From: Thorsten Blum <thorsten.blum@linux.dev>
Date: Mon, 8 Sep 2025 20:10:20 +0000 (+0200)
Subject: block: floppy: Replace kmalloc() + copy_from_user() with memdup_user()
X-Git-Tag: v6.18-rc1~136^2~77
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6214cadd79c610ca903f993c7a6c46a713715e7b;p=thirdparty%2Fkernel%2Fstable.git

block: floppy: Replace kmalloc() + copy_from_user() with memdup_user()

Replace kmalloc() followed by copy_from_user() with memdup_user() to
improve and simplify raw_cmd_copyin().

No functional changes intended.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index ae8d598ee3175..5336c3c5ca362 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3090,16 +3090,13 @@ static int raw_cmd_copyin(int cmd, void __user *param,
 	*rcmd = NULL;
 
 loop:
-	ptr = kmalloc(sizeof(struct floppy_raw_cmd), GFP_KERNEL);
-	if (!ptr)
-		return -ENOMEM;
+	ptr = memdup_user(param, sizeof(*ptr));
+	if (IS_ERR(ptr))
+		return PTR_ERR(ptr);
 	*rcmd = ptr;
-	ret = copy_from_user(ptr, param, sizeof(*ptr));
 	ptr->next = NULL;
 	ptr->buffer_length = 0;
 	ptr->kernel_data = NULL;
-	if (ret)
-		return -EFAULT;
 	param += sizeof(struct floppy_raw_cmd);
 	if (ptr->cmd_count > FD_RAW_CMD_FULLSIZE)
 		return -EINVAL;