memdup_user() is shorter and safer equivalent of kmalloc/copy_from_user pair.
Signed-off-by: Ivan Safonov <insafo...@gmail.com> --- drivers/staging/wlan-ng/p80211netdev.c | 28 ++++++++++++-------------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/drivers/staging/wlan-ng/p80211netdev.c b/drivers/staging/wlan-ng/p80211netdev.c index a15abb2c8f54..6f9666dc0277 100644 --- a/drivers/staging/wlan-ng/p80211netdev.c +++ b/drivers/staging/wlan-ng/p80211netdev.c @@ -569,24 +569,22 @@ static int p80211knetdev_do_ioctl(struct net_device *dev, goto bail; } - /* Allocate a buf of size req->len */ - msgbuf = kmalloc(req->len, GFP_KERNEL); - if (msgbuf) { - if (copy_from_user(msgbuf, (void __user *)req->data, req->len)) - result = -EFAULT; - else - result = p80211req_dorequest(wlandev, msgbuf); + msgbuf = memdup_user(req->data, req->len); + if (IS_ERR(msgbuf)) { + result = PTR_ERR(msgbuf); + goto bail; + } - if (result == 0) { - if (copy_to_user - ((void __user *)req->data, msgbuf, req->len)) { - result = -EFAULT; - } + result = p80211req_dorequest(wlandev, msgbuf); + + if (result == 0) { + if (copy_to_user + ((void __user *)req->data, msgbuf, req->len)) { + result = -EFAULT; } - kfree(msgbuf); - } else { - result = -ENOMEM; } + kfree(msgbuf); + bail: /* If allocate,copyfrom or copyto fails, return errno */ return result; -- 2.26.2