Merge branch 'for-spi' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull spi uaccess delousing from Al Viro:
 "Getting rid of pointless __get_user() and friends in drivers/spi.

  [ the only reason it's on a separate branch is that I hoped it would
    be picked by spi folks; looks like mail asking them to grab it got
    lost and I hadn't followed up on that ]"

* 'for-spi' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  spidev: quit messing with access_ok()

1 files changed, 11 insertions, 31 deletions

diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index d4d2d8d9f3e7..cda10719d1d1 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -253,10 +253,6 @@ static int spidev_message(struct spidev_data *spidev,
                                 goto done;
                         }
                         k_tmp->rx_buf = rx_buf;
-                        if (!access_ok(VERIFY_WRITE, (u8 __user *)
-                                                (uintptr_t) u_tmp->rx_buf,
-                                                u_tmp->len))
-                                goto done;
                         rx_buf += k_tmp->len;
                 }
                 if (u_tmp->tx_buf) {
@@ -304,7 +300,7 @@ static int spidev_message(struct spidev_data *spidev,
         rx_buf = spidev->rx_buffer;
         for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) {
                 if (u_tmp->rx_buf) {
-                        if (__copy_to_user((u8 __user *)
+                        if (copy_to_user((u8 __user *)
                                         (uintptr_t) u_tmp->rx_buf, rx_buf,
                                         u_tmp->len)) {
                                 status = -EFAULT;
@@ -346,7 +342,6 @@ spidev_get_ioc_message(unsigned int cmd, struct spi_ioc_transfer __user *u_ioc,
 static long
 spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
-        int                     err = 0;
         int                     retval = 0;
         struct spidev_data      *spidev;
         struct spi_device       *spi;
@@ -358,19 +353,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         if (_IOC_TYPE(cmd) != SPI_IOC_MAGIC)
                 return -ENOTTY;
 
-        /* Check access direction once here; don't repeat below.
-         * IOC_DIR is from the user perspective, while access_ok is
-         * from the kernel perspective; so they look reversed.
-         */
-        if (_IOC_DIR(cmd) & _IOC_READ)
-                err = !access_ok(VERIFY_WRITE,
-                                (void __user *)arg, _IOC_SIZE(cmd));
-        if (err == 0 && _IOC_DIR(cmd) & _IOC_WRITE)
-                err = !access_ok(VERIFY_READ,
-                                (void __user *)arg, _IOC_SIZE(cmd));
-        if (err)
-                return -EFAULT;
-
         /* guard against device removal before, or while,
          * we issue this ioctl.
          */
@@ -393,31 +375,31 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         switch (cmd) {
         /* read requests */
         case SPI_IOC_RD_MODE:
-                retval = __put_user(spi->mode & SPI_MODE_MASK,
+                retval = put_user(spi->mode & SPI_MODE_MASK,
                                         (__u8 __user *)arg);
                 break;
         case SPI_IOC_RD_MODE32:
-                retval = __put_user(spi->mode & SPI_MODE_MASK,
+                retval = put_user(spi->mode & SPI_MODE_MASK,
                                         (__u32 __user *)arg);
                 break;
         case SPI_IOC_RD_LSB_FIRST:
-                retval = __put_user((spi->mode & SPI_LSB_FIRST) ?  1 : 0,
+                retval = put_user((spi->mode & SPI_LSB_FIRST) ?  1 : 0,
                                         (__u8 __user *)arg);
                 break;
         case SPI_IOC_RD_BITS_PER_WORD:
-                retval = __put_user(spi->bits_per_word, (__u8 __user *)arg);
+                retval = put_user(spi->bits_per_word, (__u8 __user *)arg);
                 break;
         case SPI_IOC_RD_MAX_SPEED_HZ:
-                retval = __put_user(spidev->speed_hz, (__u32 __user *)arg);
+                retval = put_user(spidev->speed_hz, (__u32 __user *)arg);
                 break;
 
         /* write requests */
         case SPI_IOC_WR_MODE:
         case SPI_IOC_WR_MODE32:
                 if (cmd == SPI_IOC_WR_MODE)
-                        retval = __get_user(tmp, (u8 __user *)arg);
+                        retval = get_user(tmp, (u8 __user *)arg);
                 else
-                        retval = __get_user(tmp, (u32 __user *)arg);
+                        retval = get_user(tmp, (u32 __user *)arg);
                 if (retval == 0) {
                         u32     save = spi->mode;
 
@@ -436,7 +418,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 }
                 break;
         case SPI_IOC_WR_LSB_FIRST:
-                retval = __get_user(tmp, (__u8 __user *)arg);
+                retval = get_user(tmp, (__u8 __user *)arg);
                 if (retval == 0) {
                         u32     save = spi->mode;
 
@@ -453,7 +435,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 }
                 break;
         case SPI_IOC_WR_BITS_PER_WORD:
-                retval = __get_user(tmp, (__u8 __user *)arg);
+                retval = get_user(tmp, (__u8 __user *)arg);
                 if (retval == 0) {
                         u8      save = spi->bits_per_word;
 
@@ -466,7 +448,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 }
                 break;
         case SPI_IOC_WR_MAX_SPEED_HZ:
-                retval = __get_user(tmp, (__u32 __user *)arg);
+                retval = get_user(tmp, (__u32 __user *)arg);
                 if (retval == 0) {
                         u32     save = spi->max_speed_hz;
 
@@ -516,8 +498,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
         struct spi_ioc_transfer         *ioc;
 
         u_ioc = (struct spi_ioc_transfer __user *) compat_ptr(arg);
-        if (!access_ok(VERIFY_READ, u_ioc, _IOC_SIZE(cmd)))
-                return -EFAULT;
 
         /* guard against device removal before, or while,
          * we issue this ioctl.