diff options
| author | Stefan Weinhuber <wein@de.ibm.com> | 2011-08-03 18:44:20 +0400 |
|---|---|---|
| committer | Heiko Carstens <heiko.carstens@de.ibm.com> | 2011-08-03 18:44:19 +0400 |
| commit | e4258d55bff06780cd424c671b576a90acc1592f (patch) | |
| tree | a8a7da35bff7d9379678ba8f59f512f12681f768 /drivers/s390/block/dasd.c | |
| parent | 7dd6b3343fdc190712d1620ee8848d25c4c77c33 (diff) | |
| download | linux-e4258d55bff06780cd424c671b576a90acc1592f.tar.xz | |
[S390] dasd: use vmalloc for statistics input buffer
The size of the buffer that is used to store DASD statistics input
strings depends on the user input. If the input string is to large,
the write operation could fail with -ENOMEM. To avoid this, use
vmalloc instead of kmalloc.
Signed-off-by: Stefan Weinhuber <wein@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Diffstat (limited to 'drivers/s390/block/dasd.c')
| -rw-r--r-- | drivers/s390/block/dasd.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c index 432444af7ee4..a1d3ddba99cc 100644 --- a/drivers/s390/block/dasd.c +++ b/drivers/s390/block/dasd.c @@ -24,6 +24,7 @@ #include <linux/mutex.h> #include <linux/debugfs.h> #include <linux/seq_file.h> +#include <linux/vmalloc.h> #include <asm/ccwdev.h> #include <asm/ebcdic.h> @@ -888,11 +889,11 @@ char *dasd_get_user_string(const char __user *user_buf, size_t user_len) { char *buffer; - buffer = kmalloc(user_len + 1, GFP_KERNEL); + buffer = vmalloc(user_len + 1); if (buffer == NULL) return ERR_PTR(-ENOMEM); if (copy_from_user(buffer, user_buf, user_len) != 0) { - kfree(buffer); + vfree(buffer); return ERR_PTR(-EFAULT); } /* got the string, now strip linefeed. */ @@ -930,7 +931,7 @@ static ssize_t dasd_stats_write(struct file *file, dasd_profile_off(prof); } else rc = -EINVAL; - kfree(buffer); + vfree(buffer); return rc; } @@ -1042,7 +1043,7 @@ static ssize_t dasd_stats_global_write(struct file *file, dasd_global_profile_level = DASD_PROFILE_OFF; } else rc = -EINVAL; - kfree(buffer); + vfree(buffer); return rc; } |