commit b7310105ab2cd9168fe50564d8b9d248325a326e
author Al Viro <viro@zeniv.linux.org.uk> Wed Apr 26 17:28:25 2017 -0400
committer Al Viro <viro@zeniv.linux.org.uk> Mon May 15 23:41:50 2017 -0400
tree c29df758c5f6831c37a59e05af794e8b0c99eada
parent 8f3ba02decc943815b6a1bacfbbd39f9850a7def

s390 keyboard.c: don't open-code strndup_user()

... especially not with off-by-ones (strnlen_user() already includes NUL
into its count).

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

drivers/s390/char/keyboard.c

diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index ba0e4f9..186d05e 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -433,12 +433,7 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
 	case KDSKBSENT:
 		if (!perm)
 			return -EPERM;
-		len = strnlen_user(u_kbs->kb_string, sizeof(u_kbs->kb_string));
-		if (!len)
-			return -EFAULT;
-		if (len > sizeof(u_kbs->kb_string))
-			return -EINVAL;
-		p = memdup_user_nul(u_kbs->kb_string, len);
+		p = strndup_user(u_kbs->kb_string, sizeof(u_kbs->kb_string));
 		if (IS_ERR(p))
 			return PTR_ERR(p);
 		kfree(kbd->func_table[kb_func]);