Commit 090a81d8 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-spi' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull spi uaccess delousing from Al Viro:
 "Getting rid of pointless __get_user() and friends in drivers/spi.

  [ the only reason it's on a separate branch is that I hoped it would
    be picked by spi folks; looks like mail asking them to grab it got
    lost and I hadn't followed up on that ]"

* 'for-spi' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  spidev: quit messing with access_ok()
parents 46ace66b 251d5951
...@@ -253,10 +253,6 @@ static int spidev_message(struct spidev_data *spidev, ...@@ -253,10 +253,6 @@ static int spidev_message(struct spidev_data *spidev,
goto done; goto done;
} }
k_tmp->rx_buf = rx_buf; k_tmp->rx_buf = rx_buf;
if (!access_ok(VERIFY_WRITE, (u8 __user *)
(uintptr_t) u_tmp->rx_buf,
u_tmp->len))
goto done;
rx_buf += k_tmp->len; rx_buf += k_tmp->len;
} }
if (u_tmp->tx_buf) { if (u_tmp->tx_buf) {
...@@ -304,7 +300,7 @@ static int spidev_message(struct spidev_data *spidev, ...@@ -304,7 +300,7 @@ static int spidev_message(struct spidev_data *spidev,
rx_buf = spidev->rx_buffer; rx_buf = spidev->rx_buffer;
for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) { for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) {
if (u_tmp->rx_buf) { if (u_tmp->rx_buf) {
if (__copy_to_user((u8 __user *) if (copy_to_user((u8 __user *)
(uintptr_t) u_tmp->rx_buf, rx_buf, (uintptr_t) u_tmp->rx_buf, rx_buf,
u_tmp->len)) { u_tmp->len)) {
status = -EFAULT; status = -EFAULT;
...@@ -346,7 +342,6 @@ spidev_get_ioc_message(unsigned int cmd, struct spi_ioc_transfer __user *u_ioc, ...@@ -346,7 +342,6 @@ spidev_get_ioc_message(unsigned int cmd, struct spi_ioc_transfer __user *u_ioc,
static long static long
spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{ {
int err = 0;
int retval = 0; int retval = 0;
struct spidev_data *spidev; struct spidev_data *spidev;
struct spi_device *spi; struct spi_device *spi;
...@@ -358,19 +353,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) ...@@ -358,19 +353,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
if (_IOC_TYPE(cmd) != SPI_IOC_MAGIC) if (_IOC_TYPE(cmd) != SPI_IOC_MAGIC)
return -ENOTTY; return -ENOTTY;
/* Check access direction once here; don't repeat below.
* IOC_DIR is from the user perspective, while access_ok is
* from the kernel perspective; so they look reversed.
*/
if (_IOC_DIR(cmd) & _IOC_READ)
err = !access_ok(VERIFY_WRITE,
(void __user *)arg, _IOC_SIZE(cmd));
if (err == 0 && _IOC_DIR(cmd) & _IOC_WRITE)
err = !access_ok(VERIFY_READ,
(void __user *)arg, _IOC_SIZE(cmd));
if (err)
return -EFAULT;
/* guard against device removal before, or while, /* guard against device removal before, or while,
* we issue this ioctl. * we issue this ioctl.
*/ */
...@@ -393,31 +375,31 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) ...@@ -393,31 +375,31 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
switch (cmd) { switch (cmd) {
/* read requests */ /* read requests */
case SPI_IOC_RD_MODE: case SPI_IOC_RD_MODE:
retval = __put_user(spi->mode & SPI_MODE_MASK, retval = put_user(spi->mode & SPI_MODE_MASK,
(__u8 __user *)arg); (__u8 __user *)arg);
break; break;
case SPI_IOC_RD_MODE32: case SPI_IOC_RD_MODE32:
retval = __put_user(spi->mode & SPI_MODE_MASK, retval = put_user(spi->mode & SPI_MODE_MASK,
(__u32 __user *)arg); (__u32 __user *)arg);
break; break;
case SPI_IOC_RD_LSB_FIRST: case SPI_IOC_RD_LSB_FIRST:
retval = __put_user((spi->mode & SPI_LSB_FIRST) ? 1 : 0, retval = put_user((spi->mode & SPI_LSB_FIRST) ? 1 : 0,
(__u8 __user *)arg); (__u8 __user *)arg);
break; break;
case SPI_IOC_RD_BITS_PER_WORD: case SPI_IOC_RD_BITS_PER_WORD:
retval = __put_user(spi->bits_per_word, (__u8 __user *)arg); retval = put_user(spi->bits_per_word, (__u8 __user *)arg);
break; break;
case SPI_IOC_RD_MAX_SPEED_HZ: case SPI_IOC_RD_MAX_SPEED_HZ:
retval = __put_user(spidev->speed_hz, (__u32 __user *)arg); retval = put_user(spidev->speed_hz, (__u32 __user *)arg);
break; break;
/* write requests */ /* write requests */
case SPI_IOC_WR_MODE: case SPI_IOC_WR_MODE:
case SPI_IOC_WR_MODE32: case SPI_IOC_WR_MODE32:
if (cmd == SPI_IOC_WR_MODE) if (cmd == SPI_IOC_WR_MODE)
retval = __get_user(tmp, (u8 __user *)arg); retval = get_user(tmp, (u8 __user *)arg);
else else
retval = __get_user(tmp, (u32 __user *)arg); retval = get_user(tmp, (u32 __user *)arg);
if (retval == 0) { if (retval == 0) {
u32 save = spi->mode; u32 save = spi->mode;
...@@ -436,7 +418,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) ...@@ -436,7 +418,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
} }
break; break;
case SPI_IOC_WR_LSB_FIRST: case SPI_IOC_WR_LSB_FIRST:
retval = __get_user(tmp, (__u8 __user *)arg); retval = get_user(tmp, (__u8 __user *)arg);
if (retval == 0) { if (retval == 0) {
u32 save = spi->mode; u32 save = spi->mode;
...@@ -453,7 +435,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) ...@@ -453,7 +435,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
} }
break; break;
case SPI_IOC_WR_BITS_PER_WORD: case SPI_IOC_WR_BITS_PER_WORD:
retval = __get_user(tmp, (__u8 __user *)arg); retval = get_user(tmp, (__u8 __user *)arg);
if (retval == 0) { if (retval == 0) {
u8 save = spi->bits_per_word; u8 save = spi->bits_per_word;
...@@ -466,7 +448,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) ...@@ -466,7 +448,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
} }
break; break;
case SPI_IOC_WR_MAX_SPEED_HZ: case SPI_IOC_WR_MAX_SPEED_HZ:
retval = __get_user(tmp, (__u32 __user *)arg); retval = get_user(tmp, (__u32 __user *)arg);
if (retval == 0) { if (retval == 0) {
u32 save = spi->max_speed_hz; u32 save = spi->max_speed_hz;
...@@ -516,8 +498,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd, ...@@ -516,8 +498,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
struct spi_ioc_transfer *ioc; struct spi_ioc_transfer *ioc;
u_ioc = (struct spi_ioc_transfer __user *) compat_ptr(arg); u_ioc = (struct spi_ioc_transfer __user *) compat_ptr(arg);
if (!access_ok(VERIFY_READ, u_ioc, _IOC_SIZE(cmd)))
return -EFAULT;
/* guard against device removal before, or while, /* guard against device removal before, or while,
* we issue this ioctl. * we issue this ioctl.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment