err = -ENOBUFS;
break;
}
- msf = kmalloc(optlen, GFP_KERNEL);
- if (!msf) {
- err = -ENOBUFS;
- break;
- }
- err = -EFAULT;
- if (copy_from_user(msf, optval, optlen)) {
- kfree(msf);
+ msf = memdup_user(optval, optlen);
+ if (IS_ERR(msf)) {
+ err = PTR_ERR(msf);
break;
}
/* numsrc >= (1G-4) overflow in 32 bits */
err = -ENOBUFS;
break;
}
- gsf = kmalloc(optlen, GFP_KERNEL);
- if (!gsf) {
- err = -ENOBUFS;
+ gsf = memdup_user(optval, optlen);
+ if (IS_ERR(gsf)) {
+ err = PTR_ERR(gsf);
break;
}
- err = -EFAULT;
- if (copy_from_user(gsf, optval, optlen))
- goto mc_msf_out;
/* numsrc >= (4G-140)/128 overflow in 32 bits */
if (gsf->gf_numsrc >= 0x1ffffff ||