diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2019-10-17 22:39:24 +0300 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2019-11-06 08:04:03 +0300 |
| commit | a64e5a868573d6fe3b76e8d17538b10499239631 (patch) | |
| tree | 8ba2815425201489eb73721fa405300449d82a64 /drivers/scsi/sg.c | |
| parent | c8c12792d5fe11375af54c6bbbbebdda105eb933 (diff) | |
| download | linux-a64e5a868573d6fe3b76e8d17538b10499239631.tar.xz | |
scsi: sg: sg_write(): get rid of access_ok()/__copy_from_user()/__get_user()
Just use plain copy_from_user() and get_user(). Note that while a
buf-derived pointer gets stored into ->dxferp, all places that actually use
the resulting value feed it either to import_iovec() or to
import_single_range(), and both will do validation.
Link: https://lore.kernel.org/r/20191017193925.25539-7-viro@ZenIV.linux.org.uk
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/scsi/sg.c')
| -rw-r--r-- | drivers/scsi/sg.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 9f6534a025cd..f3d090b93cdf 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -612,11 +612,9 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) scsi_block_when_processing_errors(sdp->device))) return -ENXIO; - if (!access_ok(buf, count)) - return -EFAULT; /* protects following copy_from_user()s + get_user()s */ if (count < SZ_SG_HEADER) return -EIO; - if (__copy_from_user(&old_hdr, buf, SZ_SG_HEADER)) + if (copy_from_user(&old_hdr, buf, SZ_SG_HEADER)) return -EFAULT; blocking = !(filp->f_flags & O_NONBLOCK); if (old_hdr.reply_len < 0) @@ -626,7 +624,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) return -EIO; /* The minimum scsi command length is 6 bytes. */ buf += SZ_SG_HEADER; - if (__get_user(opcode, buf)) + if (get_user(opcode, buf)) return -EFAULT; if (!(srp = sg_add_request(sfp))) { @@ -676,7 +674,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) hp->flags = input_size; /* structure abuse ... */ hp->pack_id = old_hdr.pack_id; hp->usr_ptr = NULL; - if (__copy_from_user(cmnd, buf, cmd_size)) + if (copy_from_user(cmnd, buf, cmd_size)) return -EFAULT; /* * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV, |