Commit a64e5a86 authored by Al Viro's avatar Al Viro Committed by Martin K. Petersen
Browse files

scsi: sg: sg_write(): get rid of access_ok()/__copy_from_user()/__get_user() 

Just use plain copy_from_user() and get_user().  Note that while a
buf-derived pointer gets stored into ->dxferp, all places that actually use
the resulting value feed it either to import_iovec() or to
import_single_range(), and both will do validation.

Link: https://lore.kernel.org/r/20191017193925.25539-7-viro@ZenIV.linux.org.uk


Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Acked-by: default avatarDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent c8c12792

drivers/scsi/sg.c

+3 −5
Original line number Diff line number Diff line
@@ -612,11 +612,9 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) 
	      scsi_block_when_processing_errors(sdp->device)))

		return -ENXIO;



	if (!access_ok(buf, count))

		return -EFAULT;	/* protects following copy_from_user()s + get_user()s */

	if (count < SZ_SG_HEADER)

		return -EIO;

	if (__copy_from_user(&old_hdr, buf, SZ_SG_HEADER))

	if (copy_from_user(&old_hdr, buf, SZ_SG_HEADER))

		return -EFAULT;

	blocking = !(filp->f_flags & O_NONBLOCK);

	if (old_hdr.reply_len < 0)
@@ -626,7 +624,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) 
		return -EIO;	/* The minimum scsi command length is 6 bytes. */



	buf += SZ_SG_HEADER;

	if (__get_user(opcode, buf))

	if (get_user(opcode, buf))

		return -EFAULT;



	if (!(srp = sg_add_request(sfp))) {
@@ -676,7 +674,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) 
	hp->flags = input_size;	/* structure abuse ... */

	hp->pack_id = old_hdr.pack_id;

	hp->usr_ptr = NULL;

	if (__copy_from_user(cmnd, buf, cmd_size))

	if (copy_from_user(cmnd, buf, cmd_size))

		return -EFAULT;

	/*

	 * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV,