1 files changed, 16 insertions, 27 deletions

diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index a67fea655f49..4ec8f61ccf5a 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -193,26 +193,20 @@ int ecryptfs_send_miscdev(char *data, size_t data_size,
         int rc = 0;
 
         mutex_lock(&msg_ctx->mux);
-        if (data) {
-                msg_ctx->msg = kmalloc((sizeof(*msg_ctx->msg) + data_size),
-                                       GFP_KERNEL);
-                if (!msg_ctx->msg) {
-                        rc = -ENOMEM;
-                        printk(KERN_ERR "%s: Out of memory whilst attempting "
-                               "to kmalloc(%zd, GFP_KERNEL)\n", __func__,
-                               (sizeof(*msg_ctx->msg) + data_size));
-                        goto out_unlock;
-                }
-        } else
-                msg_ctx->msg = NULL;
+        msg_ctx->msg = kmalloc((sizeof(*msg_ctx->msg) + data_size),
+                               GFP_KERNEL);
+        if (!msg_ctx->msg) {
+                rc = -ENOMEM;
+                printk(KERN_ERR "%s: Out of memory whilst attempting "
+                       "to kmalloc(%zd, GFP_KERNEL)\n", __func__,
+                       (sizeof(*msg_ctx->msg) + data_size));
+                goto out_unlock;
+        }
         msg_ctx->msg->index = msg_ctx->index;
         msg_ctx->msg->data_len = data_size;
         msg_ctx->type = msg_type;
-        if (data) {
-                memcpy(msg_ctx->msg->data, data, data_size);
-                msg_ctx->msg_size = (sizeof(*msg_ctx->msg) + data_size);
-        } else
-                msg_ctx->msg_size = 0;
+        memcpy(msg_ctx->msg->data, data, data_size);
+        msg_ctx->msg_size = (sizeof(*msg_ctx->msg) + data_size);
         mutex_lock(&daemon->mux);
         list_add_tail(&msg_ctx->daemon_out_list, &daemon->msg_ctx_out_queue);
         daemon->num_queued_msg_ctx++;
@@ -418,18 +412,13 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
 
         if (count == 0)
                 goto out;
-        data = kmalloc(count, GFP_KERNEL);
-        if (!data) {
-                printk(KERN_ERR "%s: Out of memory whilst attempting to "
-                       "kmalloc([%zd], GFP_KERNEL)\n", __func__, count);
+
+        data = memdup_user(buf, count);
+        if (IS_ERR(data)) {
+                printk(KERN_ERR "%s: memdup_user returned error [%ld]\n",
+                       __func__, PTR_ERR(data));
                 goto out;
         }
-        rc = copy_from_user(data, buf, count);
-        if (rc) {
-                printk(KERN_ERR "%s: copy_from_user returned error [%d]\n",
-                       __func__, rc);
-                goto out_free;
-        }
         sz = count;
         i = 0;
         switch (data[i++]) {