Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4e9121e6 authored by Rodrigo Vivi's avatar Rodrigo Vivi
Browse files

drm/i915: Fix copy_to_user usage for pipe_crc 



Copy to user return the number of bytes it couldn't write
and zero on success. So any number different than 0 should
be considered a fault, not only when it doesn't write
the full size.

v2: fixed the inverted logic. (Ville)

Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
parent 19e0b4ca

drivers/gpu/drm/i915/i915_debugfs.c

+1 −3
Original line number Original line Diff line number Diff line
@@ -3625,7 +3625,6 @@ i915_pipe_crc_read(struct file *filep, char __user *user_buf, size_t count, 
	while (n_entries > 0) {

	while (n_entries > 0) {

		struct intel_pipe_crc_entry *entry =

		struct intel_pipe_crc_entry *entry =

			&pipe_crc->entries[pipe_crc->tail];

			&pipe_crc->entries[pipe_crc->tail];

		int ret;





		if (CIRC_CNT(pipe_crc->head, pipe_crc->tail,

		if (CIRC_CNT(pipe_crc->head, pipe_crc->tail,

			     INTEL_PIPE_CRC_ENTRIES_NR) < 1)

			     INTEL_PIPE_CRC_ENTRIES_NR) < 1)
@@ -3642,8 +3641,7 @@ i915_pipe_crc_read(struct file *filep, char __user *user_buf, size_t count, 




		spin_unlock_irq(&pipe_crc->lock);

		spin_unlock_irq(&pipe_crc->lock);





		ret = copy_to_user(user_buf, buf, PIPE_CRC_LINE_LEN);

		if (copy_to_user(user_buf, buf, PIPE_CRC_LINE_LEN))

		if (ret == PIPE_CRC_LINE_LEN)

			return -EFAULT;

			return -EFAULT;





		user_buf += PIPE_CRC_LINE_LEN;

		user_buf += PIPE_CRC_LINE_LEN;