From 37d59a5148a2746555c02e10b9fb70038afd3ca7 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 23 Apr 2020 13:52:23 -0400 Subject: dlmfs_file_write(): get rid of pointless access_ok() address passed only to copy_from_user() Signed-off-by: Al Viro --- fs/ocfs2/dlmfs/dlmfs.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/fs/ocfs2/dlmfs/dlmfs.c b/fs/ocfs2/dlmfs/dlmfs.c index 1de77f1a600b..a06f19b67d3b 100644 --- a/fs/ocfs2/dlmfs/dlmfs.c +++ b/fs/ocfs2/dlmfs/dlmfs.c @@ -291,9 +291,6 @@ static ssize_t dlmfs_file_write(struct file *filp, if (!count) return 0; - if (!access_ok(buf, count)) - return -EFAULT; - lvb_buf = kmalloc(count, GFP_NOFS); if (!lvb_buf) return -ENOMEM; -- cgit v1.2.3 From f06d3a7e6ebe4faf94cf0be1b25ae6df33620d88 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 18 Feb 2020 23:05:39 -0500 Subject: fat_dir_ioctl(): hadn't needed that access_ok() for more than a decade... address is passed only to put_user() and copy_to_user() Signed-off-by: Al Viro --- fs/fat/dir.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/fs/fat/dir.c b/fs/fat/dir.c index 054acd9fd033..b4ddf48fa444 100644 --- a/fs/fat/dir.c +++ b/fs/fat/dir.c @@ -804,8 +804,6 @@ static long fat_dir_ioctl(struct file *filp, unsigned int cmd, return fat_generic_ioctl(filp, cmd, arg); } - if (!access_ok(d1, sizeof(struct __fat_dirent[2]))) - return -EFAULT; /* * Yes, we don't need this put_user() absolutely. However old * code didn't return the right value. So, app use this value, @@ -844,8 +842,6 @@ static long fat_compat_dir_ioctl(struct file *filp, unsigned cmd, return fat_generic_ioctl(filp, cmd, (unsigned long)arg); } - if (!access_ok(d1, sizeof(struct compat_dirent[2]))) - return -EFAULT; /* * Yes, we don't need this put_user() absolutely. However old * code didn't return the right value. So, app use this value, -- cgit v1.2.3 From 502fd722fe1ed0133d1108bff1d5911f46de6641 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 19 Feb 2020 09:35:32 -0500 Subject: btrfs_ioctl_send(): don't bother with access_ok() we do copy_from_user() on that range anyway Signed-off-by: Al Viro --- fs/btrfs/send.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index c5f41bd86765..6a92ecf9eaa2 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -7065,13 +7065,6 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg) goto out; } - if (!access_ok(arg->clone_sources, - sizeof(*arg->clone_sources) * - arg->clone_sources_count)) { - ret = -EFAULT; - goto out; - } - if (arg->flags & ~BTRFS_SEND_FLAG_MASK) { ret = -EINVAL; goto out; -- cgit v1.2.3 From 00fca6b53a88f600c59bae3828e1c2fdce58be0d Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 23 Apr 2020 10:20:06 -0400 Subject: tomoyo_write_control(): get rid of pointless access_ok() address is passed only to get_user() Signed-off-by: Al Viro --- security/tomoyo/common.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c index 1b467381986f..f93f8acd05f7 100644 --- a/security/tomoyo/common.c +++ b/security/tomoyo/common.c @@ -2662,8 +2662,6 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, if (!head->write) return -EINVAL; - if (!access_ok(buffer, buffer_len)) - return -EFAULT; if (mutex_lock_interruptible(&head->io_sem)) return -EINTR; head->read_user_buf_avail = 0; -- cgit v1.2.3 From 1a4b8febb6c13766f1af91058b90fee876e11674 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Tue, 18 Feb 2020 12:42:57 -0500 Subject: n_hdlc_tty_read(): remove pointless access_ok() only copy_to_user() is done to the address in question Reviewed-by: Greg Kroah-Hartman Signed-off-by: Al Viro --- drivers/tty/n_hdlc.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c index 991f49ee4026..b09eac4b6d64 100644 --- a/drivers/tty/n_hdlc.c +++ b/drivers/tty/n_hdlc.c @@ -423,13 +423,6 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file, struct n_hdlc_buf *rbuf; DECLARE_WAITQUEUE(wait, current); - /* verify user access to buffer */ - if (!access_ok(buf, nr)) { - pr_warn("%s(%d) %s() can't verify user buffer\n", - __FILE__, __LINE__, __func__); - return -EFAULT; - } - add_wait_queue(&tty->read_wait, &wait); for (;;) { -- cgit v1.2.3 From 558cc8f7822ba25711142f5e7718be857b286793 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 22 Apr 2020 21:52:17 -0400 Subject: nvram: drop useless access_ok() we are using copy_to_user()/memdup_user() anyway Reviewed-by: Greg Kroah-Hartman Signed-off-by: Al Viro --- drivers/char/nvram.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c index 4667844eee69..8206412d25ba 100644 --- a/drivers/char/nvram.c +++ b/drivers/char/nvram.c @@ -232,8 +232,6 @@ static ssize_t nvram_misc_read(struct file *file, char __user *buf, ssize_t ret; - if (!access_ok(buf, count)) - return -EFAULT; if (*ppos >= nvram_size) return 0; @@ -264,8 +262,6 @@ static ssize_t nvram_misc_write(struct file *file, const char __user *buf, char *tmp; ssize_t ret; - if (!access_ok(buf, count)) - return -EFAULT; if (*ppos >= nvram_size) return 0; -- cgit v1.2.3 From 5f599098f7608deb4fa063486452f8f1dfd8a72c Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 22 Apr 2020 22:52:07 -0400 Subject: cm4000_cs.c cmm_ioctl(): get rid of pointless access_ok() copy_to_user()/copy_from_user() for everything Signed-off-by: Al Viro --- drivers/char/pcmcia/cm4000_cs.c | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c index 4edb4174a1e2..89681f07bc78 100644 --- a/drivers/char/pcmcia/cm4000_cs.c +++ b/drivers/char/pcmcia/cm4000_cs.c @@ -1404,7 +1404,6 @@ static long cmm_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) unsigned int iobase = dev->p_dev->resource[0]->start; struct inode *inode = file_inode(filp); struct pcmcia_device *link; - int size; int rc; void __user *argp = (void __user *)arg; #ifdef CM4000_DEBUG @@ -1441,19 +1440,6 @@ static long cmm_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) DEBUGP(4, dev, "iocnr mismatch\n"); goto out; } - size = _IOC_SIZE(cmd); - rc = -EFAULT; - DEBUGP(4, dev, "iocdir=%.4x iocr=%.4x iocw=%.4x iocsize=%d cmd=%.4x\n", - _IOC_DIR(cmd), _IOC_READ, _IOC_WRITE, size, cmd); - - if (_IOC_DIR(cmd) & _IOC_READ) { - if (!access_ok(argp, size)) - goto out; - } - if (_IOC_DIR(cmd) & _IOC_WRITE) { - if (!access_ok(argp, size)) - goto out; - } rc = 0; switch (cmd) { -- cgit v1.2.3 From c9a4bb416676dc1d67acc7fed51f77d8b371ab51 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 22 Apr 2020 23:05:57 -0400 Subject: drivers/fpga/dfl-fme-pr.c: get rid of pointless access_ok() followed by copy_from_user() Signed-off-by: Al Viro --- drivers/fpga/dfl-fme-pr.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/fpga/dfl-fme-pr.c b/drivers/fpga/dfl-fme-pr.c index a233a53db708..1194c0e850e0 100644 --- a/drivers/fpga/dfl-fme-pr.c +++ b/drivers/fpga/dfl-fme-pr.c @@ -97,10 +97,6 @@ static int fme_pr(struct platform_device *pdev, unsigned long arg) return -EINVAL; } - if (!access_ok((void __user *)(unsigned long)port_pr.buffer_address, - port_pr.buffer_size)) - return -EFAULT; - /* * align PR buffer per PR bandwidth, as HW ignores the extra padding * data automatically. -- cgit v1.2.3 From 83a4f2e70470be94c582b3d09e774fc9c4470b40 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 7 May 2020 21:03:04 -0400 Subject: drivers/fpga/dfl-afu-dma-region.c: get rid of pointless access_ok() Address is passed to get_user_pages_fast(), which does access_ok(). NB: this is called only from ->ioctl(), and only under USER_DS. Signed-off-by: Al Viro --- drivers/fpga/dfl-afu-dma-region.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/fpga/dfl-afu-dma-region.c b/drivers/fpga/dfl-afu-dma-region.c index 62f924489db5..d902acb36d14 100644 --- a/drivers/fpga/dfl-afu-dma-region.c +++ b/drivers/fpga/dfl-afu-dma-region.c @@ -324,10 +324,6 @@ int afu_dma_map_region(struct dfl_feature_platform_data *pdata, if (user_addr + length < user_addr) return -EINVAL; - if (!access_ok((void __user *)(unsigned long)user_addr, - length)) - return -EINVAL; - region = kzalloc(sizeof(*region), GFP_KERNEL); if (!region) return -ENOMEM; -- cgit v1.2.3 From 694b9a7157d4dfaaea70dc740e9f8d43b8a1e95b Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 23 Apr 2020 10:28:49 -0400 Subject: amifb: get rid of pointless access_ok() calls addresses passed only to get_user() and put_user() Signed-off-by: Al Viro --- drivers/video/fbdev/amifb.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/video/fbdev/amifb.c b/drivers/video/fbdev/amifb.c index 20e03e00b66d..6062104f3afb 100644 --- a/drivers/video/fbdev/amifb.c +++ b/drivers/video/fbdev/amifb.c @@ -1855,8 +1855,6 @@ static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, var->yspot = par->crsr.spot_y; if (size > var->height * var->width) return -ENAMETOOLONG; - if (!access_ok(data, size)) - return -EFAULT; delta = 1 << par->crsr.fmode; lspr = lofsprite + (delta << 1); if (par->bplcon0 & BPC0_LACE) @@ -1935,8 +1933,6 @@ static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, return -EINVAL; if (!var->height) return -EINVAL; - if (!access_ok(data, var->width * var->height)) - return -EFAULT; delta = 1 << fmode; lofsprite = shfsprite = (u_short *)spritememory; lspr = lofsprite + (delta << 1); -- cgit v1.2.3 From 9053fc91e3e9609c36904b98a4befa2988d98301 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 23 Apr 2020 10:29:49 -0400 Subject: omapfb: get rid of pointless access_ok() calls address is passed only to copy_to_user() Acked-by: Bartlomiej Zolnierkiewicz Signed-off-by: Al Viro --- drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c index 56995f44e76d..f40be68d5aac 100644 --- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c +++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c @@ -482,9 +482,6 @@ static int omapfb_memory_read(struct fb_info *fbi, if (!display || !display->driver->memory_read) return -ENOENT; - if (!access_ok(mr->buffer, mr->buffer_size)) - return -EFAULT; - if (mr->w > 4096 || mr->h > 4096) return -EINVAL; -- cgit v1.2.3 From 835ae3bb530a2e40dd5615c3728d4a78320f6fb8 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 22 Apr 2020 22:56:59 -0400 Subject: drivers/crypto/ccp/sev-dev.c: get rid of pointless access_ok() Contrary to the comments, those do *NOT* verify anything about writability of memory, etc. In all cases addresses are passed only to copy_to_user(). Signed-off-by: Al Viro --- drivers/crypto/ccp/sev-dev.c | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c index 896f190b9a50..7f97164cbafb 100644 --- a/drivers/crypto/ccp/sev-dev.c +++ b/drivers/crypto/ccp/sev-dev.c @@ -371,8 +371,7 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp, bool writable) goto cmd; /* allocate a physically contiguous buffer to store the CSR blob */ - if (!access_ok(input.address, input.length) || - input.length > SEV_FW_BLOB_MAX_SIZE) { + if (input.length > SEV_FW_BLOB_MAX_SIZE) { ret = -EFAULT; goto e_free; } @@ -609,12 +608,6 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp) if (copy_from_user(&input, (void __user *)argp->data, sizeof(input))) return -EFAULT; - /* Check if we have write access to the userspace buffer */ - if (input.address && - input.length && - !access_ok(input.address, input.length)) - return -EFAULT; - data = kzalloc(sizeof(*data), GFP_KERNEL); if (!data) return -ENOMEM; @@ -730,15 +723,13 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable) goto cmd; /* Allocate a physically contiguous buffer to store the PDH blob. */ - if ((input.pdh_cert_len > SEV_FW_BLOB_MAX_SIZE) || - !access_ok(input.pdh_cert_address, input.pdh_cert_len)) { + if (input.pdh_cert_len > SEV_FW_BLOB_MAX_SIZE) { ret = -EFAULT; goto e_free; } /* Allocate a physically contiguous buffer to store the cert chain blob. */ - if ((input.cert_chain_len > SEV_FW_BLOB_MAX_SIZE) || - !access_ok(input.cert_chain_address, input.cert_chain_len)) { + if (input.cert_chain_len > SEV_FW_BLOB_MAX_SIZE) { ret = -EFAULT; goto e_free; } -- cgit v1.2.3 From d65aca9ff83b04fa1062800c7796d44729ef55af Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 22 Apr 2020 23:08:34 -0400 Subject: via-pmu: don't bother with access_ok() we are using copy_to_user() for actual copying Signed-off-by: Al Viro --- drivers/macintosh/via-pmu.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c index 83eb05bf85ff..8450d7c008d0 100644 --- a/drivers/macintosh/via-pmu.c +++ b/drivers/macintosh/via-pmu.c @@ -2184,8 +2184,6 @@ pmu_read(struct file *file, char __user *buf, if (count < 1 || !pp) return -EINVAL; - if (!access_ok(buf, count)) - return -EFAULT; spin_lock_irqsave(&pp->lock, flags); add_wait_queue(&pp->wait, &wait); -- cgit v1.2.3 From a38547d435cd91060b0d07cc11e24eee4c3f31aa Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 7 May 2020 21:13:55 -0400 Subject: drm_read(): get rid of pointless access_ok() address is passed only to copy_to_user() Signed-off-by: Al Viro --- drivers/gpu/drm/drm_file.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c index eb009d3ab48f..6a1f6c802415 100644 --- a/drivers/gpu/drm/drm_file.c +++ b/drivers/gpu/drm/drm_file.c @@ -569,9 +569,6 @@ ssize_t drm_read(struct file *filp, char __user *buffer, struct drm_device *dev = file_priv->minor->dev; ssize_t ret; - if (!access_ok(buffer, count)) - return -EFAULT; - ret = mutex_lock_interruptible(&file_priv->event_read_lock); if (ret) return ret; -- cgit v1.2.3 From d2659e583eb32fddea4f27a346de84f88be6119f Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 22 Apr 2020 23:02:16 -0400 Subject: efi_test: get rid of pointless access_ok() really, people - get_user(), copy_from_user(), memdup_user(), etc. all fail if access_ok() does. Signed-off-by: Al Viro --- drivers/firmware/efi/test/efi_test.c | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/drivers/firmware/efi/test/efi_test.c b/drivers/firmware/efi/test/efi_test.c index 7baf48c01e72..ddf9eae396fe 100644 --- a/drivers/firmware/efi/test/efi_test.c +++ b/drivers/firmware/efi/test/efi_test.c @@ -70,9 +70,6 @@ copy_ucs2_from_user_len(efi_char16_t **dst, efi_char16_t __user *src, return 0; } - if (!access_ok(src, 1)) - return -EFAULT; - buf = memdup_user(src, len); if (IS_ERR(buf)) { *dst = NULL; @@ -91,9 +88,6 @@ copy_ucs2_from_user_len(efi_char16_t **dst, efi_char16_t __user *src, static inline int get_ucs2_strsize_from_user(efi_char16_t __user *src, size_t *len) { - if (!access_ok(src, 1)) - return -EFAULT; - *len = user_ucs2_strsize(src); if (*len == 0) return -EFAULT; @@ -118,9 +112,6 @@ copy_ucs2_from_user(efi_char16_t **dst, efi_char16_t __user *src) { size_t len; - if (!access_ok(src, 1)) - return -EFAULT; - len = user_ucs2_strsize(src); if (len == 0) return -EFAULT; @@ -142,9 +133,6 @@ copy_ucs2_to_user_len(efi_char16_t __user *dst, efi_char16_t *src, size_t len) if (!src) return 0; - if (!access_ok(dst, 1)) - return -EFAULT; - return copy_to_user(dst, src, len); } -- cgit v1.2.3 From e6c0433e270ae96fb62fd30cf7c2c7bf57d5391f Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 22 Apr 2020 23:20:52 -0400 Subject: lpfc_debugfs: get rid of pointless access_ok() No, you do NOT need to "protect copy from user" that way. Incidentally, your userland ABI stinks. I understand that you wanted to accept "reset" and "reset\n" as equivalent, but I suspect that accepting "reset this, you !@^!@!" had been an accident. Nothing to do about that now - it is a userland ABI... Signed-off-by: Al Viro --- drivers/scsi/lpfc/lpfc_debugfs.c | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c index 8a6e02aa553f..5a754fb5f854 100644 --- a/drivers/scsi/lpfc/lpfc_debugfs.c +++ b/drivers/scsi/lpfc/lpfc_debugfs.c @@ -2166,10 +2166,6 @@ lpfc_debugfs_lockstat_write(struct file *file, const char __user *buf, char *pbuf; int i; - /* Protect copy from user */ - if (!access_ok(buf, nbytes)) - return -EFAULT; - memset(mybuf, 0, sizeof(mybuf)); if (copy_from_user(mybuf, buf, nbytes)) @@ -2621,10 +2617,6 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf, if (nbytes > 64) nbytes = 64; - /* Protect copy from user */ - if (!access_ok(buf, nbytes)) - return -EFAULT; - memset(mybuf, 0, sizeof(mybuf)); if (copy_from_user(mybuf, buf, nbytes)) @@ -2787,10 +2779,6 @@ lpfc_debugfs_scsistat_write(struct file *file, const char __user *buf, char mybuf[6] = {0}; int i; - /* Protect copy from user */ - if (!access_ok(buf, nbytes)) - return -EFAULT; - if (copy_from_user(mybuf, buf, (nbytes >= sizeof(mybuf)) ? (sizeof(mybuf) - 1) : nbytes)) return -EFAULT; -- cgit v1.2.3 From fe6bb59f4dd693ffb678224fe78fc69dda163c46 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 23 Apr 2020 10:27:20 -0400 Subject: usb: get rid of pointless access_ok() calls in all affected cases addresses are passed only to copy_from()_user or copy_to_user(). Reviewed-by: Greg Kroah-Hartman Signed-off-by: Al Viro --- drivers/usb/core/devices.c | 2 -- drivers/usb/core/devio.c | 9 --------- drivers/usb/gadget/function/f_hid.c | 6 ------ 3 files changed, 17 deletions(-) diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c index 44f28a114c2b..94b6fa6e585e 100644 --- a/drivers/usb/core/devices.c +++ b/drivers/usb/core/devices.c @@ -598,8 +598,6 @@ static ssize_t usb_device_read(struct file *file, char __user *buf, return -EINVAL; if (nbytes <= 0) return 0; - if (!access_ok(buf, nbytes)) - return -EFAULT; mutex_lock(&usb_bus_idr_lock); /* print devices for all busses */ diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index 6833c918abce..544769807ab8 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -1127,11 +1127,6 @@ static int proc_control(struct usb_dev_state *ps, void __user *arg) ctrl.bRequestType, ctrl.bRequest, ctrl.wValue, ctrl.wIndex, ctrl.wLength); if (ctrl.bRequestType & 0x80) { - if (ctrl.wLength && !access_ok(ctrl.data, - ctrl.wLength)) { - ret = -EINVAL; - goto done; - } pipe = usb_rcvctrlpipe(dev, 0); snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT, NULL, 0); @@ -1216,10 +1211,6 @@ static int proc_bulk(struct usb_dev_state *ps, void __user *arg) } tmo = bulk.timeout; if (bulk.ep & 0x80) { - if (len1 && !access_ok(bulk.data, len1)) { - ret = -EINVAL; - goto done; - } snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, NULL, 0); usb_unlock_device(dev); diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index f3816a5c861e..df671acdd464 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -252,9 +252,6 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer, if (!count) return 0; - if (!access_ok(buffer, count)) - return -EFAULT; - spin_lock_irqsave(&hidg->read_spinlock, flags); #define READ_COND (!list_empty(&hidg->completed_out_req)) @@ -339,9 +336,6 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, unsigned long flags; ssize_t status = -ENOMEM; - if (!access_ok(buffer, count)) - return -EFAULT; - spin_lock_irqsave(&hidg->write_spinlock, flags); #define WRITE_COND (!hidg->write_pending) -- cgit v1.2.3 From fd8ec4dd4a79d5ad51d31d4a7664b5f82d108316 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 7 May 2020 21:39:29 -0400 Subject: hfi1: get rid of pointless access_ok() pin_user_pages_fast() doesn't need that from its caller. NB: only reachable from ->ioctl(), and only under USER_DS Signed-off-by: Al Viro --- drivers/infiniband/hw/hfi1/user_exp_rcv.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c index 4da03f823474..f81ca20f4b69 100644 --- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c +++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c @@ -206,13 +206,6 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf) return -EINVAL; } - /* Verify that access is OK for the user buffer */ - if (!access_ok((void __user *)vaddr, - npages * PAGE_SIZE)) { - dd_dev_err(dd, "Fail vaddr %p, %u pages, !access_ok\n", - (void *)vaddr, npages); - return -EFAULT; - } /* Allocate the array of struct page pointers needed for pinning */ pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL); if (!pages) -- cgit v1.2.3 From 87c233b8158a20a9c9ab1da96cb5cb1734d9006e Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 7 May 2020 23:28:15 -0400 Subject: vmci_host: get rid of pointless access_ok() get_user_pages_fast() doesn't need the caller to check that. NB: reachable only from ioctl(2) and only under USER_DS Reviewed-by: Greg Kroah-Hartman Signed-off-by: Al Viro --- drivers/misc/vmw_vmci/vmci_host.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c index ce16d6b99295..2d8328d928d5 100644 --- a/drivers/misc/vmw_vmci/vmci_host.c +++ b/drivers/misc/vmw_vmci/vmci_host.c @@ -233,8 +233,6 @@ static int vmci_host_setup_notify(struct vmci_ctx *context, * about the size. */ BUILD_BUG_ON(sizeof(bool) != sizeof(u8)); - if (!access_ok((void __user *)uva, sizeof(u8))) - return VMCI_ERROR_GENERIC; /* * Lock physical page backing a given user VA. -- cgit v1.2.3