scsi: sg: sg_read(): get rid of access_ok()/__copy_..._user()

Use copy_..._user() instead, both in sg_read() and in sg_read_oxfer().  And
don't open-code memdup_user()...

Link: https://lore.kernel.org/r/20191017193925.25539-6-viro@ZenIV.linux.org.uk
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 3702f66493f7eac29d9829110887f1f0281c3446..9f6534a025cdcaaef0d6e9349526d893d5d49bed 100644 (file)
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -429,16 +429,10 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
        SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
                                      "sg_read: count=%d\n", (int) count));
 
-       if (!access_ok(buf, count))
-               return -EFAULT;
        if (sfp->force_packid && (count >= SZ_SG_HEADER)) {
-               old_hdr = kmalloc(SZ_SG_HEADER, GFP_KERNEL);
-               if (!old_hdr)
-                       return -ENOMEM;
-               if (__copy_from_user(old_hdr, buf, SZ_SG_HEADER)) {
-                       retval = -EFAULT;
-                       goto free_old_hdr;
-               }
+               old_hdr = memdup_user(buf, SZ_SG_HEADER);
+               if (IS_ERR(old_hdr))
+                       return PTR_ERR(old_hdr);
                if (old_hdr->reply_len < 0) {
                        if (count >= SZ_SG_IO_HDR) {
                                sg_io_hdr_t __user *p = (void __user *)buf;
@@ -529,7 +523,7 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
 
        /* Now copy the result back to the user buffer.  */
        if (count >= SZ_SG_HEADER) {
-               if (__copy_to_user(buf, old_hdr, SZ_SG_HEADER)) {
+               if (copy_to_user(buf, old_hdr, SZ_SG_HEADER)) {
                        retval = -EFAULT;
                        goto free_old_hdr;
                }
@@ -1960,12 +1954,12 @@ sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer)
        num = 1 << (PAGE_SHIFT + schp->page_order);
        for (k = 0; k < schp->k_use_sg && schp->pages[k]; k++) {
                if (num > num_read_xfer) {
-                       if (__copy_to_user(outp, page_address(schp->pages[k]),
+                       if (copy_to_user(outp, page_address(schp->pages[k]),
                                           num_read_xfer))
                                return -EFAULT;
                        break;
                } else {
-                       if (__copy_to_user(outp, page_address(schp->pages[k]),
+                       if (copy_to_user(outp, page_address(schp->pages[k]),
                                           num))
                                return -EFAULT;
                        num_read_xfer -= num;