuf_len, GFP_KERNEL);
if (!datbuf)
return -ENOMEM;
}
oobbuf_len = min_t(size_t, req.ooblen, mtd->erasesize);
if (oobbuf_len > 0) {
- oobbuf = kmalloc(oobbuf_len, GFP_KERNEL);
+ oobbuf = kvmalloc(oobbuf_len, GFP_KERNEL);
if (!oobbuf) {
- kfree(datbuf);
+ kvfree(datbuf);
return -ENOMEM;
}
}
@@ -682,8 +682,8 @@ static int mtdchar_write_ioctl(struct mtd_info *mtd,
usr_oob += ops.oobretlen;
}
- kfree(datbuf);
- kfree(oobbuf);
+ kvfree(datbuf);
+ kvfree(oobbuf);
return ret;
}