spidev: quit messing with access_ok() (251d5951) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/spi/spidev.c

+11 −31

Original line number	Diff line number	Diff line
		@@ -254,10 +254,6 @@ static int spidev_message(struct spidev_data *spidev,
		goto done;
		}
		k_tmp->rx_buf = rx_buf;
		if (!access_ok(VERIFY_WRITE, (u8 __user *)
		(uintptr_t) u_tmp->rx_buf,
		u_tmp->len))
		goto done;
		rx_buf += k_tmp->len;
		}
		if (u_tmp->tx_buf) {
		@@ -305,7 +301,7 @@ static int spidev_message(struct spidev_data *spidev,
		rx_buf = spidev->rx_buffer;
		for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) {
		if (u_tmp->rx_buf) {
		if (__copy_to_user((u8 __user *)
		if (copy_to_user((u8 __user *)
		(uintptr_t) u_tmp->rx_buf, rx_buf,
		u_tmp->len)) {
		status = -EFAULT;
		@@ -355,7 +351,6 @@ spidev_get_ioc_message(unsigned int cmd, struct spi_ioc_transfer __user *u_ioc,
		static long
		spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
		{
		int err = 0;
		int retval = 0;
		struct spidev_data *spidev;
		struct spi_device *spi;
		@@ -367,19 +362,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
		if (_IOC_TYPE(cmd) != SPI_IOC_MAGIC)
		return -ENOTTY;

		/* Check access direction once here; don't repeat below.
		* IOC_DIR is from the user perspective, while access_ok is
		* from the kernel perspective; so they look reversed.
		*/
		if (_IOC_DIR(cmd) & _IOC_READ)
		err = !access_ok(VERIFY_WRITE,
		(void __user *)arg, _IOC_SIZE(cmd));
		if (err == 0 && _IOC_DIR(cmd) & _IOC_WRITE)
		err = !access_ok(VERIFY_READ,
		(void __user *)arg, _IOC_SIZE(cmd));
		if (err)
		return -EFAULT;

		/* guard against device removal before, or while,
		* we issue this ioctl.
		*/
		@@ -402,31 +384,31 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
		switch (cmd) {
		/* read requests */
		case SPI_IOC_RD_MODE:
		retval = __put_user(spi->mode & SPI_MODE_MASK,
		retval = put_user(spi->mode & SPI_MODE_MASK,
		(__u8 __user *)arg);
		break;
		case SPI_IOC_RD_MODE32:
		retval = __put_user(spi->mode & SPI_MODE_MASK,
		retval = put_user(spi->mode & SPI_MODE_MASK,
		(__u32 __user *)arg);
		break;
		case SPI_IOC_RD_LSB_FIRST:
		retval = __put_user((spi->mode & SPI_LSB_FIRST) ? 1 : 0,
		retval = put_user((spi->mode & SPI_LSB_FIRST) ? 1 : 0,
		(__u8 __user *)arg);
		break;
		case SPI_IOC_RD_BITS_PER_WORD:
		retval = __put_user(spi->bits_per_word, (__u8 __user *)arg);
		retval = put_user(spi->bits_per_word, (__u8 __user *)arg);
		break;
		case SPI_IOC_RD_MAX_SPEED_HZ:
		retval = __put_user(spidev->speed_hz, (__u32 __user *)arg);
		retval = put_user(spidev->speed_hz, (__u32 __user *)arg);
		break;

		/* write requests */
		case SPI_IOC_WR_MODE:
		case SPI_IOC_WR_MODE32:
		if (cmd == SPI_IOC_WR_MODE)
		retval = __get_user(tmp, (u8 __user *)arg);
		retval = get_user(tmp, (u8 __user *)arg);
		else
		retval = __get_user(tmp, (u32 __user *)arg);
		retval = get_user(tmp, (u32 __user *)arg);
		if (retval == 0) {
		u32 save = spi->mode;

		@@ -445,7 +427,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
		}
		break;
		case SPI_IOC_WR_LSB_FIRST:
		retval = __get_user(tmp, (__u8 __user *)arg);
		retval = get_user(tmp, (__u8 __user *)arg);
		if (retval == 0) {
		u32 save = spi->mode;

		@@ -462,7 +444,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
		}
		break;
		case SPI_IOC_WR_BITS_PER_WORD:
		retval = __get_user(tmp, (__u8 __user *)arg);
		retval = get_user(tmp, (__u8 __user *)arg);
		if (retval == 0) {
		u8 save = spi->bits_per_word;

		@@ -475,7 +457,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
		}
		break;
		case SPI_IOC_WR_MAX_SPEED_HZ:
		retval = __get_user(tmp, (__u32 __user *)arg);
		retval = get_user(tmp, (__u32 __user *)arg);
		if (retval == 0) {
		u32 save = spi->max_speed_hz;

		@@ -525,8 +507,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
		struct spi_ioc_transfer *ioc;

		u_ioc = (struct spi_ioc_transfer __user *) compat_ptr(arg);
		if (!access_ok(VERIFY_READ, u_ioc, _IOC_SIZE(cmd)))
		return -EFAULT;

		/* guard against device removal before, or while,
		* we issue this ioctl.