From fc1c428eb46af8183be771d2c78b3902acbeffe3 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 28 Dec 2017 14:43:06 -0500
Subject: [PATCH] usx2y: don't bother with access_ok() in ->dsp_load()
Git-commit: fc1c428eb46af8183be771d2c78b3902acbeffe3
Patch-mainline: v4.16-rc1
References: bsc#1121278

memdup_user() checks it, so the only effect would be failing with
-EINVAL instead of -EFAULT in case when access_ok() is false.
However, the caller has already checked access_ok() itself (and
would have buggered off with -EFAULT), so the check is completely
pointless.  Removing it both simplifies the only instance
of ->dsp_load() and allows to get rid of the check in caller -
its sole effect used to be in preventing a bogus error value
from access_ok() in the instance.  Let memdup_user() do the
right thing instead...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Takashi Iwai <tiwai@suse.de>

---
 sound/usb/usx2y/usX2Yhwdep.c | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
index f4b3cda412fc..2bbcf4af06dd 100644
--- a/sound/usb/usx2y/usX2Yhwdep.c
+++ b/sound/usb/usx2y/usX2Yhwdep.c
@@ -198,24 +198,22 @@ static int snd_usX2Y_hwdep_dsp_load(struct snd_hwdep *hw,
 				    struct snd_hwdep_dsp_image *dsp)
 {
 	struct usX2Ydev *priv = hw->private_data;
-	int	lret, err = -EINVAL;
-	snd_printdd( "dsp_load %s\n", dsp->name);
+	struct usb_device* dev = priv->dev;
+	int lret, err;
+	char *buf;
 
-	if (access_ok(VERIFY_READ, dsp->image, dsp->length)) {
-		struct usb_device* dev = priv->dev;
-		char *buf;
+	snd_printdd( "dsp_load %s\n", dsp->name);
 
-		buf = memdup_user(dsp->image, dsp->length);
-		if (IS_ERR(buf))
-			return PTR_ERR(buf);
+	buf = memdup_user(dsp->image, dsp->length);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
 
-		err = usb_set_interface(dev, 0, 1);
-		if (err)
-			snd_printk(KERN_ERR "usb_set_interface error \n");
-		else
-			err = usb_bulk_msg(dev, usb_sndbulkpipe(dev, 2), buf, dsp->length, &lret, 6000);
-		kfree(buf);
-	}
+	err = usb_set_interface(dev, 0, 1);
+	if (err)
+		snd_printk(KERN_ERR "usb_set_interface error \n");
+	else
+		err = usb_bulk_msg(dev, usb_sndbulkpipe(dev, 2), buf, dsp->length, &lret, 6000);
+	kfree(buf);
 	if (err)
 		return err;
 	if (dsp->index == 1) {
-- 
2.20.1