Commit 090a81d8 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-spi' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 

Pull spi uaccess delousing from Al Viro:
 "Getting rid of pointless __get_user() and friends in drivers/spi.

  [ the only reason it's on a separate branch is that I hoped it would
    be picked by spi folks; looks like mail asking them to grab it got
    lost and I hadn't followed up on that ]"

* 'for-spi' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  spidev: quit messing with access_ok()
parents 46ace66b 251d5951

drivers/spi/spidev.c

+11 −31
Original line number Diff line number Diff line
@@ -253,10 +253,6 @@ static int spidev_message(struct spidev_data *spidev, 
				goto done;

			}

			k_tmp->rx_buf = rx_buf;

			if (!access_ok(VERIFY_WRITE, (u8 __user *)

						(uintptr_t) u_tmp->rx_buf,

						u_tmp->len))

				goto done;

			rx_buf += k_tmp->len;

		}

		if (u_tmp->tx_buf) {
@@ -304,7 +300,7 @@ static int spidev_message(struct spidev_data *spidev, 
	rx_buf = spidev->rx_buffer;

	for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) {

		if (u_tmp->rx_buf) {

			if (__copy_to_user((u8 __user *)

			if (copy_to_user((u8 __user *)

					(uintptr_t) u_tmp->rx_buf, rx_buf,

					u_tmp->len)) {

				status = -EFAULT;
@@ -346,7 +342,6 @@ spidev_get_ioc_message(unsigned int cmd, struct spi_ioc_transfer __user *u_ioc, 
static long

spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)

{

	int			err = 0;

	int			retval = 0;

	struct spidev_data	*spidev;

	struct spi_device	*spi;
@@ -358,19 +353,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
	if (_IOC_TYPE(cmd) != SPI_IOC_MAGIC)

		return -ENOTTY;



	/* Check access direction once here; don't repeat below.

	 * IOC_DIR is from the user perspective, while access_ok is

	 * from the kernel perspective; so they look reversed.

	 */

	if (_IOC_DIR(cmd) & _IOC_READ)

		err = !access_ok(VERIFY_WRITE,

				(void __user *)arg, _IOC_SIZE(cmd));

	if (err == 0 && _IOC_DIR(cmd) & _IOC_WRITE)

		err = !access_ok(VERIFY_READ,

				(void __user *)arg, _IOC_SIZE(cmd));

	if (err)

		return -EFAULT;



	/* guard against device removal before, or while,

	 * we issue this ioctl.

	 */
@@ -393,31 +375,31 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
	switch (cmd) {

	/* read requests */

	case SPI_IOC_RD_MODE:

		retval = __put_user(spi->mode & SPI_MODE_MASK,

		retval = put_user(spi->mode & SPI_MODE_MASK,

					(__u8 __user *)arg);

		break;

	case SPI_IOC_RD_MODE32:

		retval = __put_user(spi->mode & SPI_MODE_MASK,

		retval = put_user(spi->mode & SPI_MODE_MASK,

					(__u32 __user *)arg);

		break;

	case SPI_IOC_RD_LSB_FIRST:

		retval = __put_user((spi->mode & SPI_LSB_FIRST) ?  1 : 0,

		retval = put_user((spi->mode & SPI_LSB_FIRST) ?  1 : 0,

					(__u8 __user *)arg);

		break;

	case SPI_IOC_RD_BITS_PER_WORD:

		retval = __put_user(spi->bits_per_word, (__u8 __user *)arg);

		retval = put_user(spi->bits_per_word, (__u8 __user *)arg);

		break;

	case SPI_IOC_RD_MAX_SPEED_HZ:

		retval = __put_user(spidev->speed_hz, (__u32 __user *)arg);

		retval = put_user(spidev->speed_hz, (__u32 __user *)arg);

		break;



	/* write requests */

	case SPI_IOC_WR_MODE:

	case SPI_IOC_WR_MODE32:

		if (cmd == SPI_IOC_WR_MODE)

			retval = __get_user(tmp, (u8 __user *)arg);

			retval = get_user(tmp, (u8 __user *)arg);

		else

			retval = __get_user(tmp, (u32 __user *)arg);

			retval = get_user(tmp, (u32 __user *)arg);

		if (retval == 0) {

			u32	save = spi->mode;
@@ -436,7 +418,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		}

		break;

	case SPI_IOC_WR_LSB_FIRST:

		retval = __get_user(tmp, (__u8 __user *)arg);

		retval = get_user(tmp, (__u8 __user *)arg);

		if (retval == 0) {

			u32	save = spi->mode;
@@ -453,7 +435,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		}

		break;

	case SPI_IOC_WR_BITS_PER_WORD:

		retval = __get_user(tmp, (__u8 __user *)arg);

		retval = get_user(tmp, (__u8 __user *)arg);

		if (retval == 0) {

			u8	save = spi->bits_per_word;
@@ -466,7 +448,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		}

		break;

	case SPI_IOC_WR_MAX_SPEED_HZ:

		retval = __get_user(tmp, (__u32 __user *)arg);

		retval = get_user(tmp, (__u32 __user *)arg);

		if (retval == 0) {

			u32	save = spi->max_speed_hz;
@@ -516,8 +498,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd, 
	struct spi_ioc_transfer		*ioc;



	u_ioc = (struct spi_ioc_transfer __user *) compat_ptr(arg);

	if (!access_ok(VERIFY_READ, u_ioc, _IOC_SIZE(cmd)))

		return -EFAULT;



	/* guard against device removal before, or while,

	 * we issue this ioctl.

CRA Git | Maintained and supported by SUSTech CRA and CCSE