Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 74b67efa authored Jun 18, 2019 by Dan Carpenter Committed by Sean Paul Jun 18, 2019

drm: return -EFAULT if copy_to_user() fails



The copy_from_user() function returns the number of bytes remaining
to be copied but we want to return a negative error code.  Otherwise
the callers treat it as a successful copy.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190618131843.GA29463@mwanda

parent 9870dc39

drivers/gpu/drm/drm_bufs.c

+4 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1340,7 +1340,10 @@ static int copy_one_buf(void data, int count, struct drm_buf_entry from)
	.size = from->buf_size,		.size = from->buf_size,
	.low_mark = from->low_mark,		.low_mark = from->low_mark,
	.high_mark = from->high_mark};		.high_mark = from->high_mark};
	return copy_to_user(to, &v, offsetof(struct drm_buf_desc, flags));
			if (copy_to_user(to, &v, offsetof(struct drm_buf_desc, flags)))
			return -EFAULT;
			return 0;
	}		}

	int drm_legacy_infobufs(struct drm_device dev, void data,		int drm_legacy_infobufs(struct drm_device dev, void data,

drivers/gpu/drm/drm_ioc32.c

+4 −1

Original line number	Original line	Diff line number	Diff line
	@@ -375,7 +375,10 @@ static int copy_one_buf32(void data, int count, struct drm_buf_entry from)
	.size = from->buf_size,		.size = from->buf_size,
	.low_mark = from->low_mark,		.low_mark = from->low_mark,
	.high_mark = from->high_mark};		.high_mark = from->high_mark};
	return copy_to_user(to + count, &v, offsetof(drm_buf_desc32_t, flags));
			if (copy_to_user(to + count, &v, offsetof(drm_buf_desc32_t, flags)))
			return -EFAULT;
			return 0;
	}		}

	static int drm_legacy_infobufs32(struct drm_device dev, void data,		static int drm_legacy_infobufs32(struct drm_device dev, void data,