From 104289576b33403a2c01097202a07dab74a5c231 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 27 May 2017 00:32:51 -0400 Subject: drbd: ->sendpage() never needed set_fs() Signed-off-by: Al Viro --- drivers/block/drbd/drbd_main.c | 3 --- 1 file changed, 3 deletions(-) (limited to 'drivers') diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c index 84455c365f57..da4944ea974e 100644 --- a/drivers/block/drbd/drbd_main.c +++ b/drivers/block/drbd/drbd_main.c @@ -1550,7 +1550,6 @@ static int _drbd_send_page(struct drbd_peer_device *peer_device, struct page *pa int offset, size_t size, unsigned msg_flags) { struct socket *socket = peer_device->connection->data.socket; - mm_segment_t oldfs = get_fs(); int len = size; int err = -EIO; @@ -1565,7 +1564,6 @@ static int _drbd_send_page(struct drbd_peer_device *peer_device, struct page *pa msg_flags |= MSG_NOSIGNAL; drbd_update_congested(peer_device->connection); - set_fs(KERNEL_DS); do { int sent; @@ -1585,7 +1583,6 @@ static int _drbd_send_page(struct drbd_peer_device *peer_device, struct page *pa len -= sent; offset += sent; } while (len > 0 /* THINK && device->cstate >= C_CONNECTED*/); - set_fs(oldfs); clear_bit(NET_CONGESTED, &peer_device->connection->flags); if (len == 0) { -- cgit v1.2.3 From 31acd2665b8f45548e1acfb9131657646333f91c Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 3 Jun 2017 21:44:11 -0400 Subject: isdn: get rid of pointless access_ok() copy_to_user()/copy_from_user()/get_user() check themselves Signed-off-by: Al Viro --- drivers/isdn/i4l/isdn_common.c | 18 ------------------ drivers/isdn/i4l/isdn_ppp.c | 6 ------ drivers/isdn/isdnloop/isdnloop.c | 2 -- 3 files changed, 26 deletions(-) (limited to 'drivers') diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c index 9b856e1890d1..89b09c51ab7c 100644 --- a/drivers/isdn/i4l/isdn_common.c +++ b/drivers/isdn/i4l/isdn_common.c @@ -1304,9 +1304,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg) if (arg) { ulong __user *p = argp; int i; - if (!access_ok(VERIFY_WRITE, p, - sizeof(ulong) * ISDN_MAX_CHANNELS * 2)) - return -EFAULT; for (i = 0; i < ISDN_MAX_CHANNELS; i++) { put_user(dev->ibytes[i], p++); put_user(dev->obytes[i], p++); @@ -1540,11 +1537,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg) char __user *p = argp; int i; - if (!access_ok(VERIFY_WRITE, argp, - (ISDN_MODEM_NUMREG + ISDN_MSNLEN + ISDN_LMSNLEN) - * ISDN_MAX_CHANNELS)) - return -EFAULT; - for (i = 0; i < ISDN_MAX_CHANNELS; i++) { if (copy_to_user(p, dev->mdm.info[i].emu.profile, ISDN_MODEM_NUMREG)) @@ -1567,11 +1559,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg) char __user *p = argp; int i; - if (!access_ok(VERIFY_READ, argp, - (ISDN_MODEM_NUMREG + ISDN_MSNLEN + ISDN_LMSNLEN) - * ISDN_MAX_CHANNELS)) - return -EFAULT; - for (i = 0; i < ISDN_MAX_CHANNELS; i++) { if (copy_from_user(dev->mdm.info[i].emu.profile, p, ISDN_MODEM_NUMREG)) @@ -1617,8 +1604,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg) int j = 0; while (1) { - if (!access_ok(VERIFY_READ, p, 1)) - return -EFAULT; get_user(bname[j], p++); switch (bname[j]) { case '\0': @@ -1685,9 +1670,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg) drvidx = 0; if (drvidx == -1) return -ENODEV; - if (!access_ok(VERIFY_WRITE, argp, - sizeof(isdn_ioctl_struct))) - return -EFAULT; c.driver = drvidx; c.command = ISDN_CMD_IOCTL; c.arg = cmd; diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c index d07dd5196ffc..487478bafaf5 100644 --- a/drivers/isdn/i4l/isdn_ppp.c +++ b/drivers/isdn/i4l/isdn_ppp.c @@ -795,9 +795,6 @@ isdn_ppp_read(int min, struct file *file, char __user *buf, int count) if (!(is->state & IPPP_OPEN)) return 0; - if (!access_ok(VERIFY_WRITE, buf, count)) - return -EFAULT; - spin_lock_irqsave(&is->buflock, flags); b = is->first->next; save_buf = b->buf; @@ -2014,9 +2011,6 @@ isdn_ppp_dev_ioctl_stats(int slot, struct ifreq *ifr, struct net_device *dev) struct ppp_stats t; isdn_net_local *lp = netdev_priv(dev); - if (!access_ok(VERIFY_WRITE, res, sizeof(struct ppp_stats))) - return -EFAULT; - /* build a temporary stat struct and copy it to user space */ memset(&t, 0, sizeof(struct ppp_stats)); diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c index ef9c8e4f1fa2..32cb0cbd7217 100644 --- a/drivers/isdn/isdnloop/isdnloop.c +++ b/drivers/isdn/isdnloop/isdnloop.c @@ -1142,8 +1142,6 @@ isdnloop_command(isdn_ctrl *c, isdnloop_card *card) case ISDNLOOP_IOCTL_DEBUGVAR: return (ulong) card; case ISDNLOOP_IOCTL_STARTUP: - if (!access_ok(VERIFY_READ, (void *) a, sizeof(isdnloop_sdef))) - return -EFAULT; return isdnloop_start(card, (isdnloop_sdef *) a); break; case ISDNLOOP_IOCTL_ADDCARD: -- cgit v1.2.3 From 5a5011936ec0ef22e9433cf2ee3520db4993b445 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 3 Jun 2017 21:50:46 -0400 Subject: adb: get rid of pointless access_ok() Signed-off-by: Al Viro --- drivers/macintosh/adb.c | 4 ---- 1 file changed, 4 deletions(-) (limited to 'drivers') diff --git a/drivers/macintosh/adb.c b/drivers/macintosh/adb.c index fee939efc4fc..039dc8285fc5 100644 --- a/drivers/macintosh/adb.c +++ b/drivers/macintosh/adb.c @@ -723,8 +723,6 @@ static ssize_t adb_read(struct file *file, char __user *buf, return -EINVAL; if (count > sizeof(req->reply)) count = sizeof(req->reply); - if (!access_ok(VERIFY_WRITE, buf, count)) - return -EFAULT; req = NULL; spin_lock_irqsave(&state->lock, flags); @@ -781,8 +779,6 @@ static ssize_t adb_write(struct file *file, const char __user *buf, return -EINVAL; if (adb_controller == NULL) return -ENXIO; - if (!access_ok(VERIFY_READ, buf, count)) - return -EFAULT; req = kmalloc(sizeof(struct adb_request), GFP_KERNEL); -- cgit v1.2.3 From 20dcf8e244b963a5c64cdda336d00d5169d17985 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 3 Jun 2017 22:00:37 -0400 Subject: lpfc debugfs: get rid of pointless access_ok() copy_from_user() needs no protection - it does the checks itself Signed-off-by: Al Viro --- drivers/scsi/lpfc/lpfc_debugfs.c | 20 -------------------- 1 file changed, 20 deletions(-) (limited to 'drivers') diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c index fce549a91911..ca08d3730d7b 100644 --- a/drivers/scsi/lpfc/lpfc_debugfs.c +++ b/drivers/scsi/lpfc/lpfc_debugfs.c @@ -1942,10 +1942,6 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf, if (nbytes > 64) nbytes = 64; - /* Protect copy from user */ - if (!access_ok(VERIFY_READ, buf, nbytes)) - return -EFAULT; - memset(mybuf, 0, sizeof(mybuf)); if (copy_from_user(mybuf, buf, nbytes)) @@ -2026,10 +2022,6 @@ lpfc_debugfs_nvmektime_write(struct file *file, const char __user *buf, if (nbytes > 64) nbytes = 64; - /* Protect copy from user */ - if (!access_ok(VERIFY_READ, buf, nbytes)) - return -EFAULT; - memset(mybuf, 0, sizeof(mybuf)); if (copy_from_user(mybuf, buf, nbytes)) @@ -2158,10 +2150,6 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf, if (nbytes > 64) nbytes = 64; - /* Protect copy from user */ - if (!access_ok(VERIFY_READ, buf, nbytes)) - return -EFAULT; - memset(mybuf, 0, sizeof(mybuf)); if (copy_from_user(mybuf, buf, nbytes)) @@ -2269,10 +2257,6 @@ lpfc_debugfs_cpucheck_write(struct file *file, const char __user *buf, if (nbytes > 64) nbytes = 64; - /* Protect copy from user */ - if (!access_ok(VERIFY_READ, buf, nbytes)) - return -EFAULT; - memset(mybuf, 0, sizeof(mybuf)); if (copy_from_user(mybuf, buf, nbytes)) @@ -2343,10 +2327,6 @@ static int lpfc_idiag_cmd_get(const char __user *buf, size_t nbytes, int i; size_t bsize; - /* Protect copy from user */ - if (!access_ok(VERIFY_READ, buf, nbytes)) - return -EFAULT; - memset(mybuf, 0, sizeof(mybuf)); memset(idiag_cmd, 0, sizeof(*idiag_cmd)); bsize = min(nbytes, (sizeof(mybuf)-1)); -- cgit v1.2.3