14 files changed, 0 insertions, 187 deletions

diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index 0fccf149f5aa..4c2f84c2a7c7 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -104,11 +104,6 @@ static int block2mtd_read(struct mtd_info *mtd, loff_t from, size_t len,
         int offset = from & (PAGE_SIZE-1);
         int cpylen;
 
-        if (from > mtd->size)
-                return -EINVAL;
-        if (from + len > mtd->size)
-                len = mtd->size - from;
-
         if (retlen)
                 *retlen = 0;
 
@@ -190,10 +185,6 @@ static int block2mtd_write(struct mtd_info *mtd, loff_t to, size_t len,
 
         if (!len)
                 return 0;
-        if (to >= mtd->size)
-                return -ENOSPC;
-        if (to + len > mtd->size)
-                len = mtd->size - to;
 
         mutex_lock(&dev->write_mutex);
         err = _block2mtd_write(dev, buf, to, len, retlen);
diff --git a/drivers/mtd/devices/doc2000.c b/drivers/mtd/devices/doc2000.c
index 115d890e9919..ee4ee0b8440d 100644
--- a/drivers/mtd/devices/doc2000.c
+++ b/drivers/mtd/devices/doc2000.c
@@ -602,10 +602,6 @@ static int doc_read(struct mtd_info *mtd, loff_t from, size_t len,
         int i, len256 = 0, ret=0;
         size_t left = len;
 
-        /* Don't allow read past end of device */
-        if (from >= this->totlen)
-                return -EINVAL;
-
         mutex_lock(&this->lock);
 
         *retlen = 0;
@@ -748,10 +744,6 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
         size_t left = len;
         int status;
 
-        /* Don't allow write past end of device */
-        if (to >= this->totlen)
-                return -EINVAL;
-
         mutex_lock(&this->lock);
 
         *retlen = 0;
diff --git a/drivers/mtd/devices/doc2001.c b/drivers/mtd/devices/doc2001.c
index b1185f938711..17844155a685 100644
--- a/drivers/mtd/devices/doc2001.c
+++ b/drivers/mtd/devices/doc2001.c
@@ -383,10 +383,6 @@ static int doc_read (struct mtd_info *mtd, loff_t from, size_t len,
         void __iomem *docptr = this->virtadr;
         struct Nand *mychip = &this->chips[from >> (this->chipshift)];
 
-        /* Don't allow read past end of device */
-        if (from >= this->totlen)
-                return -EINVAL;
-
         /* Don't allow a single read to cross a 512-byte block boundary */
         if (from + len > ((from | 0x1ff) + 1))
                 len = ((from | 0x1ff) + 1) - from;
@@ -494,10 +490,6 @@ static int doc_write (struct mtd_info *mtd, loff_t to, size_t len,
         void __iomem *docptr = this->virtadr;
         struct Nand *mychip = &this->chips[to >> (this->chipshift)];
 
-        /* Don't allow write past end of device */
-        if (to >= this->totlen)
-                return -EINVAL;
-
 #if 0
         /* Don't allow a single write to cross a 512-byte block boundary */
         if (to + len > ( (to | 0x1ff) + 1))
diff --git a/drivers/mtd/devices/doc2001plus.c b/drivers/mtd/devices/doc2001plus.c
index c9fbadd3303e..a472bab7ef2b 100644
--- a/drivers/mtd/devices/doc2001plus.c
+++ b/drivers/mtd/devices/doc2001plus.c
@@ -581,10 +581,6 @@ static int doc_read(struct mtd_info *mtd, loff_t from, size_t len,
         void __iomem * docptr = this->virtadr;
         struct Nand *mychip = &this->chips[from >> (this->chipshift)];
 
-        /* Don't allow read past end of device */
-        if (from >= this->totlen)
-                return -EINVAL;
-
         /* Don't allow a single read to cross a 512-byte block boundary */
         if (from + len > ((from | 0x1ff) + 1))
                 len = ((from | 0x1ff) + 1) - from;
@@ -700,10 +696,6 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
         void __iomem * docptr = this->virtadr;
         struct Nand *mychip = &this->chips[to >> (this->chipshift)];
 
-        /* Don't allow write past end of device */
-        if (to >= this->totlen)
-                return -EINVAL;
-
         /* Don't allow writes which aren't exactly one block (512 bytes) */
         if ((to & 0x1ff) || (len != 0x200))
                 return -EINVAL;
diff --git a/drivers/mtd/devices/lart.c b/drivers/mtd/devices/lart.c
index 6d6502c2ec35..c9ae60112a90 100644
--- a/drivers/mtd/devices/lart.c
+++ b/drivers/mtd/devices/lart.c
@@ -367,9 +367,6 @@ static int flash_erase (struct mtd_info *mtd,struct erase_info *instr)
    printk (KERN_DEBUG "%s(addr = 0x%.8x, len = %d)\n", __func__, instr->addr, instr->len);
 #endif
 
-   /* sanity checks */
-   if (instr->addr + instr->len > mtd->size) return (-EINVAL);
-
    /*
         * check that both start and end of the requested erase are
         * aligned with the erasesize at the appropriate addresses.
@@ -442,7 +439,6 @@ static int flash_read (struct mtd_info *mtd,loff_t from,size_t len,size_t *retle
 
    /* sanity checks */
    if (!len) return (0);
-   if (from + len > mtd->size) return (-EINVAL);
 
    /* we always read len bytes */
    *retlen = len;
@@ -526,7 +522,6 @@ static int flash_write (struct mtd_info *mtd,loff_t to,size_t len,size_t *retlen
 
    /* sanity checks */
    if (!len) return (0);
-   if (to + len > mtd->size) return (-EINVAL);
 
    /* first, we write a 0xFF.... padded byte until we reach a dword boundary */
    if (to & (BUSWIDTH - 1))
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 8808da9ee31f..0955a8f4fd25 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -288,9 +288,6 @@ static int m25p80_erase(struct mtd_info *mtd, struct erase_info *instr)
                         __func__, (long long)instr->addr,
                         (long long)instr->len);
 
-        /* sanity checks */
-        if (instr->addr + instr->len > flash->mtd.size)
-                return -EINVAL;
         div_u64_rem(instr->len, mtd->erasesize, &rem);
         if (rem)
                 return -EINVAL;
@@ -353,9 +350,6 @@ static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
         if (!len)
                 return 0;
 
-        if (from + len > flash->mtd.size)
-                return -EINVAL;
-
         spi_message_init(&m);
         memset(t, 0, (sizeof t));
 
@@ -423,9 +417,6 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
         if (!len)
                 return(0);
 
-        if (to + len > flash->mtd.size)
-                return -EINVAL;
-
         spi_message_init(&m);
         memset(t, 0, (sizeof t));
 
@@ -515,9 +506,6 @@ static int sst_write(struct mtd_info *mtd, loff_t to, size_t len,
         if (!len)
                 return 0;
 
-        if (to + len > flash->mtd.size)
-                return -EINVAL;
-
         spi_message_init(&m);
         memset(t, 0, (sizeof t));
 
diff --git a/drivers/mtd/devices/ms02-nv.c b/drivers/mtd/devices/ms02-nv.c
index 3a05af529e7d..182849d39c61 100644
--- a/drivers/mtd/devices/ms02-nv.c
+++ b/drivers/mtd/devices/ms02-nv.c
@@ -59,12 +59,8 @@ static int ms02nv_read(struct mtd_info *mtd, loff_t from,
 {
         struct ms02nv_private *mp = mtd->priv;
 
-        if (from + len > mtd->size)
-                return -EINVAL;
-
         memcpy(buf, mp->uaddr + from, len);
         *retlen = len;
-
         return 0;
 }
 
@@ -73,12 +69,8 @@ static int ms02nv_write(struct mtd_info *mtd, loff_t to,
 {
         struct ms02nv_private *mp = mtd->priv;
 
-        if (to + len > mtd->size)
-                return -EINVAL;
-
         memcpy(mp->uaddr + to, buf, len);
         *retlen = len;
-
         return 0;
 }
 
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index fd4a9fc0d8b8..fc5c78171844 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -164,9 +164,6 @@ static int dataflash_erase(struct mtd_info *mtd, struct erase_info *instr)
               dev_name(&spi->dev), (long long)instr->addr,
               (long long)instr->len);
 
-        /* Sanity checks */
-        if (instr->addr + instr->len > mtd->size)
-                return -EINVAL;
         div_u64_rem(instr->len, priv->page_size, &rem);
         if (rem)
                 return -EINVAL;
@@ -257,8 +254,6 @@ static int dataflash_read(struct mtd_info *mtd, loff_t from, size_t len,
         /* Sanity checks */
         if (!len)
                 return 0;
-        if (from + len > mtd->size)
-                return -EINVAL;
 
         /* Calculate flash page/byte address */
         addr = (((unsigned)from / priv->page_size) << priv->page_offset)
@@ -333,8 +328,6 @@ static int dataflash_write(struct mtd_info *mtd, loff_t to, size_t len,
         /* Sanity checks */
         if (!len)
                 return 0;
-        if ((to + len) > mtd->size)
-                return -EINVAL;
 
         spi_message_init(&msg);
 
diff --git a/drivers/mtd/devices/mtdram.c b/drivers/mtd/devices/mtdram.c
index e1f017bf0777..0e0e6ed4443c 100644
--- a/drivers/mtd/devices/mtdram.c
+++ b/drivers/mtd/devices/mtdram.c
@@ -34,27 +34,18 @@ static struct mtd_info *mtd_info;
 
 static int ram_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
-        if (instr->addr + instr->len > mtd->size)
-                return -EINVAL;
-
         memset((char *)mtd->priv + instr->addr, 0xff, instr->len);
-
         instr->state = MTD_ERASE_DONE;
         mtd_erase_callback(instr);
-
         return 0;
 }
 
 static int ram_point(struct mtd_info *mtd, loff_t from, size_t len,
                 size_t *retlen, void **virt, resource_size_t *phys)
 {
-        if (from + len > mtd->size)
-                return -EINVAL;
-
         /* can we return a physical address with this driver? */
         if (phys)
                 return -EINVAL;
-
         *virt = mtd->priv + from;
         *retlen = len;
         return 0;
@@ -81,11 +72,7 @@ static unsigned long ram_get_unmapped_area(struct mtd_info *mtd,
 static int ram_read(struct mtd_info *mtd, loff_t from, size_t len,
                 size_t *retlen, u_char *buf)
 {
-        if (from + len > mtd->size)
-                return -EINVAL;
-
         memcpy(buf, mtd->priv + from, len);
-
         *retlen = len;
         return 0;
 }
@@ -93,11 +80,7 @@ static int ram_read(struct mtd_info *mtd, loff_t from, size_t len,
 static int ram_write(struct mtd_info *mtd, loff_t to, size_t len,
                 size_t *retlen, const u_char *buf)
 {
-        if (to + len > mtd->size)
-                return -EINVAL;
-
         memcpy((char *)mtd->priv + to, buf, len);
-
         *retlen = len;
         return 0;
 }
diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index 38035551a7d2..36add7ce4632 100644
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -38,29 +38,20 @@ static int phram_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
         u_char *start = mtd->priv;
 
-        if (instr->addr + instr->len > mtd->size)
-                return -EINVAL;
-
         memset(start + instr->addr, 0xff, instr->len);
 
         /* This'll catch a few races. Free the thing before returning :)
          * I don't feel at all ashamed. This kind of thing is possible anyway
          * with flash, but unlikely.
          */
-
         instr->state = MTD_ERASE_DONE;
-
         mtd_erase_callback(instr);
-
         return 0;
 }
 
 static int phram_point(struct mtd_info *mtd, loff_t from, size_t len,
                 size_t *retlen, void **virt, resource_size_t *phys)
 {
-        if (from + len > mtd->size)
-                return -EINVAL;
-
         /* can we return a physical address with this driver? */
         if (phys)
                 return -EINVAL;
@@ -80,14 +71,7 @@ static int phram_read(struct mtd_info *mtd, loff_t from, size_t len,
 {
         u_char *start = mtd->priv;
 
-        if (from >= mtd->size)
-                return -EINVAL;
-
-        if (len > mtd->size - from)
-                len = mtd->size - from;
-
         memcpy(buf, start + from, len);
-
         *retlen = len;
         return 0;
 }
@@ -97,14 +81,7 @@ static int phram_write(struct mtd_info *mtd, loff_t to, size_t len,
 {
         u_char *start = mtd->priv;
 
-        if (to >= mtd->size)
-                return -EINVAL;
-
-        if (len > mtd->size - to)
-                len = mtd->size - to;
-
         memcpy(start + to, buf, len);
-
         *retlen = len;
         return 0;
 }
diff --git a/drivers/mtd/devices/pmc551.c b/drivers/mtd/devices/pmc551.c
index 933127ecebe5..d394e06e4279 100644
--- a/drivers/mtd/devices/pmc551.c
+++ b/drivers/mtd/devices/pmc551.c
@@ -116,16 +116,6 @@ static int pmc551_erase(struct mtd_info *mtd, struct erase_info *instr)
 #endif
 
         end = instr->addr + instr->len - 1;
-
-        /* Is it past the end? */
-        if (end > mtd->size) {
-#ifdef CONFIG_MTD_PMC551_DEBUG
-                printk(KERN_DEBUG "pmc551_erase() out of bounds (%ld > %ld)\n",
-                        (long)end, (long)mtd->size);
-#endif
-                return -EINVAL;
-        }
-
         eoff_hi = end & ~(priv->asize - 1);
         soff_hi = instr->addr & ~(priv->asize - 1);
         eoff_lo = end & (priv->asize - 1);
@@ -179,14 +169,6 @@ static int pmc551_point(struct mtd_info *mtd, loff_t from, size_t len,
         printk(KERN_DEBUG "pmc551_point(%ld, %ld)\n", (long)from, (long)len);
 #endif
 
-        if (from + len > mtd->size) {
-#ifdef CONFIG_MTD_PMC551_DEBUG
-                printk(KERN_DEBUG "pmc551_point() out of bounds (%ld > %ld)\n",
-                        (long)from + len, (long)mtd->size);
-#endif
-                return -EINVAL;
-        }
-
         /* can we return a physical address with this driver? */
         if (phys)
                 return -EINVAL;
@@ -230,16 +212,6 @@ static int pmc551_read(struct mtd_info *mtd, loff_t from, size_t len,
 #endif
 
         end = from + len - 1;
-
-        /* Is it past the end? */
-        if (end > mtd->size) {
-#ifdef CONFIG_MTD_PMC551_DEBUG
-                printk(KERN_DEBUG "pmc551_read() out of bounds (%ld > %ld)\n",
-                        (long)end, (long)mtd->size);
-#endif
-                return -EINVAL;
-        }
-
         soff_hi = from & ~(priv->asize - 1);
         eoff_hi = end & ~(priv->asize - 1);
         soff_lo = from & (priv->asize - 1);
@@ -297,16 +269,6 @@ static int pmc551_write(struct mtd_info *mtd, loff_t to, size_t len,
 #endif
 
         end = to + len - 1;
-        /* Is it past the end?  or did the u32 wrap? */
-        if (end > mtd->size) {
-#ifdef CONFIG_MTD_PMC551_DEBUG
-                printk(KERN_DEBUG "pmc551_write() out of bounds (end: %ld, "
-                        "size: %ld, to: %ld)\n", (long)end, (long)mtd->size,
-                        (long)to);
-#endif
-                return -EINVAL;
-        }
-
         soff_hi = to & ~(priv->asize - 1);
         eoff_hi = end & ~(priv->asize - 1);
         soff_lo = to & (priv->asize - 1);
diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index 9431ffc761c2..842e4890d771 100644
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -84,21 +84,13 @@ static int slram_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
         slram_priv_t *priv = mtd->priv;
 
-        if (instr->addr + instr->len > mtd->size) {
-                return(-EINVAL);
-        }
-
         memset(priv->start + instr->addr, 0xff, instr->len);
-
         /* This'll catch a few races. Free the thing before returning :)
          * I don't feel at all ashamed. This kind of thing is possible anyway
          * with flash, but unlikely.
          */
-
         instr->state = MTD_ERASE_DONE;
-
         mtd_erase_callback(instr);
-
         return(0);
 }
 
@@ -110,10 +102,6 @@ static int slram_point(struct mtd_info *mtd, loff_t from, size_t len,
         /* can we return a physical address with this driver? */
         if (phys)
                 return -EINVAL;
-
-        if (from + len > mtd->size)
-                return -EINVAL;
-
         *virt = priv->start + from;
         *retlen = len;
         return(0);
@@ -129,14 +117,7 @@ static int slram_read(struct mtd_info *mtd, loff_t from, size_t len,
 {
         slram_priv_t *priv = mtd->priv;
 
-        if (from > mtd->size)
-                return -EINVAL;
-
-        if (from + len > mtd->size)
-                len = mtd->size - from;
-
         memcpy(buf, priv->start + from, len);
-
         *retlen = len;
         return(0);
 }
@@ -146,11 +127,7 @@ static int slram_write(struct mtd_info *mtd, loff_t to, size_t len,
 {
         slram_priv_t *priv = mtd->priv;
 
-        if (to + len > mtd->size)
-                return -EINVAL;
-
         memcpy(priv->start + to, buf, len);
-
         *retlen = len;
         return(0);
 }
diff --git a/drivers/mtd/devices/spear_smi.c b/drivers/mtd/devices/spear_smi.c
index b80cb5b5ebbd..2238ab916a06 100644
--- a/drivers/mtd/devices/spear_smi.c
+++ b/drivers/mtd/devices/spear_smi.c
@@ -510,10 +510,6 @@ static int spear_mtd_erase(struct mtd_info *mtd, struct erase_info *e_info)
         if (!flash || !dev)
                 return -ENODEV;
 
-        /* do not allow erase past end of device */
-        if (e_info->addr + e_info->len > flash->mtd.size)
-                return -EINVAL;
-
         bank = flash->bank;
         if (bank > dev->num_flashes - 1) {
                 dev_err(&dev->pdev->dev, "Invalid Bank Num");
@@ -573,10 +569,6 @@ static int spear_mtd_read(struct mtd_info *mtd, loff_t from, size_t len,
         if (!flash || !dev)
                 return -ENODEV;
 
-        /* do not allow reads past end of device */
-        if (from + len > flash->mtd.size)
-                return -EINVAL;
-
         if (flash->bank > dev->num_flashes - 1) {
                 dev_err(&dev->pdev->dev, "Invalid Bank Num");
                 return -EINVAL;
@@ -678,10 +670,6 @@ static int spear_mtd_write(struct mtd_info *mtd, loff_t to, size_t len,
         if (!len)
                 return 0;
 
-        /* do not allow write past end of page */
-        if (to + len > flash->mtd.size)
-                return -EINVAL;
-
         if (flash->bank > dev->num_flashes - 1) {
                 dev_err(&dev->pdev->dev, "Invalid Bank Num");
                 return -EINVAL;
diff --git a/drivers/mtd/devices/sst25l.c b/drivers/mtd/devices/sst25l.c
index 8b9ffafcc401..99d4a3c510d7 100644
--- a/drivers/mtd/devices/sst25l.c
+++ b/drivers/mtd/devices/sst25l.c
@@ -175,9 +175,6 @@ static int sst25l_erase(struct mtd_info *mtd, struct erase_info *instr)
         int err;
 
         /* Sanity checks */
-        if (instr->addr + instr->len > flash->mtd.size)
-                return -EINVAL;
-
         if ((uint32_t)instr->len % mtd->erasesize)
                 return -EINVAL;
 
@@ -227,9 +224,6 @@ static int sst25l_read(struct mtd_info *mtd, loff_t from, size_t len,
         if (len == 0)
                 return 0;
 
-        if (from + len > flash->mtd.size)
-                return -EINVAL;
-
         if (retlen)
                 *retlen = 0;
 
@@ -278,9 +272,6 @@ static int sst25l_write(struct mtd_info *mtd, loff_t to, size_t len,
         if (!len)
                 return 0;
 
-        if (to + len > flash->mtd.size)
-                return -EINVAL;
-
         if ((uint32_t)to % mtd->writesize)
                 return -EINVAL;