2 files changed, 16 insertions, 46 deletions

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 7594bec1be10..9f135e878507 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -461,15 +461,9 @@ static int btrfs_ioctl_resize(struct btrfs_root *root, void __user *arg)
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        vol_args = kmalloc(sizeof(*vol_args), GFP_NOFS);
-
-        if (!vol_args)
-                return -ENOMEM;
-
-        if (copy_from_user(vol_args, arg, sizeof(*vol_args))) {
-                ret = -EFAULT;
-                goto out;
-        }
+        vol_args = memdup_user(arg, sizeof(*vol_args));
+        if (IS_ERR(vol_args))
+                return PTR_ERR(vol_args);
 
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         namelen = strlen(vol_args->name);
@@ -545,7 +539,6 @@ static int btrfs_ioctl_resize(struct btrfs_root *root, void __user *arg)
 
 out_unlock:
         mutex_unlock(&root->fs_info->volume_mutex);
-out:
         kfree(vol_args);
         return ret;
 }
@@ -565,15 +558,9 @@ static noinline int btrfs_ioctl_snap_create(struct file *file,
         if (root->fs_info->sb->s_flags & MS_RDONLY)
                 return -EROFS;
 
-        vol_args = kmalloc(sizeof(*vol_args), GFP_NOFS);
-
-        if (!vol_args)
-                return -ENOMEM;
-
-        if (copy_from_user(vol_args, arg, sizeof(*vol_args))) {
-                ret = -EFAULT;
-                goto out;
-        }
+        vol_args = memdup_user(arg, sizeof(*vol_args));
+        if (IS_ERR(vol_args))
+                return PTR_ERR(vol_args);
 
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         namelen = strlen(vol_args->name);
@@ -675,19 +662,13 @@ static long btrfs_ioctl_add_dev(struct btrfs_root *root, void __user *arg)
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        vol_args = kmalloc(sizeof(*vol_args), GFP_NOFS);
+        vol_args = memdup_user(arg, sizeof(*vol_args));
+        if (IS_ERR(vol_args))
+                return PTR_ERR(vol_args);
 
-        if (!vol_args)
-                return -ENOMEM;
-
-        if (copy_from_user(vol_args, arg, sizeof(*vol_args))) {
-                ret = -EFAULT;
-                goto out;
-        }
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         ret = btrfs_init_new_device(root, vol_args->name);
 
-out:
         kfree(vol_args);
         return ret;
 }
@@ -703,19 +684,13 @@ static long btrfs_ioctl_rm_dev(struct btrfs_root *root, void __user *arg)
         if (root->fs_info->sb->s_flags & MS_RDONLY)
                 return -EROFS;
 
-        vol_args = kmalloc(sizeof(*vol_args), GFP_NOFS);
+        vol_args = memdup_user(arg, sizeof(*vol_args));
+        if (IS_ERR(vol_args))
+                return PTR_ERR(vol_args);
 
-        if (!vol_args)
-                return -ENOMEM;
-
-        if (copy_from_user(vol_args, arg, sizeof(*vol_args))) {
-                ret = -EFAULT;
-                goto out;
-        }
         vol_args->name[BTRFS_PATH_NAME_MAX] = '\0';
         ret = btrfs_rm_device(root, vol_args->name);
 
-out:
         kfree(vol_args);
         return ret;
 }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 9744af9d71e9..a7acfe639a44 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -635,14 +635,9 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        vol = kmalloc(sizeof(*vol), GFP_KERNEL);
-        if (!vol)
-                return -ENOMEM;
-
-        if (copy_from_user(vol, (void __user *)arg, sizeof(*vol))) {
-                ret = -EFAULT;
-                goto out;
-        }
+        vol = memdup_user((void __user *)arg, sizeof(*vol));
+        if (IS_ERR(vol))
+                return PTR_ERR(vol);
 
         switch (cmd) {
         case BTRFS_IOC_SCAN_DEV:
@@ -650,7 +645,7 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
                                             &btrfs_fs_type, &fs_devices);
                 break;
         }
-out:
+
         kfree(vol);
         return ret;
 }