scsi: sg: sg_read(): get rid of access_ok()/__copy_..._user() (c8c12792) · Commits · 戴 / test

drivers/scsi/sg.c

+6 −12

Original line number	Diff line number	Diff line
		@@ -429,16 +429,10 @@ sg_read(struct file filp, char __user buf, size_t count, loff_t * ppos)
		SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
		"sg_read: count=%d\n", (int) count));

		if (!access_ok(buf, count))
		return -EFAULT;
		if (sfp->force_packid && (count >= SZ_SG_HEADER)) {
		old_hdr = kmalloc(SZ_SG_HEADER, GFP_KERNEL);
		if (!old_hdr)
		return -ENOMEM;
		if (__copy_from_user(old_hdr, buf, SZ_SG_HEADER)) {
		retval = -EFAULT;
		goto free_old_hdr;
		}
		old_hdr = memdup_user(buf, SZ_SG_HEADER);
		if (IS_ERR(old_hdr))
		return PTR_ERR(old_hdr);
		if (old_hdr->reply_len < 0) {
		if (count >= SZ_SG_IO_HDR) {
		sg_io_hdr_t __user p = (void __user )buf;
		@@ -529,7 +523,7 @@ sg_read(struct file filp, char __user buf, size_t count, loff_t * ppos)

		/* Now copy the result back to the user buffer. */
		if (count >= SZ_SG_HEADER) {
		if (__copy_to_user(buf, old_hdr, SZ_SG_HEADER)) {
		if (copy_to_user(buf, old_hdr, SZ_SG_HEADER)) {
		retval = -EFAULT;
		goto free_old_hdr;
		}
		@@ -1960,12 +1954,12 @@ sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer)
		num = 1 << (PAGE_SHIFT + schp->page_order);
		for (k = 0; k < schp->k_use_sg && schp->pages[k]; k++) {
		if (num > num_read_xfer) {
		if (__copy_to_user(outp, page_address(schp->pages[k]),
		if (copy_to_user(outp, page_address(schp->pages[k]),
		num_read_xfer))
		return -EFAULT;
		break;
		} else {
		if (__copy_to_user(outp, page_address(schp->pages[k]),
		if (copy_to_user(outp, page_address(schp->pages[k]),
		num))
		return -EFAULT;
		num_read_xfer -= num;