Merge branch 'work.__copy_in_user' of git://git.kernel.org/pub/scm/linux/kernel/git...

Pull __copy_in_user removal from Al Viro:
 "There used to be 6 places in the entire tree calling __copy_in_user(),
  all of them bogus.

  Four got killed off in work.drm branch, this takes care of the
  remaining ones and kills the definition of that sucker"

* 'work.__copy_in_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  kill __copy_in_user()
  sanitize do_i2c_smbus_ioctl()

diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 112b3e1e20e3828705a9fefe159be3a08da54623..2dd4a7af7dd736f185541cd6dad413cd1d8090ba 100644 (file)
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -739,23 +739,22 @@ static int do_i2c_smbus_ioctl(struct file *file,
                unsigned int cmd, struct i2c_smbus_ioctl_data32   __user *udata)
 {
        struct i2c_smbus_ioctl_data     __user *tdata;
-       compat_caddr_t                  datap;
+       union {
+               /* beginnings of those have identical layouts */
+               struct i2c_smbus_ioctl_data32   data32;
+               struct i2c_smbus_ioctl_data     data;
+       } v;
 
        tdata = compat_alloc_user_space(sizeof(*tdata));
        if (tdata == NULL)
                return -ENOMEM;
-       if (!access_ok(VERIFY_WRITE, tdata, sizeof(*tdata)))
-               return -EFAULT;
 
-       if (!access_ok(VERIFY_READ, udata, sizeof(*udata)))
+       memset(&v, 0, sizeof(v));
+       if (copy_from_user(&v.data32, udata, sizeof(v.data32)))
                return -EFAULT;
+       v.data.data = compat_ptr(v.data32.data);
 
-       if (__copy_in_user(&tdata->read_write, &udata->read_write, 2 * sizeof(u8)))
-               return -EFAULT;
-       if (__copy_in_user(&tdata->size, &udata->size, 2 * sizeof(u32)))
-               return -EFAULT;
-       if (__get_user(datap, &udata->data) ||
-           __put_user(compat_ptr(datap), &tdata->data))
+       if (copy_to_user(tdata, &v.data, sizeof(v.data)))
                return -EFAULT;
 
        return do_ioctl(file, cmd, (unsigned long)tdata);

diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index 80b587085e7913c19ab17d33a1a1ff77e51ad7ad..acdd6f915a8d3d1185d8a13e587824313a5dd14f 100644 (file)
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -156,12 +156,6 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
 }
 #ifdef CONFIG_COMPAT
 static __always_inline unsigned long __must_check
-__copy_in_user(void __user *to, const void *from, unsigned long n)
-{
-       might_fault();
-       return raw_copy_in_user(to, from, n);
-}
-static __always_inline unsigned long __must_check
 copy_in_user(void __user *to, const void *from, unsigned long n)
 {
        might_fault();