scsi: sg: sg_write(): get rid of access_ok()/__copy_from_user()/__get_user()

Just use plain copy_from_user() and get_user().  Note that while a
buf-derived pointer gets stored into ->dxferp, all places that actually use
the resulting value feed it either to import_iovec() or to
import_single_range(), and both will do validation.

Link: https://lore.kernel.org/r/20191017193925.25539-7-viro@ZenIV.linux.org.uk
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 9f6534a..f3d090b 100644 (file)
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -612,11 +612,9 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
              scsi_block_when_processing_errors(sdp->device)))
                return -ENXIO;
 
-       if (!access_ok(buf, count))
-               return -EFAULT; /* protects following copy_from_user()s + get_user()s */
        if (count < SZ_SG_HEADER)
                return -EIO;
-       if (__copy_from_user(&old_hdr, buf, SZ_SG_HEADER))
+       if (copy_from_user(&old_hdr, buf, SZ_SG_HEADER))
                return -EFAULT;
        blocking = !(filp->f_flags & O_NONBLOCK);
        if (old_hdr.reply_len < 0)
@@ -626,7 +624,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
                return -EIO;    /* The minimum scsi command length is 6 bytes. */
 
        buf += SZ_SG_HEADER;
-       if (__get_user(opcode, buf))
+       if (get_user(opcode, buf))
                return -EFAULT;
 
        if (!(srp = sg_add_request(sfp))) {
@@ -676,7 +674,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
        hp->flags = input_size; /* structure abuse ... */
        hp->pack_id = old_hdr.pack_id;
        hp->usr_ptr = NULL;
-       if (__copy_from_user(cmnd, buf, cmd_size))
+       if (copy_from_user(cmnd, buf, cmd_size))
                return -EFAULT;
        /*
         * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV,