summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
Diffstat (limited to 'drivers')
-rw-r--r--drivers/acpi/acpi_dbg.c4
-rw-r--r--drivers/char/generic_nvram.c4
-rw-r--r--drivers/char/mem.c4
-rw-r--r--drivers/char/nwflash.c2
-rw-r--r--drivers/char/pcmcia/cm4000_cs.c4
-rw-r--r--drivers/crypto/ccp/psp-dev.c6
-rw-r--r--drivers/firewire/core-cdev.c2
-rw-r--r--drivers/firmware/efi/test/efi_test.c8
-rw-r--r--drivers/fpga/dfl-afu-dma-region.c2
-rw-r--r--drivers/fpga/dfl-fme-pr.c3
-rw-r--r--drivers/gpu/drm/amd/amdkfd/kfd_chardev.c18
-rw-r--r--drivers/gpu/drm/armada/armada_gem.c2
-rw-r--r--drivers/gpu/drm/drm_file.c2
-rw-r--r--drivers/gpu/drm/etnaviv/etnaviv_drv.c8
-rw-r--r--drivers/gpu/drm/i915/i915_gem.c7
-rw-r--r--drivers/gpu/drm/i915/i915_gem_execbuffer.c22
-rw-r--r--drivers/gpu/drm/i915/i915_gem_userptr.c3
-rw-r--r--drivers/gpu/drm/i915/i915_ioc32.c2
-rw-r--r--drivers/gpu/drm/i915/i915_perf.c2
-rw-r--r--drivers/gpu/drm/i915/i915_query.c2
-rw-r--r--drivers/gpu/drm/msm/msm_gem_submit.c2
-rw-r--r--drivers/gpu/drm/qxl/qxl_ioctl.c3
-rw-r--r--drivers/infiniband/core/uverbs_main.c3
-rw-r--r--drivers/infiniband/hw/hfi1/user_exp_rcv.c2
-rw-r--r--drivers/infiniband/hw/qib/qib_file_ops.c2
-rw-r--r--drivers/isdn/capi/kcapi.c4
-rw-r--r--drivers/isdn/hisax/hfc_pci.c2
-rw-r--r--drivers/macintosh/ans-lcd.c2
-rw-r--r--drivers/macintosh/via-pmu.c2
-rw-r--r--drivers/media/pci/ivtv/ivtvfb.c2
-rw-r--r--drivers/media/v4l2-core/v4l2-compat-ioctl32.c46
-rw-r--r--drivers/misc/vmw_vmci/vmci_host.c2
-rw-r--r--drivers/net/dsa/bcm_sf2.c7
-rw-r--r--drivers/net/ethernet/atheros/atl1e/atl1e_main.c4
-rw-r--r--drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c4
-rw-r--r--drivers/net/ethernet/freescale/fman/fman_memac.c2
-rw-r--r--drivers/net/ethernet/freescale/fman/fman_tgec.c2
-rw-r--r--drivers/net/ethernet/hisilicon/hns3/hns3_enet.c7
-rw-r--r--drivers/net/ethernet/huawei/hinic/hinic_main.c6
-rw-r--r--drivers/net/ethernet/ibm/ibmveth.c6
-rw-r--r--drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c2
-rw-r--r--drivers/net/ethernet/realtek/r8169.c4
-rw-r--r--drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c4
-rw-r--r--drivers/net/ethernet/sun/niu.c10
-rw-r--r--drivers/net/ethernet/ti/cpts.c4
-rw-r--r--drivers/net/hamradio/6pack.c16
-rw-r--r--drivers/net/tap.c3
-rw-r--r--drivers/net/wan/fsl_ucc_hdlc.c1
-rw-r--r--drivers/net/wan/x25_asy.c2
-rw-r--r--drivers/pci/proc.c4
-rw-r--r--drivers/platform/goldfish/goldfish_pipe.c3
-rw-r--r--drivers/pnp/isapnp/proc.c2
-rw-r--r--drivers/scsi/pmcraid.c4
-rw-r--r--drivers/scsi/scsi_ioctl.c2
-rw-r--r--drivers/scsi/sg.c16
-rw-r--r--drivers/staging/comedi/comedi_compat32.c24
-rw-r--r--drivers/tty/n_hdlc.c2
-rw-r--r--drivers/usb/core/devices.c2
-rw-r--r--drivers/usb/core/devio.c7
-rw-r--r--drivers/usb/gadget/function/f_hid.c4
-rw-r--r--drivers/usb/gadget/udc/atmel_usba_udc.c2
-rw-r--r--drivers/vhost/vhost.c16
-rw-r--r--drivers/video/fbdev/amifb.c4
-rw-r--r--drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c2
-rw-r--r--drivers/xen/privcmd.c6
65 files changed, 187 insertions, 176 deletions
diff --git a/drivers/acpi/acpi_dbg.c b/drivers/acpi/acpi_dbg.c
index f21c99ec46ee..a2dcd62ea32f 100644
--- a/drivers/acpi/acpi_dbg.c
+++ b/drivers/acpi/acpi_dbg.c
@@ -614,7 +614,7 @@ static ssize_t acpi_aml_read(struct file *file, char __user *buf,
614 614
615 if (!count) 615 if (!count)
616 return 0; 616 return 0;
617 if (!access_ok(VERIFY_WRITE, buf, count)) 617 if (!access_ok(buf, count))
618 return -EFAULT; 618 return -EFAULT;
619 619
620 while (count > 0) { 620 while (count > 0) {
@@ -684,7 +684,7 @@ static ssize_t acpi_aml_write(struct file *file, const char __user *buf,
684 684
685 if (!count) 685 if (!count)
686 return 0; 686 return 0;
687 if (!access_ok(VERIFY_READ, buf, count)) 687 if (!access_ok(buf, count))
688 return -EFAULT; 688 return -EFAULT;
689 689
690 while (count > 0) { 690 while (count > 0) {
diff --git a/drivers/char/generic_nvram.c b/drivers/char/generic_nvram.c
index 14e728fbb8a0..ff5394f47587 100644
--- a/drivers/char/generic_nvram.c
+++ b/drivers/char/generic_nvram.c
@@ -44,7 +44,7 @@ static ssize_t read_nvram(struct file *file, char __user *buf,
44 unsigned int i; 44 unsigned int i;
45 char __user *p = buf; 45 char __user *p = buf;
46 46
47 if (!access_ok(VERIFY_WRITE, buf, count)) 47 if (!access_ok(buf, count))
48 return -EFAULT; 48 return -EFAULT;
49 if (*ppos >= nvram_len) 49 if (*ppos >= nvram_len)
50 return 0; 50 return 0;
@@ -62,7 +62,7 @@ static ssize_t write_nvram(struct file *file, const char __user *buf,
62 const char __user *p = buf; 62 const char __user *p = buf;
63 char c; 63 char c;
64 64
65 if (!access_ok(VERIFY_READ, buf, count)) 65 if (!access_ok(buf, count))
66 return -EFAULT; 66 return -EFAULT;
67 if (*ppos >= nvram_len) 67 if (*ppos >= nvram_len)
68 return 0; 68 return 0;
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 7b4e4de778e4..b08dc50f9f26 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -609,7 +609,7 @@ static ssize_t read_port(struct file *file, char __user *buf,
609 unsigned long i = *ppos; 609 unsigned long i = *ppos;
610 char __user *tmp = buf; 610 char __user *tmp = buf;
611 611
612 if (!access_ok(VERIFY_WRITE, buf, count)) 612 if (!access_ok(buf, count))
613 return -EFAULT; 613 return -EFAULT;
614 while (count-- > 0 && i < 65536) { 614 while (count-- > 0 && i < 65536) {
615 if (__put_user(inb(i), tmp) < 0) 615 if (__put_user(inb(i), tmp) < 0)
@@ -627,7 +627,7 @@ static ssize_t write_port(struct file *file, const char __user *buf,
627 unsigned long i = *ppos; 627 unsigned long i = *ppos;
628 const char __user *tmp = buf; 628 const char __user *tmp = buf;
629 629
630 if (!access_ok(VERIFY_READ, buf, count)) 630 if (!access_ok(buf, count))
631 return -EFAULT; 631 return -EFAULT;
632 while (count-- > 0 && i < 65536) { 632 while (count-- > 0 && i < 65536) {
633 char c; 633 char c;
diff --git a/drivers/char/nwflash.c b/drivers/char/nwflash.c
index a284ae25e69a..76fb434068d4 100644
--- a/drivers/char/nwflash.c
+++ b/drivers/char/nwflash.c
@@ -167,7 +167,7 @@ static ssize_t flash_write(struct file *file, const char __user *buf,
167 if (count > gbFlashSize - p) 167 if (count > gbFlashSize - p)
168 count = gbFlashSize - p; 168 count = gbFlashSize - p;
169 169
170 if (!access_ok(VERIFY_READ, buf, count)) 170 if (!access_ok(buf, count))
171 return -EFAULT; 171 return -EFAULT;
172 172
173 /* 173 /*
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index 809507bf8f1c..7a4eb86aedac 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -1445,11 +1445,11 @@ static long cmm_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
1445 _IOC_DIR(cmd), _IOC_READ, _IOC_WRITE, size, cmd); 1445 _IOC_DIR(cmd), _IOC_READ, _IOC_WRITE, size, cmd);
1446 1446
1447 if (_IOC_DIR(cmd) & _IOC_READ) { 1447 if (_IOC_DIR(cmd) & _IOC_READ) {
1448 if (!access_ok(VERIFY_WRITE, argp, size)) 1448 if (!access_ok(argp, size))
1449 goto out; 1449 goto out;
1450 } 1450 }
1451 if (_IOC_DIR(cmd) & _IOC_WRITE) { 1451 if (_IOC_DIR(cmd) & _IOC_WRITE) {
1452 if (!access_ok(VERIFY_READ, argp, size)) 1452 if (!access_ok(argp, size))
1453 goto out; 1453 goto out;
1454 } 1454 }
1455 rc = 0; 1455 rc = 0;
diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c
index d64a78ccc03e..b16be8a11d92 100644
--- a/drivers/crypto/ccp/psp-dev.c
+++ b/drivers/crypto/ccp/psp-dev.c
@@ -364,7 +364,7 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp)
364 goto cmd; 364 goto cmd;
365 365
366 /* allocate a physically contiguous buffer to store the CSR blob */ 366 /* allocate a physically contiguous buffer to store the CSR blob */
367 if (!access_ok(VERIFY_WRITE, input.address, input.length) || 367 if (!access_ok(input.address, input.length) ||
368 input.length > SEV_FW_BLOB_MAX_SIZE) { 368 input.length > SEV_FW_BLOB_MAX_SIZE) {
369 ret = -EFAULT; 369 ret = -EFAULT;
370 goto e_free; 370 goto e_free;
@@ -644,14 +644,14 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp)
644 644
645 /* Allocate a physically contiguous buffer to store the PDH blob. */ 645 /* Allocate a physically contiguous buffer to store the PDH blob. */
646 if ((input.pdh_cert_len > SEV_FW_BLOB_MAX_SIZE) || 646 if ((input.pdh_cert_len > SEV_FW_BLOB_MAX_SIZE) ||
647 !access_ok(VERIFY_WRITE, input.pdh_cert_address, input.pdh_cert_len)) { 647 !access_ok(input.pdh_cert_address, input.pdh_cert_len)) {
648 ret = -EFAULT; 648 ret = -EFAULT;
649 goto e_free; 649 goto e_free;
650 } 650 }
651 651
652 /* Allocate a physically contiguous buffer to store the cert chain blob. */ 652 /* Allocate a physically contiguous buffer to store the cert chain blob. */
653 if ((input.cert_chain_len > SEV_FW_BLOB_MAX_SIZE) || 653 if ((input.cert_chain_len > SEV_FW_BLOB_MAX_SIZE) ||
654 !access_ok(VERIFY_WRITE, input.cert_chain_address, input.cert_chain_len)) { 654 !access_ok(input.cert_chain_address, input.cert_chain_len)) {
655 ret = -EFAULT; 655 ret = -EFAULT;
656 goto e_free; 656 goto e_free;
657 } 657 }
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index d8e185582642..16a7045736a9 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -1094,7 +1094,7 @@ static int ioctl_queue_iso(struct client *client, union ioctl_arg *arg)
1094 return -EINVAL; 1094 return -EINVAL;
1095 1095
1096 p = (struct fw_cdev_iso_packet __user *)u64_to_uptr(a->packets); 1096 p = (struct fw_cdev_iso_packet __user *)u64_to_uptr(a->packets);
1097 if (!access_ok(VERIFY_READ, p, a->size)) 1097 if (!access_ok(p, a->size))
1098 return -EFAULT; 1098 return -EFAULT;
1099 1099
1100 end = (void __user *)p + a->size; 1100 end = (void __user *)p + a->size;
diff --git a/drivers/firmware/efi/test/efi_test.c b/drivers/firmware/efi/test/efi_test.c
index 769640940c9f..51ecf7d6da48 100644
--- a/drivers/firmware/efi/test/efi_test.c
+++ b/drivers/firmware/efi/test/efi_test.c
@@ -68,7 +68,7 @@ copy_ucs2_from_user_len(efi_char16_t **dst, efi_char16_t __user *src,
68 return 0; 68 return 0;
69 } 69 }
70 70
71 if (!access_ok(VERIFY_READ, src, 1)) 71 if (!access_ok(src, 1))
72 return -EFAULT; 72 return -EFAULT;
73 73
74 buf = memdup_user(src, len); 74 buf = memdup_user(src, len);
@@ -89,7 +89,7 @@ copy_ucs2_from_user_len(efi_char16_t **dst, efi_char16_t __user *src,
89static inline int 89static inline int
90get_ucs2_strsize_from_user(efi_char16_t __user *src, size_t *len) 90get_ucs2_strsize_from_user(efi_char16_t __user *src, size_t *len)
91{ 91{
92 if (!access_ok(VERIFY_READ, src, 1)) 92 if (!access_ok(src, 1))
93 return -EFAULT; 93 return -EFAULT;
94 94
95 *len = user_ucs2_strsize(src); 95 *len = user_ucs2_strsize(src);
@@ -116,7 +116,7 @@ copy_ucs2_from_user(efi_char16_t **dst, efi_char16_t __user *src)
116{ 116{
117 size_t len; 117 size_t len;
118 118
119 if (!access_ok(VERIFY_READ, src, 1)) 119 if (!access_ok(src, 1))
120 return -EFAULT; 120 return -EFAULT;
121 121
122 len = user_ucs2_strsize(src); 122 len = user_ucs2_strsize(src);
@@ -140,7 +140,7 @@ copy_ucs2_to_user_len(efi_char16_t __user *dst, efi_char16_t *src, size_t len)
140 if (!src) 140 if (!src)
141 return 0; 141 return 0;
142 142
143 if (!access_ok(VERIFY_WRITE, dst, 1)) 143 if (!access_ok(dst, 1))
144 return -EFAULT; 144 return -EFAULT;
145 145
146 return copy_to_user(dst, src, len); 146 return copy_to_user(dst, src, len);
diff --git a/drivers/fpga/dfl-afu-dma-region.c b/drivers/fpga/dfl-afu-dma-region.c
index 025aba3ea76c..e18a786fc943 100644
--- a/drivers/fpga/dfl-afu-dma-region.c
+++ b/drivers/fpga/dfl-afu-dma-region.c
@@ -369,7 +369,7 @@ int afu_dma_map_region(struct dfl_feature_platform_data *pdata,
369 if (user_addr + length < user_addr) 369 if (user_addr + length < user_addr)
370 return -EINVAL; 370 return -EINVAL;
371 371
372 if (!access_ok(VERIFY_WRITE, (void __user *)(unsigned long)user_addr, 372 if (!access_ok((void __user *)(unsigned long)user_addr,
373 length)) 373 length))
374 return -EINVAL; 374 return -EINVAL;
375 375
diff --git a/drivers/fpga/dfl-fme-pr.c b/drivers/fpga/dfl-fme-pr.c
index fe5a5578fbf7..d9ca9554844a 100644
--- a/drivers/fpga/dfl-fme-pr.c
+++ b/drivers/fpga/dfl-fme-pr.c
@@ -99,8 +99,7 @@ static int fme_pr(struct platform_device *pdev, unsigned long arg)
99 return -EINVAL; 99 return -EINVAL;
100 } 100 }
101 101
102 if (!access_ok(VERIFY_READ, 102 if (!access_ok((void __user *)(unsigned long)port_pr.buffer_address,
103 (void __user *)(unsigned long)port_pr.buffer_address,
104 port_pr.buffer_size)) 103 port_pr.buffer_size))
105 return -EFAULT; 104 return -EFAULT;
106 105
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 3623538baf6f..be68752c3469 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -158,8 +158,7 @@ static int set_queue_properties_from_user(struct queue_properties *q_properties,
158 } 158 }
159 159
160 if ((args->ring_base_address) && 160 if ((args->ring_base_address) &&
161 (!access_ok(VERIFY_WRITE, 161 (!access_ok((const void __user *) args->ring_base_address,
162 (const void __user *) args->ring_base_address,
163 sizeof(uint64_t)))) { 162 sizeof(uint64_t)))) {
164 pr_err("Can't access ring base address\n"); 163 pr_err("Can't access ring base address\n");
165 return -EFAULT; 164 return -EFAULT;
@@ -170,31 +169,27 @@ static int set_queue_properties_from_user(struct queue_properties *q_properties,
170 return -EINVAL; 169 return -EINVAL;
171 } 170 }
172 171
173 if (!access_ok(VERIFY_WRITE, 172 if (!access_ok((const void __user *) args->read_pointer_address,
174 (const void __user *) args->read_pointer_address,
175 sizeof(uint32_t))) { 173 sizeof(uint32_t))) {
176 pr_err("Can't access read pointer\n"); 174 pr_err("Can't access read pointer\n");
177 return -EFAULT; 175 return -EFAULT;
178 } 176 }
179 177
180 if (!access_ok(VERIFY_WRITE, 178 if (!access_ok((const void __user *) args->write_pointer_address,
181 (const void __user *) args->write_pointer_address,
182 sizeof(uint32_t))) { 179 sizeof(uint32_t))) {
183 pr_err("Can't access write pointer\n"); 180 pr_err("Can't access write pointer\n");
184 return -EFAULT; 181 return -EFAULT;
185 } 182 }
186 183
187 if (args->eop_buffer_address && 184 if (args->eop_buffer_address &&
188 !access_ok(VERIFY_WRITE, 185 !access_ok((const void __user *) args->eop_buffer_address,
189 (const void __user *) args->eop_buffer_address,
190 sizeof(uint32_t))) { 186 sizeof(uint32_t))) {
191 pr_debug("Can't access eop buffer"); 187 pr_debug("Can't access eop buffer");
192 return -EFAULT; 188 return -EFAULT;
193 } 189 }
194 190
195 if (args->ctx_save_restore_address && 191 if (args->ctx_save_restore_address &&
196 !access_ok(VERIFY_WRITE, 192 !access_ok((const void __user *) args->ctx_save_restore_address,
197 (const void __user *) args->ctx_save_restore_address,
198 sizeof(uint32_t))) { 193 sizeof(uint32_t))) {
199 pr_debug("Can't access ctx save restore buffer"); 194 pr_debug("Can't access ctx save restore buffer");
200 return -EFAULT; 195 return -EFAULT;
@@ -365,8 +360,7 @@ static int kfd_ioctl_update_queue(struct file *filp, struct kfd_process *p,
365 } 360 }
366 361
367 if ((args->ring_base_address) && 362 if ((args->ring_base_address) &&
368 (!access_ok(VERIFY_WRITE, 363 (!access_ok((const void __user *) args->ring_base_address,
369 (const void __user *) args->ring_base_address,
370 sizeof(uint64_t)))) { 364 sizeof(uint64_t)))) {
371 pr_err("Can't access ring base address\n"); 365 pr_err("Can't access ring base address\n");
372 return -EFAULT; 366 return -EFAULT;
diff --git a/drivers/gpu/drm/armada/armada_gem.c b/drivers/gpu/drm/armada/armada_gem.c
index 892c1d9304bb..642d0e70d0f8 100644
--- a/drivers/gpu/drm/armada/armada_gem.c
+++ b/drivers/gpu/drm/armada/armada_gem.c
@@ -334,7 +334,7 @@ int armada_gem_pwrite_ioctl(struct drm_device *dev, void *data,
334 334
335 ptr = (char __user *)(uintptr_t)args->ptr; 335 ptr = (char __user *)(uintptr_t)args->ptr;
336 336
337 if (!access_ok(VERIFY_READ, ptr, args->size)) 337 if (!access_ok(ptr, args->size))
338 return -EFAULT; 338 return -EFAULT;
339 339
340 ret = fault_in_pages_readable(ptr, args->size); 340 ret = fault_in_pages_readable(ptr, args->size);
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index ffa8dc35515f..46f48f245eb5 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -525,7 +525,7 @@ ssize_t drm_read(struct file *filp, char __user *buffer,
525 struct drm_device *dev = file_priv->minor->dev; 525 struct drm_device *dev = file_priv->minor->dev;
526 ssize_t ret; 526 ssize_t ret;
527 527
528 if (!access_ok(VERIFY_WRITE, buffer, count)) 528 if (!access_ok(buffer, count))
529 return -EFAULT; 529 return -EFAULT;
530 530
531 ret = mutex_lock_interruptible(&file_priv->event_read_lock); 531 ret = mutex_lock_interruptible(&file_priv->event_read_lock);
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
index 96efc84396bf..18c27f795cf6 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
@@ -339,7 +339,6 @@ static int etnaviv_ioctl_gem_userptr(struct drm_device *dev, void *data,
339 struct drm_file *file) 339 struct drm_file *file)
340{ 340{
341 struct drm_etnaviv_gem_userptr *args = data; 341 struct drm_etnaviv_gem_userptr *args = data;
342 int access;
343 342
344 if (args->flags & ~(ETNA_USERPTR_READ|ETNA_USERPTR_WRITE) || 343 if (args->flags & ~(ETNA_USERPTR_READ|ETNA_USERPTR_WRITE) ||
345 args->flags == 0) 344 args->flags == 0)
@@ -351,12 +350,7 @@ static int etnaviv_ioctl_gem_userptr(struct drm_device *dev, void *data,
351 args->user_ptr & ~PAGE_MASK) 350 args->user_ptr & ~PAGE_MASK)
352 return -EINVAL; 351 return -EINVAL;
353 352
354 if (args->flags & ETNA_USERPTR_WRITE) 353 if (!access_ok((void __user *)(unsigned long)args->user_ptr,
355 access = VERIFY_WRITE;
356 else
357 access = VERIFY_READ;
358
359 if (!access_ok(access, (void __user *)(unsigned long)args->user_ptr,
360 args->user_size)) 354 args->user_size))
361 return -EFAULT; 355 return -EFAULT;
362 356
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index a9de07bb72c8..216f52b744a6 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1282,8 +1282,7 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
1282 if (args->size == 0) 1282 if (args->size == 0)
1283 return 0; 1283 return 0;
1284 1284
1285 if (!access_ok(VERIFY_WRITE, 1285 if (!access_ok(u64_to_user_ptr(args->data_ptr),
1286 u64_to_user_ptr(args->data_ptr),
1287 args->size)) 1286 args->size))
1288 return -EFAULT; 1287 return -EFAULT;
1289 1288
@@ -1609,9 +1608,7 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
1609 if (args->size == 0) 1608 if (args->size == 0)
1610 return 0; 1609 return 0;
1611 1610
1612 if (!access_ok(VERIFY_READ, 1611 if (!access_ok(u64_to_user_ptr(args->data_ptr), args->size))
1613 u64_to_user_ptr(args->data_ptr),
1614 args->size))
1615 return -EFAULT; 1612 return -EFAULT;
1616 1613
1617 obj = i915_gem_object_lookup(file, args->handle); 1614 obj = i915_gem_object_lookup(file, args->handle);
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 8ff6b581cf1c..485b259127c3 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1447,7 +1447,7 @@ static int eb_relocate_vma(struct i915_execbuffer *eb, struct i915_vma *vma)
1447 * to read. However, if the array is not writable the user loses 1447 * to read. However, if the array is not writable the user loses
1448 * the updated relocation values. 1448 * the updated relocation values.
1449 */ 1449 */
1450 if (unlikely(!access_ok(VERIFY_READ, urelocs, remain*sizeof(*urelocs)))) 1450 if (unlikely(!access_ok(urelocs, remain*sizeof(*urelocs))))
1451 return -EFAULT; 1451 return -EFAULT;
1452 1452
1453 do { 1453 do {
@@ -1554,7 +1554,7 @@ static int check_relocations(const struct drm_i915_gem_exec_object2 *entry)
1554 1554
1555 addr = u64_to_user_ptr(entry->relocs_ptr); 1555 addr = u64_to_user_ptr(entry->relocs_ptr);
1556 size *= sizeof(struct drm_i915_gem_relocation_entry); 1556 size *= sizeof(struct drm_i915_gem_relocation_entry);
1557 if (!access_ok(VERIFY_READ, addr, size)) 1557 if (!access_ok(addr, size))
1558 return -EFAULT; 1558 return -EFAULT;
1559 1559
1560 end = addr + size; 1560 end = addr + size;
@@ -1605,6 +1605,7 @@ static int eb_copy_relocations(const struct i915_execbuffer *eb)
1605 (char __user *)urelocs + copied, 1605 (char __user *)urelocs + copied,
1606 len)) { 1606 len)) {
1607end_user: 1607end_user:
1608 user_access_end();
1608 kvfree(relocs); 1609 kvfree(relocs);
1609 err = -EFAULT; 1610 err = -EFAULT;
1610 goto err; 1611 goto err;
@@ -1623,7 +1624,9 @@ end_user:
1623 * happened we would make the mistake of assuming that the 1624 * happened we would make the mistake of assuming that the
1624 * relocations were valid. 1625 * relocations were valid.
1625 */ 1626 */
1626 user_access_begin(); 1627 if (!user_access_begin(urelocs, size))
1628 goto end_user;
1629
1627 for (copied = 0; copied < nreloc; copied++) 1630 for (copied = 0; copied < nreloc; copied++)
1628 unsafe_put_user(-1, 1631 unsafe_put_user(-1,
1629 &urelocs[copied].presumed_offset, 1632 &urelocs[copied].presumed_offset,
@@ -2090,7 +2093,7 @@ get_fence_array(struct drm_i915_gem_execbuffer2 *args,
2090 return ERR_PTR(-EINVAL); 2093 return ERR_PTR(-EINVAL);
2091 2094
2092 user = u64_to_user_ptr(args->cliprects_ptr); 2095 user = u64_to_user_ptr(args->cliprects_ptr);
2093 if (!access_ok(VERIFY_READ, user, nfences * sizeof(*user))) 2096 if (!access_ok(user, nfences * sizeof(*user)))
2094 return ERR_PTR(-EFAULT); 2097 return ERR_PTR(-EFAULT);
2095 2098
2096 fences = kvmalloc_array(nfences, sizeof(*fences), 2099 fences = kvmalloc_array(nfences, sizeof(*fences),
@@ -2605,7 +2608,16 @@ i915_gem_execbuffer2_ioctl(struct drm_device *dev, void *data,
2605 unsigned int i; 2608 unsigned int i;
2606 2609
2607 /* Copy the new buffer offsets back to the user's exec list. */ 2610 /* Copy the new buffer offsets back to the user's exec list. */
2608 user_access_begin(); 2611 /*
2612 * Note: count * sizeof(*user_exec_list) does not overflow,
2613 * because we checked 'count' in check_buffer_count().
2614 *
2615 * And this range already got effectively checked earlier
2616 * when we did the "copy_from_user()" above.
2617 */
2618 if (!user_access_begin(user_exec_list, count * sizeof(*user_exec_list)))
2619 goto end_user;
2620
2609 for (i = 0; i < args->buffer_count; i++) { 2621 for (i = 0; i < args->buffer_count; i++) {
2610 if (!(exec2_list[i].offset & UPDATE)) 2622 if (!(exec2_list[i].offset & UPDATE))
2611 continue; 2623 continue;
diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c
index 3df77020aada..9558582c105e 100644
--- a/drivers/gpu/drm/i915/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
@@ -789,8 +789,7 @@ i915_gem_userptr_ioctl(struct drm_device *dev,
789 if (offset_in_page(args->user_ptr | args->user_size)) 789 if (offset_in_page(args->user_ptr | args->user_size))
790 return -EINVAL; 790 return -EINVAL;
791 791
792 if (!access_ok(args->flags & I915_USERPTR_READ_ONLY ? VERIFY_READ : VERIFY_WRITE, 792 if (!access_ok((char __user *)(unsigned long)args->user_ptr, args->user_size))
793 (char __user *)(unsigned long)args->user_ptr, args->user_size))
794 return -EFAULT; 793 return -EFAULT;
795 794
796 if (args->flags & I915_USERPTR_READ_ONLY) { 795 if (args->flags & I915_USERPTR_READ_ONLY) {
diff --git a/drivers/gpu/drm/i915/i915_ioc32.c b/drivers/gpu/drm/i915/i915_ioc32.c
index 0e5c580d117c..e869daf9c8a9 100644
--- a/drivers/gpu/drm/i915/i915_ioc32.c
+++ b/drivers/gpu/drm/i915/i915_ioc32.c
@@ -52,7 +52,7 @@ static int compat_i915_getparam(struct file *file, unsigned int cmd,
52 return -EFAULT; 52 return -EFAULT;
53 53
54 request = compat_alloc_user_space(sizeof(*request)); 54 request = compat_alloc_user_space(sizeof(*request));
55 if (!access_ok(VERIFY_WRITE, request, sizeof(*request)) || 55 if (!access_ok(request, sizeof(*request)) ||
56 __put_user(req32.param, &request->param) || 56 __put_user(req32.param, &request->param) ||
57 __put_user((void __user *)(unsigned long)req32.value, 57 __put_user((void __user *)(unsigned long)req32.value,
58 &request->value)) 58 &request->value))
diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
index 4529edfdcfc8..2b2eb57ca71f 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -3052,7 +3052,7 @@ static struct i915_oa_reg *alloc_oa_regs(struct drm_i915_private *dev_priv,
3052 if (!n_regs) 3052 if (!n_regs)
3053 return NULL; 3053 return NULL;
3054 3054
3055 if (!access_ok(VERIFY_READ, regs, n_regs * sizeof(u32) * 2)) 3055 if (!access_ok(regs, n_regs * sizeof(u32) * 2))
3056 return ERR_PTR(-EFAULT); 3056 return ERR_PTR(-EFAULT);
3057 3057
3058 /* No is_valid function means we're not allowing any register to be programmed. */ 3058 /* No is_valid function means we're not allowing any register to be programmed. */
diff --git a/drivers/gpu/drm/i915/i915_query.c b/drivers/gpu/drm/i915/i915_query.c
index 6fc4b8eeab42..fe56465cdfd6 100644
--- a/drivers/gpu/drm/i915/i915_query.c
+++ b/drivers/gpu/drm/i915/i915_query.c
@@ -46,7 +46,7 @@ static int query_topology_info(struct drm_i915_private *dev_priv,
46 if (topo.flags != 0) 46 if (topo.flags != 0)
47 return -EINVAL; 47 return -EINVAL;
48 48
49 if (!access_ok(VERIFY_WRITE, u64_to_user_ptr(query_item->data_ptr), 49 if (!access_ok(u64_to_user_ptr(query_item->data_ptr),
50 total_length)) 50 total_length))
51 return -EFAULT; 51 return -EFAULT;
52 52
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index a28465d90529..12b983fc0b56 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -77,7 +77,7 @@ void msm_gem_submit_free(struct msm_gem_submit *submit)
77static inline unsigned long __must_check 77static inline unsigned long __must_check
78copy_from_user_inatomic(void *to, const void __user *from, unsigned long n) 78copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
79{ 79{
80 if (access_ok(VERIFY_READ, from, n)) 80 if (access_ok(from, n))
81 return __copy_from_user_inatomic(to, from, n); 81 return __copy_from_user_inatomic(to, from, n);
82 return -EFAULT; 82 return -EFAULT;
83} 83}
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 6e828158bcb0..d410e2925162 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -163,8 +163,7 @@ static int qxl_process_single_command(struct qxl_device *qdev,
163 if (cmd->command_size > PAGE_SIZE - sizeof(union qxl_release_info)) 163 if (cmd->command_size > PAGE_SIZE - sizeof(union qxl_release_info))
164 return -EINVAL; 164 return -EINVAL;
165 165
166 if (!access_ok(VERIFY_READ, 166 if (!access_ok(u64_to_user_ptr(cmd->command),
167 u64_to_user_ptr(cmd->command),
168 cmd->command_size)) 167 cmd->command_size))
169 return -EFAULT; 168 return -EFAULT;
170 169
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 9f9172eb1512..fb0007aa0c27 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -611,8 +611,7 @@ static ssize_t verify_hdr(struct ib_uverbs_cmd_hdr *hdr,
611 if (hdr->out_words * 8 < method_elm->resp_size) 611 if (hdr->out_words * 8 < method_elm->resp_size)
612 return -ENOSPC; 612 return -ENOSPC;
613 613
614 if (!access_ok(VERIFY_WRITE, 614 if (!access_ok(u64_to_user_ptr(ex_hdr->response),
615 u64_to_user_ptr(ex_hdr->response),
616 (hdr->out_words + ex_hdr->provider_out_words) * 8)) 615 (hdr->out_words + ex_hdr->provider_out_words) * 8))
617 return -EFAULT; 616 return -EFAULT;
618 } else { 617 } else {
diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
index dbe7d14a5c76..0cd71ce7cc71 100644
--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
@@ -232,7 +232,7 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
232 } 232 }
233 233
234 /* Verify that access is OK for the user buffer */ 234 /* Verify that access is OK for the user buffer */
235 if (!access_ok(VERIFY_WRITE, (void __user *)vaddr, 235 if (!access_ok((void __user *)vaddr,
236 npages * PAGE_SIZE)) { 236 npages * PAGE_SIZE)) {
237 dd_dev_err(dd, "Fail vaddr %p, %u pages, !access_ok\n", 237 dd_dev_err(dd, "Fail vaddr %p, %u pages, !access_ok\n",
238 (void *)vaddr, npages); 238 (void *)vaddr, npages);
diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c
index 98e1ce14fa2a..78fa634de98a 100644
--- a/drivers/infiniband/hw/qib/qib_file_ops.c
+++ b/drivers/infiniband/hw/qib/qib_file_ops.c
@@ -343,7 +343,7 @@ static int qib_tid_update(struct qib_ctxtdata *rcd, struct file *fp,
343 343
344 /* virtual address of first page in transfer */ 344 /* virtual address of first page in transfer */
345 vaddr = ti->tidvaddr; 345 vaddr = ti->tidvaddr;
346 if (!access_ok(VERIFY_WRITE, (void __user *) vaddr, 346 if (!access_ok((void __user *) vaddr,
347 cnt * PAGE_SIZE)) { 347 cnt * PAGE_SIZE)) {
348 ret = -EFAULT; 348 ret = -EFAULT;
349 goto done; 349 goto done;
diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index 0ff517d3c98f..a4ceb61c5b60 100644
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -852,7 +852,7 @@ u16 capi20_get_manufacturer(u32 contr, u8 *buf)
852 u16 ret; 852 u16 ret;
853 853
854 if (contr == 0) { 854 if (contr == 0) {
855 strlcpy(buf, capi_manufakturer, CAPI_MANUFACTURER_LEN); 855 strncpy(buf, capi_manufakturer, CAPI_MANUFACTURER_LEN);
856 return CAPI_NOERROR; 856 return CAPI_NOERROR;
857 } 857 }
858 858
@@ -860,7 +860,7 @@ u16 capi20_get_manufacturer(u32 contr, u8 *buf)
860 860
861 ctr = get_capi_ctr_by_nr(contr); 861 ctr = get_capi_ctr_by_nr(contr);
862 if (ctr && ctr->state == CAPI_CTR_RUNNING) { 862 if (ctr && ctr->state == CAPI_CTR_RUNNING) {
863 strlcpy(buf, ctr->manu, CAPI_MANUFACTURER_LEN); 863 strncpy(buf, ctr->manu, CAPI_MANUFACTURER_LEN);
864 ret = CAPI_NOERROR; 864 ret = CAPI_NOERROR;
865 } else 865 } else
866 ret = CAPI_REGNOTINSTALLED; 866 ret = CAPI_REGNOTINSTALLED;
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 5b719b561860..81dd465afcf4 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -1169,11 +1169,13 @@ HFCPCI_l1hw(struct PStack *st, int pr, void *arg)
1169 if (cs->debug & L1_DEB_LAPD) 1169 if (cs->debug & L1_DEB_LAPD)
1170 debugl1(cs, "-> PH_REQUEST_PULL"); 1170 debugl1(cs, "-> PH_REQUEST_PULL");
1171#endif 1171#endif
1172 spin_lock_irqsave(&cs->lock, flags);
1172 if (!cs->tx_skb) { 1173 if (!cs->tx_skb) {
1173 test_and_clear_bit(FLG_L1_PULL_REQ, &st->l1.Flags); 1174 test_and_clear_bit(FLG_L1_PULL_REQ, &st->l1.Flags);
1174 st->l1.l1l2(st, PH_PULL | CONFIRM, NULL); 1175 st->l1.l1l2(st, PH_PULL | CONFIRM, NULL);
1175 } else 1176 } else
1176 test_and_set_bit(FLG_L1_PULL_REQ, &st->l1.Flags); 1177 test_and_set_bit(FLG_L1_PULL_REQ, &st->l1.Flags);
1178 spin_unlock_irqrestore(&cs->lock, flags);
1177 break; 1179 break;
1178 case (HW_RESET | REQUEST): 1180 case (HW_RESET | REQUEST):
1179 spin_lock_irqsave(&cs->lock, flags); 1181 spin_lock_irqsave(&cs->lock, flags);
diff --git a/drivers/macintosh/ans-lcd.c b/drivers/macintosh/ans-lcd.c
index ef0c2366cf59..400960cf04d5 100644
--- a/drivers/macintosh/ans-lcd.c
+++ b/drivers/macintosh/ans-lcd.c
@@ -64,7 +64,7 @@ anslcd_write( struct file * file, const char __user * buf,
64 printk(KERN_DEBUG "LCD: write\n"); 64 printk(KERN_DEBUG "LCD: write\n");
65#endif 65#endif
66 66
67 if (!access_ok(VERIFY_READ, buf, count)) 67 if (!access_ok(buf, count))
68 return -EFAULT; 68 return -EFAULT;
69 69
70 mutex_lock(&anslcd_mutex); 70 mutex_lock(&anslcd_mutex);
diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
index ac0cf37d6239..21d532a78fa4 100644
--- a/drivers/macintosh/via-pmu.c
+++ b/drivers/macintosh/via-pmu.c
@@ -2188,7 +2188,7 @@ pmu_read(struct file *file, char __user *buf,
2188 2188
2189 if (count < 1 || !pp) 2189 if (count < 1 || !pp)
2190 return -EINVAL; 2190 return -EINVAL;
2191 if (!access_ok(VERIFY_WRITE, buf, count)) 2191 if (!access_ok(buf, count))
2192 return -EFAULT; 2192 return -EFAULT;
2193 2193
2194 spin_lock_irqsave(&pp->lock, flags); 2194 spin_lock_irqsave(&pp->lock, flags);
diff --git a/drivers/media/pci/ivtv/ivtvfb.c b/drivers/media/pci/ivtv/ivtvfb.c
index 3e02de02ffdd..8ec2525d8ef5 100644
--- a/drivers/media/pci/ivtv/ivtvfb.c
+++ b/drivers/media/pci/ivtv/ivtvfb.c
@@ -356,7 +356,7 @@ static int ivtvfb_prep_frame(struct ivtv *itv, int cmd, void __user *source,
356 IVTVFB_WARN("ivtvfb_prep_frame: Count not a multiple of 4 (%d)\n", count); 356 IVTVFB_WARN("ivtvfb_prep_frame: Count not a multiple of 4 (%d)\n", count);
357 357
358 /* Check Source */ 358 /* Check Source */
359 if (!access_ok(VERIFY_READ, source + dest_offset, count)) { 359 if (!access_ok(source + dest_offset, count)) {
360 IVTVFB_WARN("Invalid userspace pointer %p\n", source); 360 IVTVFB_WARN("Invalid userspace pointer %p\n", source);
361 361
362 IVTVFB_DEBUG_WARN("access_ok() failed for offset 0x%08lx source %p count %d\n", 362 IVTVFB_DEBUG_WARN("access_ok() failed for offset 0x%08lx source %p count %d\n",
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index fe4577a46869..73dac1d8d4f6 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -158,7 +158,7 @@ static int get_v4l2_window32(struct v4l2_window __user *p64,
158 compat_caddr_t p; 158 compat_caddr_t p;
159 u32 clipcount; 159 u32 clipcount;
160 160
161 if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) || 161 if (!access_ok(p32, sizeof(*p32)) ||
162 copy_in_user(&p64->w, &p32->w, sizeof(p32->w)) || 162 copy_in_user(&p64->w, &p32->w, sizeof(p32->w)) ||
163 assign_in_user(&p64->field, &p32->field) || 163 assign_in_user(&p64->field, &p32->field) ||
164 assign_in_user(&p64->chromakey, &p32->chromakey) || 164 assign_in_user(&p64->chromakey, &p32->chromakey) ||
@@ -283,7 +283,7 @@ static int __bufsize_v4l2_format(struct v4l2_format32 __user *p32, u32 *size)
283 283
284static int bufsize_v4l2_format(struct v4l2_format32 __user *p32, u32 *size) 284static int bufsize_v4l2_format(struct v4l2_format32 __user *p32, u32 *size)
285{ 285{
286 if (!access_ok(VERIFY_READ, p32, sizeof(*p32))) 286 if (!access_ok(p32, sizeof(*p32)))
287 return -EFAULT; 287 return -EFAULT;
288 return __bufsize_v4l2_format(p32, size); 288 return __bufsize_v4l2_format(p32, size);
289} 289}
@@ -335,7 +335,7 @@ static int get_v4l2_format32(struct v4l2_format __user *p64,
335 struct v4l2_format32 __user *p32, 335 struct v4l2_format32 __user *p32,
336 void __user *aux_buf, u32 aux_space) 336 void __user *aux_buf, u32 aux_space)
337{ 337{
338 if (!access_ok(VERIFY_READ, p32, sizeof(*p32))) 338 if (!access_ok(p32, sizeof(*p32)))
339 return -EFAULT; 339 return -EFAULT;
340 return __get_v4l2_format32(p64, p32, aux_buf, aux_space); 340 return __get_v4l2_format32(p64, p32, aux_buf, aux_space);
341} 341}
@@ -343,7 +343,7 @@ static int get_v4l2_format32(struct v4l2_format __user *p64,
343static int bufsize_v4l2_create(struct v4l2_create_buffers32 __user *p32, 343static int bufsize_v4l2_create(struct v4l2_create_buffers32 __user *p32,
344 u32 *size) 344 u32 *size)
345{ 345{
346 if (!access_ok(VERIFY_READ, p32, sizeof(*p32))) 346 if (!access_ok(p32, sizeof(*p32)))
347 return -EFAULT; 347 return -EFAULT;
348 return __bufsize_v4l2_format(&p32->format, size); 348 return __bufsize_v4l2_format(&p32->format, size);
349} 349}
@@ -352,7 +352,7 @@ static int get_v4l2_create32(struct v4l2_create_buffers __user *p64,
352 struct v4l2_create_buffers32 __user *p32, 352 struct v4l2_create_buffers32 __user *p32,
353 void __user *aux_buf, u32 aux_space) 353 void __user *aux_buf, u32 aux_space)
354{ 354{
355 if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) || 355 if (!access_ok(p32, sizeof(*p32)) ||
356 copy_in_user(p64, p32, 356 copy_in_user(p64, p32,
357 offsetof(struct v4l2_create_buffers32, format))) 357 offsetof(struct v4l2_create_buffers32, format)))
358 return -EFAULT; 358 return -EFAULT;
@@ -404,7 +404,7 @@ static int __put_v4l2_format32(struct v4l2_format __user *p64,
404static int put_v4l2_format32(struct v4l2_format __user *p64, 404static int put_v4l2_format32(struct v4l2_format __user *p64,
405 struct v4l2_format32 __user *p32) 405 struct v4l2_format32 __user *p32)
406{ 406{
407 if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32))) 407 if (!access_ok(p32, sizeof(*p32)))
408 return -EFAULT; 408 return -EFAULT;
409 return __put_v4l2_format32(p64, p32); 409 return __put_v4l2_format32(p64, p32);
410} 410}
@@ -412,7 +412,7 @@ static int put_v4l2_format32(struct v4l2_format __user *p64,
412static int put_v4l2_create32(struct v4l2_create_buffers __user *p64, 412static int put_v4l2_create32(struct v4l2_create_buffers __user *p64,
413 struct v4l2_create_buffers32 __user *p32) 413 struct v4l2_create_buffers32 __user *p32)
414{ 414{
415 if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) || 415 if (!access_ok(p32, sizeof(*p32)) ||
416 copy_in_user(p32, p64, 416 copy_in_user(p32, p64,
417 offsetof(struct v4l2_create_buffers32, format)) || 417 offsetof(struct v4l2_create_buffers32, format)) ||
418 assign_in_user(&p32->capabilities, &p64->capabilities) || 418 assign_in_user(&p32->capabilities, &p64->capabilities) ||
@@ -434,7 +434,7 @@ static int get_v4l2_standard32(struct v4l2_standard __user *p64,
434 struct v4l2_standard32 __user *p32) 434 struct v4l2_standard32 __user *p32)
435{ 435{
436 /* other fields are not set by the user, nor used by the driver */ 436 /* other fields are not set by the user, nor used by the driver */
437 if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) || 437 if (!access_ok(p32, sizeof(*p32)) ||
438 assign_in_user(&p64->index, &p32->index)) 438 assign_in_user(&p64->index, &p32->index))
439 return -EFAULT; 439 return -EFAULT;
440 return 0; 440 return 0;
@@ -443,7 +443,7 @@ static int get_v4l2_standard32(struct v4l2_standard __user *p64,
443static int put_v4l2_standard32(struct v4l2_standard __user *p64, 443static int put_v4l2_standard32(struct v4l2_standard __user *p64,
444 struct v4l2_standard32 __user *p32) 444 struct v4l2_standard32 __user *p32)
445{ 445{
446 if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) || 446 if (!access_ok(p32, sizeof(*p32)) ||
447 assign_in_user(&p32->index, &p64->index) || 447 assign_in_user(&p32->index, &p64->index) ||
448 assign_in_user(&p32->id, &p64->id) || 448 assign_in_user(&p32->id, &p64->id) ||
449 copy_in_user(p32->name, p64->name, sizeof(p32->name)) || 449 copy_in_user(p32->name, p64->name, sizeof(p32->name)) ||
@@ -560,7 +560,7 @@ static int bufsize_v4l2_buffer(struct v4l2_buffer32 __user *p32, u32 *size)
560 u32 type; 560 u32 type;
561 u32 length; 561 u32 length;
562 562
563 if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) || 563 if (!access_ok(p32, sizeof(*p32)) ||
564 get_user(type, &p32->type) || 564 get_user(type, &p32->type) ||
565 get_user(length, &p32->length)) 565 get_user(length, &p32->length))
566 return -EFAULT; 566 return -EFAULT;
@@ -593,7 +593,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *p64,
593 compat_caddr_t p; 593 compat_caddr_t p;
594 int ret; 594 int ret;
595 595
596 if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) || 596 if (!access_ok(p32, sizeof(*p32)) ||
597 assign_in_user(&p64->index, &p32->index) || 597 assign_in_user(&p64->index, &p32->index) ||
598 get_user(type, &p32->type) || 598 get_user(type, &p32->type) ||
599 put_user(type, &p64->type) || 599 put_user(type, &p64->type) ||
@@ -632,7 +632,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *p64,
632 return -EFAULT; 632 return -EFAULT;
633 633
634 uplane32 = compat_ptr(p); 634 uplane32 = compat_ptr(p);
635 if (!access_ok(VERIFY_READ, uplane32, 635 if (!access_ok(uplane32,
636 num_planes * sizeof(*uplane32))) 636 num_planes * sizeof(*uplane32)))
637 return -EFAULT; 637 return -EFAULT;
638 638
@@ -691,7 +691,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *p64,
691 compat_caddr_t p; 691 compat_caddr_t p;
692 int ret; 692 int ret;
693 693
694 if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) || 694 if (!access_ok(p32, sizeof(*p32)) ||
695 assign_in_user(&p32->index, &p64->index) || 695 assign_in_user(&p32->index, &p64->index) ||
696 get_user(type, &p64->type) || 696 get_user(type, &p64->type) ||
697 put_user(type, &p32->type) || 697 put_user(type, &p32->type) ||
@@ -781,7 +781,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *p64,
781{ 781{
782 compat_caddr_t tmp; 782 compat_caddr_t tmp;
783 783
784 if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) || 784 if (!access_ok(p32, sizeof(*p32)) ||
785 get_user(tmp, &p32->base) || 785 get_user(tmp, &p32->base) ||
786 put_user_force(compat_ptr(tmp), &p64->base) || 786 put_user_force(compat_ptr(tmp), &p64->base) ||
787 assign_in_user(&p64->capability, &p32->capability) || 787 assign_in_user(&p64->capability, &p32->capability) ||
@@ -796,7 +796,7 @@ static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *p64,
796{ 796{
797 void *base; 797 void *base;
798 798
799 if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) || 799 if (!access_ok(p32, sizeof(*p32)) ||
800 get_user(base, &p64->base) || 800 get_user(base, &p64->base) ||
801 put_user(ptr_to_compat((void __user *)base), &p32->base) || 801 put_user(ptr_to_compat((void __user *)base), &p32->base) ||
802 assign_in_user(&p32->capability, &p64->capability) || 802 assign_in_user(&p32->capability, &p64->capability) ||
@@ -893,7 +893,7 @@ static int bufsize_v4l2_ext_controls(struct v4l2_ext_controls32 __user *p32,
893{ 893{
894 u32 count; 894 u32 count;
895 895
896 if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) || 896 if (!access_ok(p32, sizeof(*p32)) ||
897 get_user(count, &p32->count)) 897 get_user(count, &p32->count))
898 return -EFAULT; 898 return -EFAULT;
899 if (count > V4L2_CID_MAX_CTRLS) 899 if (count > V4L2_CID_MAX_CTRLS)
@@ -913,7 +913,7 @@ static int get_v4l2_ext_controls32(struct file *file,
913 u32 n; 913 u32 n;
914 compat_caddr_t p; 914 compat_caddr_t p;
915 915
916 if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) || 916 if (!access_ok(p32, sizeof(*p32)) ||
917 assign_in_user(&p64->which, &p32->which) || 917 assign_in_user(&p64->which, &p32->which) ||
918 get_user(count, &p32->count) || 918 get_user(count, &p32->count) ||
919 put_user(count, &p64->count) || 919 put_user(count, &p64->count) ||
@@ -929,7 +929,7 @@ static int get_v4l2_ext_controls32(struct file *file,
929 if (get_user(p, &p32->controls)) 929 if (get_user(p, &p32->controls))
930 return -EFAULT; 930 return -EFAULT;
931 ucontrols = compat_ptr(p); 931 ucontrols = compat_ptr(p);
932 if (!access_ok(VERIFY_READ, ucontrols, count * sizeof(*ucontrols))) 932 if (!access_ok(ucontrols, count * sizeof(*ucontrols)))
933 return -EFAULT; 933 return -EFAULT;
934 if (aux_space < count * sizeof(*kcontrols)) 934 if (aux_space < count * sizeof(*kcontrols))
935 return -EFAULT; 935 return -EFAULT;
@@ -979,7 +979,7 @@ static int put_v4l2_ext_controls32(struct file *file,
979 * with __user causes smatch warnings, so instead declare it 979 * with __user causes smatch warnings, so instead declare it
980 * without __user and cast it as a userspace pointer where needed. 980 * without __user and cast it as a userspace pointer where needed.
981 */ 981 */
982 if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) || 982 if (!access_ok(p32, sizeof(*p32)) ||
983 assign_in_user(&p32->which, &p64->which) || 983 assign_in_user(&p32->which, &p64->which) ||
984 get_user(count, &p64->count) || 984 get_user(count, &p64->count) ||
985 put_user(count, &p32->count) || 985 put_user(count, &p32->count) ||
@@ -994,7 +994,7 @@ static int put_v4l2_ext_controls32(struct file *file,
994 if (get_user(p, &p32->controls)) 994 if (get_user(p, &p32->controls))
995 return -EFAULT; 995 return -EFAULT;
996 ucontrols = compat_ptr(p); 996 ucontrols = compat_ptr(p);
997 if (!access_ok(VERIFY_WRITE, ucontrols, count * sizeof(*ucontrols))) 997 if (!access_ok(ucontrols, count * sizeof(*ucontrols)))
998 return -EFAULT; 998 return -EFAULT;
999 999
1000 for (n = 0; n < count; n++) { 1000 for (n = 0; n < count; n++) {
@@ -1043,7 +1043,7 @@ struct v4l2_event32 {
1043static int put_v4l2_event32(struct v4l2_event __user *p64, 1043static int put_v4l2_event32(struct v4l2_event __user *p64,
1044 struct v4l2_event32 __user *p32) 1044 struct v4l2_event32 __user *p32)
1045{ 1045{
1046 if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) || 1046 if (!access_ok(p32, sizeof(*p32)) ||
1047 assign_in_user(&p32->type, &p64->type) || 1047 assign_in_user(&p32->type, &p64->type) ||
1048 copy_in_user(&p32->u, &p64->u, sizeof(p64->u)) || 1048 copy_in_user(&p32->u, &p64->u, sizeof(p64->u)) ||
1049 assign_in_user(&p32->pending, &p64->pending) || 1049 assign_in_user(&p32->pending, &p64->pending) ||
@@ -1069,7 +1069,7 @@ static int get_v4l2_edid32(struct v4l2_edid __user *p64,
1069{ 1069{
1070 compat_uptr_t tmp; 1070 compat_uptr_t tmp;
1071 1071
1072 if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) || 1072 if (!access_ok(p32, sizeof(*p32)) ||
1073 assign_in_user(&p64->pad, &p32->pad) || 1073 assign_in_user(&p64->pad, &p32->pad) ||
1074 assign_in_user(&p64->start_block, &p32->start_block) || 1074 assign_in_user(&p64->start_block, &p32->start_block) ||
1075 assign_in_user_cast(&p64->blocks, &p32->blocks) || 1075 assign_in_user_cast(&p64->blocks, &p32->blocks) ||
@@ -1085,7 +1085,7 @@ static int put_v4l2_edid32(struct v4l2_edid __user *p64,
1085{ 1085{
1086 void *edid; 1086 void *edid;
1087 1087
1088 if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) || 1088 if (!access_ok(p32, sizeof(*p32)) ||
1089 assign_in_user(&p32->pad, &p64->pad) || 1089 assign_in_user(&p32->pad, &p64->pad) ||
1090 assign_in_user(&p32->start_block, &p64->start_block) || 1090 assign_in_user(&p32->start_block, &p64->start_block) ||
1091 assign_in_user(&p32->blocks, &p64->blocks) || 1091 assign_in_user(&p32->blocks, &p64->blocks) ||
diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
index 5da1f3e3f997..997f92543dd4 100644
--- a/drivers/misc/vmw_vmci/vmci_host.c
+++ b/drivers/misc/vmw_vmci/vmci_host.c
@@ -236,7 +236,7 @@ static int vmci_host_setup_notify(struct vmci_ctx *context,
236 * about the size. 236 * about the size.
237 */ 237 */
238 BUILD_BUG_ON(sizeof(bool) != sizeof(u8)); 238 BUILD_BUG_ON(sizeof(bool) != sizeof(u8));
239 if (!access_ok(VERIFY_WRITE, (void __user *)uva, sizeof(u8))) 239 if (!access_ok((void __user *)uva, sizeof(u8)))
240 return VMCI_ERROR_GENERIC; 240 return VMCI_ERROR_GENERIC;
241 241
242 /* 242 /*
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index aa4a1f5206f1..361fbde76654 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -303,11 +303,10 @@ static int bcm_sf2_sw_mdio_write(struct mii_bus *bus, int addr, int regnum,
303 * send them to our master MDIO bus controller 303 * send them to our master MDIO bus controller
304 */ 304 */
305 if (addr == BRCM_PSEUDO_PHY_ADDR && priv->indir_phy_mask & BIT(addr)) 305 if (addr == BRCM_PSEUDO_PHY_ADDR && priv->indir_phy_mask & BIT(addr))
306 bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val); 306 return bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val);
307 else 307 else
308 mdiobus_write_nested(priv->master_mii_bus, addr, regnum, val); 308 return mdiobus_write_nested(priv->master_mii_bus, addr,
309 309 regnum, val);
310 return 0;
311} 310}
312 311
313static irqreturn_t bcm_sf2_switch_0_isr(int irq, void *dev_id) 312static irqreturn_t bcm_sf2_switch_0_isr(int irq, void *dev_id)
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
index 9dc6da039a6d..3164aad29bcf 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
@@ -473,7 +473,9 @@ static void atl1e_mdio_write(struct net_device *netdev, int phy_id,
473{ 473{
474 struct atl1e_adapter *adapter = netdev_priv(netdev); 474 struct atl1e_adapter *adapter = netdev_priv(netdev);
475 475
476 atl1e_write_phy_reg(&adapter->hw, reg_num & MDIO_REG_ADDR_MASK, val); 476 if (atl1e_write_phy_reg(&adapter->hw,
477 reg_num & MDIO_REG_ADDR_MASK, val))
478 netdev_err(netdev, "write phy register failed\n");
477} 479}
478 480
479static int atl1e_mii_ioctl(struct net_device *netdev, 481static int atl1e_mii_ioctl(struct net_device *netdev,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
index 7c49681407ad..127b1f624413 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
@@ -1229,6 +1229,10 @@ int cudbg_collect_hw_sched(struct cudbg_init *pdbg_init,
1229 1229
1230 rc = cudbg_get_buff(pdbg_init, dbg_buff, sizeof(struct cudbg_hw_sched), 1230 rc = cudbg_get_buff(pdbg_init, dbg_buff, sizeof(struct cudbg_hw_sched),
1231 &temp_buff); 1231 &temp_buff);
1232
1233 if (rc)
1234 return rc;
1235
1232 hw_sched_buff = (struct cudbg_hw_sched *)temp_buff.data; 1236 hw_sched_buff = (struct cudbg_hw_sched *)temp_buff.data;
1233 hw_sched_buff->map = t4_read_reg(padap, TP_TX_MOD_QUEUE_REQ_MAP_A); 1237 hw_sched_buff->map = t4_read_reg(padap, TP_TX_MOD_QUEUE_REQ_MAP_A);
1234 hw_sched_buff->mode = TIMERMODE_G(t4_read_reg(padap, TP_MOD_CONFIG_A)); 1238 hw_sched_buff->mode = TIMERMODE_G(t4_read_reg(padap, TP_MOD_CONFIG_A));
diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
index bc6eb30aa20f..41c6fa200e74 100644
--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
+++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
@@ -928,7 +928,7 @@ int memac_add_hash_mac_address(struct fman_mac *memac, enet_addr_t *eth_addr)
928 hash = get_mac_addr_hash_code(addr) & HASH_CTRL_ADDR_MASK; 928 hash = get_mac_addr_hash_code(addr) & HASH_CTRL_ADDR_MASK;
929 929
930 /* Create element to be added to the driver hash table */ 930 /* Create element to be added to the driver hash table */
931 hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL); 931 hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC);
932 if (!hash_entry) 932 if (!hash_entry)
933 return -ENOMEM; 933 return -ENOMEM;
934 hash_entry->addr = addr; 934 hash_entry->addr = addr;
diff --git a/drivers/net/ethernet/freescale/fman/fman_tgec.c b/drivers/net/ethernet/freescale/fman/fman_tgec.c
index 40705938eecc..f75b9c11b2d2 100644
--- a/drivers/net/ethernet/freescale/fman/fman_tgec.c
+++ b/drivers/net/ethernet/freescale/fman/fman_tgec.c
@@ -553,7 +553,7 @@ int tgec_add_hash_mac_address(struct fman_mac *tgec, enet_addr_t *eth_addr)
553 hash = (crc >> TGEC_HASH_MCAST_SHIFT) & TGEC_HASH_ADR_MSK; 553 hash = (crc >> TGEC_HASH_MCAST_SHIFT) & TGEC_HASH_ADR_MSK;
554 554
555 /* Create element to be added to the driver hash table */ 555 /* Create element to be added to the driver hash table */
556 hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL); 556 hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC);
557 if (!hash_entry) 557 if (!hash_entry)
558 return -ENOMEM; 558 return -ENOMEM;
559 hash_entry->addr = addr; 559 hash_entry->addr = addr;
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index d3b9aaf96c1c..07cd58798083 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -3995,17 +3995,18 @@ static int hns3_reset_notify_up_enet(struct hnae3_handle *handle)
3995 struct hns3_nic_priv *priv = netdev_priv(kinfo->netdev); 3995 struct hns3_nic_priv *priv = netdev_priv(kinfo->netdev);
3996 int ret = 0; 3996 int ret = 0;
3997 3997
3998 clear_bit(HNS3_NIC_STATE_RESETTING, &priv->state);
3999
3998 if (netif_running(kinfo->netdev)) { 4000 if (netif_running(kinfo->netdev)) {
3999 ret = hns3_nic_net_up(kinfo->netdev); 4001 ret = hns3_nic_net_open(kinfo->netdev);
4000 if (ret) { 4002 if (ret) {
4003 set_bit(HNS3_NIC_STATE_RESETTING, &priv->state);
4001 netdev_err(kinfo->netdev, 4004 netdev_err(kinfo->netdev,
4002 "hns net up fail, ret=%d!\n", ret); 4005 "hns net up fail, ret=%d!\n", ret);
4003 return ret; 4006 return ret;
4004 } 4007 }
4005 } 4008 }
4006 4009
4007 clear_bit(HNS3_NIC_STATE_RESETTING, &priv->state);
4008
4009 return ret; 4010 return ret;
4010} 4011}
4011 4012
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c
index 6d48dc62a44b..da323b9e1f62 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c
@@ -1106,6 +1106,11 @@ static void hinic_remove(struct pci_dev *pdev)
1106 dev_info(&pdev->dev, "HiNIC driver - removed\n"); 1106 dev_info(&pdev->dev, "HiNIC driver - removed\n");
1107} 1107}
1108 1108
1109static void hinic_shutdown(struct pci_dev *pdev)
1110{
1111 pci_disable_device(pdev);
1112}
1113
1109static const struct pci_device_id hinic_pci_table[] = { 1114static const struct pci_device_id hinic_pci_table[] = {
1110 { PCI_VDEVICE(HUAWEI, HINIC_DEV_ID_QUAD_PORT_25GE), 0}, 1115 { PCI_VDEVICE(HUAWEI, HINIC_DEV_ID_QUAD_PORT_25GE), 0},
1111 { PCI_VDEVICE(HUAWEI, HINIC_DEV_ID_DUAL_PORT_25GE), 0}, 1116 { PCI_VDEVICE(HUAWEI, HINIC_DEV_ID_DUAL_PORT_25GE), 0},
@@ -1119,6 +1124,7 @@ static struct pci_driver hinic_driver = {
1119 .id_table = hinic_pci_table, 1124 .id_table = hinic_pci_table,
1120 .probe = hinic_probe, 1125 .probe = hinic_probe,
1121 .remove = hinic_remove, 1126 .remove = hinic_remove,
1127 .shutdown = hinic_shutdown,
1122}; 1128};
1123 1129
1124module_pci_driver(hinic_driver); 1130module_pci_driver(hinic_driver);
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index a4681780a55d..098d8764c0ea 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1171,11 +1171,15 @@ out:
1171 1171
1172map_failed_frags: 1172map_failed_frags:
1173 last = i+1; 1173 last = i+1;
1174 for (i = 0; i < last; i++) 1174 for (i = 1; i < last; i++)
1175 dma_unmap_page(&adapter->vdev->dev, descs[i].fields.address, 1175 dma_unmap_page(&adapter->vdev->dev, descs[i].fields.address,
1176 descs[i].fields.flags_len & IBMVETH_BUF_LEN_MASK, 1176 descs[i].fields.flags_len & IBMVETH_BUF_LEN_MASK,
1177 DMA_TO_DEVICE); 1177 DMA_TO_DEVICE);
1178 1178
1179 dma_unmap_single(&adapter->vdev->dev,
1180 descs[0].fields.address,
1181 descs[0].fields.flags_len & IBMVETH_BUF_LEN_MASK,
1182 DMA_TO_DEVICE);
1179map_failed: 1183map_failed:
1180 if (!firmware_has_feature(FW_FEATURE_CMO)) 1184 if (!firmware_has_feature(FW_FEATURE_CMO))
1181 netdev_err(netdev, "tx: unable to map xmit buffer\n"); 1185 netdev_err(netdev, "tx: unable to map xmit buffer\n");
diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index 6a059d6ee03f..e0875476a780 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -5240,6 +5240,8 @@ static int mvpp2_probe(struct platform_device *pdev)
5240 if (has_acpi_companion(&pdev->dev)) { 5240 if (has_acpi_companion(&pdev->dev)) {
5241 acpi_id = acpi_match_device(pdev->dev.driver->acpi_match_table, 5241 acpi_id = acpi_match_device(pdev->dev.driver->acpi_match_table,
5242 &pdev->dev); 5242 &pdev->dev);
5243 if (!acpi_id)
5244 return -EINVAL;
5243 priv->hw_version = (unsigned long)acpi_id->driver_data; 5245 priv->hw_version = (unsigned long)acpi_id->driver_data;
5244 } else { 5246 } else {
5245 priv->hw_version = 5247 priv->hw_version =
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 99bc3de906e2..298930d39b79 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -1477,6 +1477,8 @@ static void __rtl8169_set_wol(struct rtl8169_private *tp, u32 wolopts)
1477 } 1477 }
1478 1478
1479 RTL_W8(tp, Cfg9346, Cfg9346_Lock); 1479 RTL_W8(tp, Cfg9346, Cfg9346_Lock);
1480
1481 device_set_wakeup_enable(tp_to_dev(tp), wolopts);
1480} 1482}
1481 1483
1482static int rtl8169_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol) 1484static int rtl8169_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
@@ -1498,8 +1500,6 @@ static int rtl8169_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
1498 1500
1499 rtl_unlock_work(tp); 1501 rtl_unlock_work(tp);
1500 1502
1501 device_set_wakeup_enable(d, tp->saved_wolopts);
1502
1503 pm_runtime_put_noidle(d); 1503 pm_runtime_put_noidle(d);
1504 1504
1505 return 0; 1505 return 0;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
index d07520fb969e..62ccbd47c1db 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
@@ -59,7 +59,9 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
59 gmac->clk_enabled = 1; 59 gmac->clk_enabled = 1;
60 } else { 60 } else {
61 clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE); 61 clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
62 clk_prepare(gmac->tx_clk); 62 ret = clk_prepare(gmac->tx_clk);
63 if (ret)
64 return ret;
63 } 65 }
64 66
65 return 0; 67 return 0;
diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 9319d84bf49f..d84501441edd 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -8100,6 +8100,8 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
8100 start += 3; 8100 start += 3;
8101 8101
8102 prop_len = niu_pci_eeprom_read(np, start + 4); 8102 prop_len = niu_pci_eeprom_read(np, start + 4);
8103 if (prop_len < 0)
8104 return prop_len;
8103 err = niu_pci_vpd_get_propname(np, start + 5, namebuf, 64); 8105 err = niu_pci_vpd_get_propname(np, start + 5, namebuf, 64);
8104 if (err < 0) 8106 if (err < 0)
8105 return err; 8107 return err;
@@ -8144,8 +8146,12 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
8144 netif_printk(np, probe, KERN_DEBUG, np->dev, 8146 netif_printk(np, probe, KERN_DEBUG, np->dev,
8145 "VPD_SCAN: Reading in property [%s] len[%d]\n", 8147 "VPD_SCAN: Reading in property [%s] len[%d]\n",
8146 namebuf, prop_len); 8148 namebuf, prop_len);
8147 for (i = 0; i < prop_len; i++) 8149 for (i = 0; i < prop_len; i++) {
8148 *prop_buf++ = niu_pci_eeprom_read(np, off + i); 8150 err = niu_pci_eeprom_read(np, off + i);
8151 if (err >= 0)
8152 *prop_buf = err;
8153 ++prop_buf;
8154 }
8149 } 8155 }
8150 8156
8151 start += len; 8157 start += len;
diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
index 054f78295d1d..2a9ba4acd7fa 100644
--- a/drivers/net/ethernet/ti/cpts.c
+++ b/drivers/net/ethernet/ti/cpts.c
@@ -590,7 +590,9 @@ struct cpts *cpts_create(struct device *dev, void __iomem *regs,
590 return ERR_CAST(cpts->refclk); 590 return ERR_CAST(cpts->refclk);
591 } 591 }
592 592
593 clk_prepare(cpts->refclk); 593 ret = clk_prepare(cpts->refclk);
594 if (ret)
595 return ERR_PTR(ret);
594 596
595 cpts->cc.read = cpts_systim_read; 597 cpts->cc.read = cpts_systim_read;
596 cpts->cc.mask = CLOCKSOURCE_MASK(32); 598 cpts->cc.mask = CLOCKSOURCE_MASK(32);
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 28c749980359..a19868cba48c 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -523,10 +523,7 @@ static void resync_tnc(struct timer_list *t)
523 523
524 524
525 /* Start resync timer again -- the TNC might be still absent */ 525 /* Start resync timer again -- the TNC might be still absent */
526 526 mod_timer(&sp->resync_t, jiffies + SIXP_RESYNC_TIMEOUT);
527 del_timer(&sp->resync_t);
528 sp->resync_t.expires = jiffies + SIXP_RESYNC_TIMEOUT;
529 add_timer(&sp->resync_t);
530} 527}
531 528
532static inline int tnc_init(struct sixpack *sp) 529static inline int tnc_init(struct sixpack *sp)
@@ -537,9 +534,7 @@ static inline int tnc_init(struct sixpack *sp)
537 534
538 sp->tty->ops->write(sp->tty, &inbyte, 1); 535 sp->tty->ops->write(sp->tty, &inbyte, 1);
539 536
540 del_timer(&sp->resync_t); 537 mod_timer(&sp->resync_t, jiffies + SIXP_RESYNC_TIMEOUT);
541 sp->resync_t.expires = jiffies + SIXP_RESYNC_TIMEOUT;
542 add_timer(&sp->resync_t);
543 538
544 return 0; 539 return 0;
545} 540}
@@ -897,11 +892,8 @@ static void decode_prio_command(struct sixpack *sp, unsigned char cmd)
897 /* if the state byte has been received, the TNC is present, 892 /* if the state byte has been received, the TNC is present,
898 so the resync timer can be reset. */ 893 so the resync timer can be reset. */
899 894
900 if (sp->tnc_state == TNC_IN_SYNC) { 895 if (sp->tnc_state == TNC_IN_SYNC)
901 del_timer(&sp->resync_t); 896 mod_timer(&sp->resync_t, jiffies + SIXP_INIT_RESYNC_TIMEOUT);
902 sp->resync_t.expires = jiffies + SIXP_INIT_RESYNC_TIMEOUT;
903 add_timer(&sp->resync_t);
904 }
905 897
906 sp->status1 = cmd & SIXP_PRIO_DATA_MASK; 898 sp->status1 = cmd & SIXP_PRIO_DATA_MASK;
907} 899}
diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index 443b2694130c..c0b52e48f0e6 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -1177,8 +1177,6 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp)
1177 goto err_kfree; 1177 goto err_kfree;
1178 } 1178 }
1179 1179
1180 skb_probe_transport_header(skb, ETH_HLEN);
1181
1182 /* Move network header to the right position for VLAN tagged packets */ 1180 /* Move network header to the right position for VLAN tagged packets */
1183 if ((skb->protocol == htons(ETH_P_8021Q) || 1181 if ((skb->protocol == htons(ETH_P_8021Q) ||
1184 skb->protocol == htons(ETH_P_8021AD)) && 1182 skb->protocol == htons(ETH_P_8021AD)) &&
@@ -1189,6 +1187,7 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp)
1189 tap = rcu_dereference(q->tap); 1187 tap = rcu_dereference(q->tap);
1190 if (tap) { 1188 if (tap) {
1191 skb->dev = tap->dev; 1189 skb->dev = tap->dev;
1190 skb_probe_transport_header(skb, ETH_HLEN);
1192 dev_queue_xmit(skb); 1191 dev_queue_xmit(skb);
1193 } else { 1192 } else {
1194 kfree_skb(skb); 1193 kfree_skb(skb);
diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index 7a42336c8af8..839fa7715709 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -1180,7 +1180,6 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
1180 if (register_hdlc_device(dev)) { 1180 if (register_hdlc_device(dev)) {
1181 ret = -ENOBUFS; 1181 ret = -ENOBUFS;
1182 pr_err("ucc_hdlc: unable to register hdlc device\n"); 1182 pr_err("ucc_hdlc: unable to register hdlc device\n");
1183 free_netdev(dev);
1184 goto free_dev; 1183 goto free_dev;
1185 } 1184 }
1186 1185
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 1098263ab862..46c3d983b7b7 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -485,8 +485,10 @@ static int x25_asy_open(struct net_device *dev)
485 485
486 /* Cleanup */ 486 /* Cleanup */
487 kfree(sl->xbuff); 487 kfree(sl->xbuff);
488 sl->xbuff = NULL;
488noxbuff: 489noxbuff:
489 kfree(sl->rbuff); 490 kfree(sl->rbuff);
491 sl->rbuff = NULL;
490norbuff: 492norbuff:
491 return -ENOMEM; 493 return -ENOMEM;
492} 494}
diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
index 7ac035af39f0..6fa1627ce08d 100644
--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -52,7 +52,7 @@ static ssize_t proc_bus_pci_read(struct file *file, char __user *buf,
52 nbytes = size - pos; 52 nbytes = size - pos;
53 cnt = nbytes; 53 cnt = nbytes;
54 54
55 if (!access_ok(VERIFY_WRITE, buf, cnt)) 55 if (!access_ok(buf, cnt))
56 return -EINVAL; 56 return -EINVAL;
57 57
58 pci_config_pm_runtime_get(dev); 58 pci_config_pm_runtime_get(dev);
@@ -125,7 +125,7 @@ static ssize_t proc_bus_pci_write(struct file *file, const char __user *buf,
125 nbytes = size - pos; 125 nbytes = size - pos;
126 cnt = nbytes; 126 cnt = nbytes;
127 127
128 if (!access_ok(VERIFY_READ, buf, cnt)) 128 if (!access_ok(buf, cnt))
129 return -EINVAL; 129 return -EINVAL;
130 130
131 pci_config_pm_runtime_get(dev); 131 pci_config_pm_runtime_get(dev);
diff --git a/drivers/platform/goldfish/goldfish_pipe.c b/drivers/platform/goldfish/goldfish_pipe.c
index 7c639006252e..321bc673c417 100644
--- a/drivers/platform/goldfish/goldfish_pipe.c
+++ b/drivers/platform/goldfish/goldfish_pipe.c
@@ -416,8 +416,7 @@ static ssize_t goldfish_pipe_read_write(struct file *filp,
416 if (unlikely(bufflen == 0)) 416 if (unlikely(bufflen == 0))
417 return 0; 417 return 0;
418 /* Check the buffer range for access */ 418 /* Check the buffer range for access */
419 if (unlikely(!access_ok(is_write ? VERIFY_WRITE : VERIFY_READ, 419 if (unlikely(!access_ok(buffer, bufflen)))
420 buffer, bufflen)))
421 return -EFAULT; 420 return -EFAULT;
422 421
423 address = (unsigned long)buffer; 422 address = (unsigned long)buffer;
diff --git a/drivers/pnp/isapnp/proc.c b/drivers/pnp/isapnp/proc.c
index 262285e48a09..051613140812 100644
--- a/drivers/pnp/isapnp/proc.c
+++ b/drivers/pnp/isapnp/proc.c
@@ -47,7 +47,7 @@ static ssize_t isapnp_proc_bus_read(struct file *file, char __user * buf,
47 nbytes = size - pos; 47 nbytes = size - pos;
48 cnt = nbytes; 48 cnt = nbytes;
49 49
50 if (!access_ok(VERIFY_WRITE, buf, cnt)) 50 if (!access_ok(buf, cnt))
51 return -EINVAL; 51 return -EINVAL;
52 52
53 isapnp_cfg_begin(dev->card->number, dev->number); 53 isapnp_cfg_begin(dev->card->number, dev->number);
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index 7c4673308f5b..e338d7a4f571 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -3600,7 +3600,7 @@ static long pmcraid_ioctl_passthrough(
3600 u32 ioasc; 3600 u32 ioasc;
3601 int request_size; 3601 int request_size;
3602 int buffer_size; 3602 int buffer_size;
3603 u8 access, direction; 3603 u8 direction;
3604 int rc = 0; 3604 int rc = 0;
3605 3605
3606 /* If IOA reset is in progress, wait 10 secs for reset to complete */ 3606 /* If IOA reset is in progress, wait 10 secs for reset to complete */
@@ -3649,10 +3649,8 @@ static long pmcraid_ioctl_passthrough(
3649 request_size = le32_to_cpu(buffer->ioarcb.data_transfer_length); 3649 request_size = le32_to_cpu(buffer->ioarcb.data_transfer_length);
3650 3650
3651 if (buffer->ioarcb.request_flags0 & TRANSFER_DIR_WRITE) { 3651 if (buffer->ioarcb.request_flags0 & TRANSFER_DIR_WRITE) {
3652 access = VERIFY_READ;
3653 direction = DMA_TO_DEVICE; 3652 direction = DMA_TO_DEVICE;
3654 } else { 3653 } else {
3655 access = VERIFY_WRITE;
3656 direction = DMA_FROM_DEVICE; 3654 direction = DMA_FROM_DEVICE;
3657 } 3655 }
3658 3656
diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
index cc30fccc1a2e..840d96fe81bc 100644
--- a/drivers/scsi/scsi_ioctl.c
+++ b/drivers/scsi/scsi_ioctl.c
@@ -221,7 +221,7 @@ int scsi_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
221 221
222 switch (cmd) { 222 switch (cmd) {
223 case SCSI_IOCTL_GET_IDLUN: 223 case SCSI_IOCTL_GET_IDLUN:
224 if (!access_ok(VERIFY_WRITE, arg, sizeof(struct scsi_idlun))) 224 if (!access_ok(arg, sizeof(struct scsi_idlun)))
225 return -EFAULT; 225 return -EFAULT;
226 226
227 __put_user((sdev->id & 0xff) 227 __put_user((sdev->id & 0xff)
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 4e27460ec926..d3f15319b9b3 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -434,7 +434,7 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
434 SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, 434 SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
435 "sg_read: count=%d\n", (int) count)); 435 "sg_read: count=%d\n", (int) count));
436 436
437 if (!access_ok(VERIFY_WRITE, buf, count)) 437 if (!access_ok(buf, count))
438 return -EFAULT; 438 return -EFAULT;
439 if (sfp->force_packid && (count >= SZ_SG_HEADER)) { 439 if (sfp->force_packid && (count >= SZ_SG_HEADER)) {
440 old_hdr = kmalloc(SZ_SG_HEADER, GFP_KERNEL); 440 old_hdr = kmalloc(SZ_SG_HEADER, GFP_KERNEL);
@@ -632,7 +632,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
632 scsi_block_when_processing_errors(sdp->device))) 632 scsi_block_when_processing_errors(sdp->device)))
633 return -ENXIO; 633 return -ENXIO;
634 634
635 if (!access_ok(VERIFY_READ, buf, count)) 635 if (!access_ok(buf, count))
636 return -EFAULT; /* protects following copy_from_user()s + get_user()s */ 636 return -EFAULT; /* protects following copy_from_user()s + get_user()s */
637 if (count < SZ_SG_HEADER) 637 if (count < SZ_SG_HEADER)
638 return -EIO; 638 return -EIO;
@@ -729,7 +729,7 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
729 729
730 if (count < SZ_SG_IO_HDR) 730 if (count < SZ_SG_IO_HDR)
731 return -EINVAL; 731 return -EINVAL;
732 if (!access_ok(VERIFY_READ, buf, count)) 732 if (!access_ok(buf, count))
733 return -EFAULT; /* protects following copy_from_user()s + get_user()s */ 733 return -EFAULT; /* protects following copy_from_user()s + get_user()s */
734 734
735 sfp->cmd_q = 1; /* when sg_io_hdr seen, set command queuing on */ 735 sfp->cmd_q = 1; /* when sg_io_hdr seen, set command queuing on */
@@ -768,7 +768,7 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
768 sg_remove_request(sfp, srp); 768 sg_remove_request(sfp, srp);
769 return -EMSGSIZE; 769 return -EMSGSIZE;
770 } 770 }
771 if (!access_ok(VERIFY_READ, hp->cmdp, hp->cmd_len)) { 771 if (!access_ok(hp->cmdp, hp->cmd_len)) {
772 sg_remove_request(sfp, srp); 772 sg_remove_request(sfp, srp);
773 return -EFAULT; /* protects following copy_from_user()s + get_user()s */ 773 return -EFAULT; /* protects following copy_from_user()s + get_user()s */
774 } 774 }
@@ -922,7 +922,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
922 return -ENODEV; 922 return -ENODEV;
923 if (!scsi_block_when_processing_errors(sdp->device)) 923 if (!scsi_block_when_processing_errors(sdp->device))
924 return -ENXIO; 924 return -ENXIO;
925 if (!access_ok(VERIFY_WRITE, p, SZ_SG_IO_HDR)) 925 if (!access_ok(p, SZ_SG_IO_HDR))
926 return -EFAULT; 926 return -EFAULT;
927 result = sg_new_write(sfp, filp, p, SZ_SG_IO_HDR, 927 result = sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,
928 1, read_only, 1, &srp); 928 1, read_only, 1, &srp);
@@ -968,7 +968,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
968 case SG_GET_LOW_DMA: 968 case SG_GET_LOW_DMA:
969 return put_user((int) sdp->device->host->unchecked_isa_dma, ip); 969 return put_user((int) sdp->device->host->unchecked_isa_dma, ip);
970 case SG_GET_SCSI_ID: 970 case SG_GET_SCSI_ID:
971 if (!access_ok(VERIFY_WRITE, p, sizeof (sg_scsi_id_t))) 971 if (!access_ok(p, sizeof (sg_scsi_id_t)))
972 return -EFAULT; 972 return -EFAULT;
973 else { 973 else {
974 sg_scsi_id_t __user *sg_idp = p; 974 sg_scsi_id_t __user *sg_idp = p;
@@ -997,7 +997,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
997 sfp->force_packid = val ? 1 : 0; 997 sfp->force_packid = val ? 1 : 0;
998 return 0; 998 return 0;
999 case SG_GET_PACK_ID: 999 case SG_GET_PACK_ID:
1000 if (!access_ok(VERIFY_WRITE, ip, sizeof (int))) 1000 if (!access_ok(ip, sizeof (int)))
1001 return -EFAULT; 1001 return -EFAULT;
1002 read_lock_irqsave(&sfp->rq_list_lock, iflags); 1002 read_lock_irqsave(&sfp->rq_list_lock, iflags);
1003 list_for_each_entry(srp, &sfp->rq_list, entry) { 1003 list_for_each_entry(srp, &sfp->rq_list, entry) {
@@ -1078,7 +1078,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
1078 val = (sdp->device ? 1 : 0); 1078 val = (sdp->device ? 1 : 0);
1079 return put_user(val, ip); 1079 return put_user(val, ip);
1080 case SG_GET_REQUEST_TABLE: 1080 case SG_GET_REQUEST_TABLE:
1081 if (!access_ok(VERIFY_WRITE, p, SZ_SG_REQ_INFO * SG_MAX_QUEUE)) 1081 if (!access_ok(p, SZ_SG_REQ_INFO * SG_MAX_QUEUE))
1082 return -EFAULT; 1082 return -EFAULT;
1083 else { 1083 else {
1084 sg_req_info_t *rinfo; 1084 sg_req_info_t *rinfo;
diff --git a/drivers/staging/comedi/comedi_compat32.c b/drivers/staging/comedi/comedi_compat32.c
index fa9d239474ee..36a3564ba1fb 100644
--- a/drivers/staging/comedi/comedi_compat32.c
+++ b/drivers/staging/comedi/comedi_compat32.c
@@ -102,8 +102,8 @@ static int compat_chaninfo(struct file *file, unsigned long arg)
102 chaninfo = compat_alloc_user_space(sizeof(*chaninfo)); 102 chaninfo = compat_alloc_user_space(sizeof(*chaninfo));
103 103
104 /* Copy chaninfo structure. Ignore unused members. */ 104 /* Copy chaninfo structure. Ignore unused members. */
105 if (!access_ok(VERIFY_READ, chaninfo32, sizeof(*chaninfo32)) || 105 if (!access_ok(chaninfo32, sizeof(*chaninfo32)) ||
106 !access_ok(VERIFY_WRITE, chaninfo, sizeof(*chaninfo))) 106 !access_ok(chaninfo, sizeof(*chaninfo)))
107 return -EFAULT; 107 return -EFAULT;
108 108
109 err = 0; 109 err = 0;
@@ -136,8 +136,8 @@ static int compat_rangeinfo(struct file *file, unsigned long arg)
136 rangeinfo = compat_alloc_user_space(sizeof(*rangeinfo)); 136 rangeinfo = compat_alloc_user_space(sizeof(*rangeinfo));
137 137
138 /* Copy rangeinfo structure. */ 138 /* Copy rangeinfo structure. */
139 if (!access_ok(VERIFY_READ, rangeinfo32, sizeof(*rangeinfo32)) || 139 if (!access_ok(rangeinfo32, sizeof(*rangeinfo32)) ||
140 !access_ok(VERIFY_WRITE, rangeinfo, sizeof(*rangeinfo))) 140 !access_ok(rangeinfo, sizeof(*rangeinfo)))
141 return -EFAULT; 141 return -EFAULT;
142 142
143 err = 0; 143 err = 0;
@@ -163,8 +163,8 @@ static int get_compat_cmd(struct comedi_cmd __user *cmd,
163 } temp; 163 } temp;
164 164
165 /* Copy cmd structure. */ 165 /* Copy cmd structure. */
166 if (!access_ok(VERIFY_READ, cmd32, sizeof(*cmd32)) || 166 if (!access_ok(cmd32, sizeof(*cmd32)) ||
167 !access_ok(VERIFY_WRITE, cmd, sizeof(*cmd))) 167 !access_ok(cmd, sizeof(*cmd)))
168 return -EFAULT; 168 return -EFAULT;
169 169
170 err = 0; 170 err = 0;
@@ -217,8 +217,8 @@ static int put_compat_cmd(struct comedi32_cmd_struct __user *cmd32,
217 * Assume the pointer values are already valid. 217 * Assume the pointer values are already valid.
218 * (Could use ptr_to_compat() to set them.) 218 * (Could use ptr_to_compat() to set them.)
219 */ 219 */
220 if (!access_ok(VERIFY_READ, cmd, sizeof(*cmd)) || 220 if (!access_ok(cmd, sizeof(*cmd)) ||
221 !access_ok(VERIFY_WRITE, cmd32, sizeof(*cmd32))) 221 !access_ok(cmd32, sizeof(*cmd32)))
222 return -EFAULT; 222 return -EFAULT;
223 223
224 err = 0; 224 err = 0;
@@ -317,8 +317,8 @@ static int get_compat_insn(struct comedi_insn __user *insn,
317 317
318 /* Copy insn structure. Ignore the unused members. */ 318 /* Copy insn structure. Ignore the unused members. */
319 err = 0; 319 err = 0;
320 if (!access_ok(VERIFY_READ, insn32, sizeof(*insn32)) || 320 if (!access_ok(insn32, sizeof(*insn32)) ||
321 !access_ok(VERIFY_WRITE, insn, sizeof(*insn))) 321 !access_ok(insn, sizeof(*insn)))
322 return -EFAULT; 322 return -EFAULT;
323 323
324 err |= __get_user(temp.uint, &insn32->insn); 324 err |= __get_user(temp.uint, &insn32->insn);
@@ -350,7 +350,7 @@ static int compat_insnlist(struct file *file, unsigned long arg)
350 insnlist32 = compat_ptr(arg); 350 insnlist32 = compat_ptr(arg);
351 351
352 /* Get 32-bit insnlist structure. */ 352 /* Get 32-bit insnlist structure. */
353 if (!access_ok(VERIFY_READ, insnlist32, sizeof(*insnlist32))) 353 if (!access_ok(insnlist32, sizeof(*insnlist32)))
354 return -EFAULT; 354 return -EFAULT;
355 355
356 err = 0; 356 err = 0;
@@ -365,7 +365,7 @@ static int compat_insnlist(struct file *file, unsigned long arg)
365 insn[n_insns])); 365 insn[n_insns]));
366 366
367 /* Set native insnlist structure. */ 367 /* Set native insnlist structure. */
368 if (!access_ok(VERIFY_WRITE, &s->insnlist, sizeof(s->insnlist))) 368 if (!access_ok(&s->insnlist, sizeof(s->insnlist)))
369 return -EFAULT; 369 return -EFAULT;
370 370
371 err |= __put_user(n_insns, &s->insnlist.n_insns); 371 err |= __put_user(n_insns, &s->insnlist.n_insns);
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index 99460af61b77..4164414d4c64 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -573,7 +573,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
573 return -EIO; 573 return -EIO;
574 574
575 /* verify user access to buffer */ 575 /* verify user access to buffer */
576 if (!access_ok(VERIFY_WRITE, buf, nr)) { 576 if (!access_ok(buf, nr)) {
577 printk(KERN_WARNING "%s(%d) n_hdlc_tty_read() can't verify user " 577 printk(KERN_WARNING "%s(%d) n_hdlc_tty_read() can't verify user "
578 "buffer\n", __FILE__, __LINE__); 578 "buffer\n", __FILE__, __LINE__);
579 return -EFAULT; 579 return -EFAULT;
diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
index 3de3c750b5f6..44f28a114c2b 100644
--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -598,7 +598,7 @@ static ssize_t usb_device_read(struct file *file, char __user *buf,
598 return -EINVAL; 598 return -EINVAL;
599 if (nbytes <= 0) 599 if (nbytes <= 0)
600 return 0; 600 return 0;
601 if (!access_ok(VERIFY_WRITE, buf, nbytes)) 601 if (!access_ok(buf, nbytes))
602 return -EFAULT; 602 return -EFAULT;
603 603
604 mutex_lock(&usb_bus_idr_lock); 604 mutex_lock(&usb_bus_idr_lock);
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index a75bc0b8a50f..d65566341dd1 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1094,7 +1094,7 @@ static int proc_control(struct usb_dev_state *ps, void __user *arg)
1094 ctrl.bRequestType, ctrl.bRequest, ctrl.wValue, 1094 ctrl.bRequestType, ctrl.bRequest, ctrl.wValue,
1095 ctrl.wIndex, ctrl.wLength); 1095 ctrl.wIndex, ctrl.wLength);
1096 if (ctrl.bRequestType & 0x80) { 1096 if (ctrl.bRequestType & 0x80) {
1097 if (ctrl.wLength && !access_ok(VERIFY_WRITE, ctrl.data, 1097 if (ctrl.wLength && !access_ok(ctrl.data,
1098 ctrl.wLength)) { 1098 ctrl.wLength)) {
1099 ret = -EINVAL; 1099 ret = -EINVAL;
1100 goto done; 1100 goto done;
@@ -1183,7 +1183,7 @@ static int proc_bulk(struct usb_dev_state *ps, void __user *arg)
1183 } 1183 }
1184 tmo = bulk.timeout; 1184 tmo = bulk.timeout;
1185 if (bulk.ep & 0x80) { 1185 if (bulk.ep & 0x80) {
1186 if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) { 1186 if (len1 && !access_ok(bulk.data, len1)) {
1187 ret = -EINVAL; 1187 ret = -EINVAL;
1188 goto done; 1188 goto done;
1189 } 1189 }
@@ -1584,8 +1584,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
1584 } 1584 }
1585 1585
1586 if (uurb->buffer_length > 0 && 1586 if (uurb->buffer_length > 0 &&
1587 !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, 1587 !access_ok(uurb->buffer, uurb->buffer_length)) {
1588 uurb->buffer, uurb->buffer_length)) {
1589 ret = -EFAULT; 1588 ret = -EFAULT;
1590 goto error; 1589 goto error;
1591 } 1590 }
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 54e859dcb25c..75b113a5b25c 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -252,7 +252,7 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer,
252 if (!count) 252 if (!count)
253 return 0; 253 return 0;
254 254
255 if (!access_ok(VERIFY_WRITE, buffer, count)) 255 if (!access_ok(buffer, count))
256 return -EFAULT; 256 return -EFAULT;
257 257
258 spin_lock_irqsave(&hidg->read_spinlock, flags); 258 spin_lock_irqsave(&hidg->read_spinlock, flags);
@@ -339,7 +339,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
339 unsigned long flags; 339 unsigned long flags;
340 ssize_t status = -ENOMEM; 340 ssize_t status = -ENOMEM;
341 341
342 if (!access_ok(VERIFY_READ, buffer, count)) 342 if (!access_ok(buffer, count))
343 return -EFAULT; 343 return -EFAULT;
344 344
345 spin_lock_irqsave(&hidg->write_spinlock, flags); 345 spin_lock_irqsave(&hidg->write_spinlock, flags);
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 11247322d587..660712e0bf98 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -88,7 +88,7 @@ static ssize_t queue_dbg_read(struct file *file, char __user *buf,
88 size_t len, remaining, actual = 0; 88 size_t len, remaining, actual = 0;
89 char tmpbuf[38]; 89 char tmpbuf[38];
90 90
91 if (!access_ok(VERIFY_WRITE, buf, nbytes)) 91 if (!access_ok(buf, nbytes))
92 return -EFAULT; 92 return -EFAULT;
93 93
94 inode_lock(file_inode(file)); 94 inode_lock(file_inode(file));
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 55e5aa662ad5..9f7942cbcbb2 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -655,7 +655,7 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz)
655 a + (unsigned long)log_base > ULONG_MAX) 655 a + (unsigned long)log_base > ULONG_MAX)
656 return false; 656 return false;
657 657
658 return access_ok(VERIFY_WRITE, log_base + a, 658 return access_ok(log_base + a,
659 (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8); 659 (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8);
660} 660}
661 661
@@ -681,7 +681,7 @@ static bool vq_memory_access_ok(void __user *log_base, struct vhost_umem *umem,
681 return false; 681 return false;
682 682
683 683
684 if (!access_ok(VERIFY_WRITE, (void __user *)a, 684 if (!access_ok((void __user *)a,
685 node->size)) 685 node->size))
686 return false; 686 return false;
687 else if (log_all && !log_access_ok(log_base, 687 else if (log_all && !log_access_ok(log_base,
@@ -973,10 +973,10 @@ static bool umem_access_ok(u64 uaddr, u64 size, int access)
973 return false; 973 return false;
974 974
975 if ((access & VHOST_ACCESS_RO) && 975 if ((access & VHOST_ACCESS_RO) &&
976 !access_ok(VERIFY_READ, (void __user *)a, size)) 976 !access_ok((void __user *)a, size))
977 return false; 977 return false;
978 if ((access & VHOST_ACCESS_WO) && 978 if ((access & VHOST_ACCESS_WO) &&
979 !access_ok(VERIFY_WRITE, (void __user *)a, size)) 979 !access_ok((void __user *)a, size))
980 return false; 980 return false;
981 return true; 981 return true;
982} 982}
@@ -1185,10 +1185,10 @@ static bool vq_access_ok(struct vhost_virtqueue *vq, unsigned int num,
1185{ 1185{
1186 size_t s = vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX) ? 2 : 0; 1186 size_t s = vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX) ? 2 : 0;
1187 1187
1188 return access_ok(VERIFY_READ, desc, num * sizeof *desc) && 1188 return access_ok(desc, num * sizeof *desc) &&
1189 access_ok(VERIFY_READ, avail, 1189 access_ok(avail,
1190 sizeof *avail + num * sizeof *avail->ring + s) && 1190 sizeof *avail + num * sizeof *avail->ring + s) &&
1191 access_ok(VERIFY_WRITE, used, 1191 access_ok(used,
1192 sizeof *used + num * sizeof *used->ring + s); 1192 sizeof *used + num * sizeof *used->ring + s);
1193} 1193}
1194 1194
@@ -1814,7 +1814,7 @@ int vhost_vq_init_access(struct vhost_virtqueue *vq)
1814 goto err; 1814 goto err;
1815 vq->signalled_used_valid = false; 1815 vq->signalled_used_valid = false;
1816 if (!vq->iotlb && 1816 if (!vq->iotlb &&
1817 !access_ok(VERIFY_READ, &vq->used->idx, sizeof vq->used->idx)) { 1817 !access_ok(&vq->used->idx, sizeof vq->used->idx)) {
1818 r = -EFAULT; 1818 r = -EFAULT;
1819 goto err; 1819 goto err;
1820 } 1820 }
diff --git a/drivers/video/fbdev/amifb.c b/drivers/video/fbdev/amifb.c
index 0777aff211e5..758457026694 100644
--- a/drivers/video/fbdev/amifb.c
+++ b/drivers/video/fbdev/amifb.c
@@ -1855,7 +1855,7 @@ static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var,
1855 var->yspot = par->crsr.spot_y; 1855 var->yspot = par->crsr.spot_y;
1856 if (size > var->height * var->width) 1856 if (size > var->height * var->width)
1857 return -ENAMETOOLONG; 1857 return -ENAMETOOLONG;
1858 if (!access_ok(VERIFY_WRITE, data, size)) 1858 if (!access_ok(data, size))
1859 return -EFAULT; 1859 return -EFAULT;
1860 delta = 1 << par->crsr.fmode; 1860 delta = 1 << par->crsr.fmode;
1861 lspr = lofsprite + (delta << 1); 1861 lspr = lofsprite + (delta << 1);
@@ -1935,7 +1935,7 @@ static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var,
1935 return -EINVAL; 1935 return -EINVAL;
1936 if (!var->height) 1936 if (!var->height)
1937 return -EINVAL; 1937 return -EINVAL;
1938 if (!access_ok(VERIFY_READ, data, var->width * var->height)) 1938 if (!access_ok(data, var->width * var->height))
1939 return -EFAULT; 1939 return -EFAULT;
1940 delta = 1 << fmode; 1940 delta = 1 << fmode;
1941 lofsprite = shfsprite = (u_short *)spritememory; 1941 lofsprite = shfsprite = (u_short *)spritememory;
diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
index a3edb20ea4c3..53f93616c671 100644
--- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
@@ -493,7 +493,7 @@ static int omapfb_memory_read(struct fb_info *fbi,
493 if (!display || !display->driver->memory_read) 493 if (!display || !display->driver->memory_read)
494 return -ENOENT; 494 return -ENOENT;
495 495
496 if (!access_ok(VERIFY_WRITE, mr->buffer, mr->buffer_size)) 496 if (!access_ok(mr->buffer, mr->buffer_size))
497 return -EFAULT; 497 return -EFAULT;
498 498
499 if (mr->w > 4096 || mr->h > 4096) 499 if (mr->w > 4096 || mr->h > 4096)
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 7e6e682104dc..b24ddac1604b 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -459,14 +459,14 @@ static long privcmd_ioctl_mmap_batch(
459 return -EFAULT; 459 return -EFAULT;
460 /* Returns per-frame error in m.arr. */ 460 /* Returns per-frame error in m.arr. */
461 m.err = NULL; 461 m.err = NULL;
462 if (!access_ok(VERIFY_WRITE, m.arr, m.num * sizeof(*m.arr))) 462 if (!access_ok(m.arr, m.num * sizeof(*m.arr)))
463 return -EFAULT; 463 return -EFAULT;
464 break; 464 break;
465 case 2: 465 case 2:
466 if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch_v2))) 466 if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch_v2)))
467 return -EFAULT; 467 return -EFAULT;
468 /* Returns per-frame error code in m.err. */ 468 /* Returns per-frame error code in m.err. */
469 if (!access_ok(VERIFY_WRITE, m.err, m.num * (sizeof(*m.err)))) 469 if (!access_ok(m.err, m.num * (sizeof(*m.err))))
470 return -EFAULT; 470 return -EFAULT;
471 break; 471 break;
472 default: 472 default:
@@ -661,7 +661,7 @@ static long privcmd_ioctl_dm_op(struct file *file, void __user *udata)
661 goto out; 661 goto out;
662 } 662 }
663 663
664 if (!access_ok(VERIFY_WRITE, kbufs[i].uptr, 664 if (!access_ok(kbufs[i].uptr,
665 kbufs[i].size)) { 665 kbufs[i].size)) {
666 rc = -EFAULT; 666 rc = -EFAULT;
667 goto out; 667 goto out;
generated by cgit v1.2.2 (git 2.25.0) at 2025-09-30 23:23:35 -0400