Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9927a403 authored by Dan Carpenter's avatar Dan Carpenter Committed by Chris Wilson
Browse files

i915: return -EFAULT if copy_to_user fails 



copy_to_user returns the number of bytes remaining to be copied, but we
want to return a negative error code here.  These are returned to
userspace.

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org
parent df51e7aa

drivers/gpu/drm/i915/i915_dma.c

+9 −3
Original line number Original line Diff line number Diff line
@@ -620,9 +620,11 @@ static int i915_batchbuffer(struct drm_device *dev, void *data, 
		ret = copy_from_user(cliprects, batch->cliprects,

		ret = copy_from_user(cliprects, batch->cliprects,

				     batch->num_cliprects *

				     batch->num_cliprects *

				     sizeof(struct drm_clip_rect));

				     sizeof(struct drm_clip_rect));

		if (ret != 0)

		if (ret != 0) {

			ret = -EFAULT;

			goto fail_free;

			goto fail_free;

		}

		}

	}





	mutex_lock(&dev->struct_mutex);

	mutex_lock(&dev->struct_mutex);

	ret = i915_dispatch_batchbuffer(dev, batch, cliprects);

	ret = i915_dispatch_batchbuffer(dev, batch, cliprects);
@@ -662,8 +664,10 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data, 
		return -ENOMEM;

		return -ENOMEM;





	ret = copy_from_user(batch_data, cmdbuf->buf, cmdbuf->sz);

	ret = copy_from_user(batch_data, cmdbuf->buf, cmdbuf->sz);

	if (ret != 0)

	if (ret != 0) {

		ret = -EFAULT;

		goto fail_batch_free;

		goto fail_batch_free;

	}





	if (cmdbuf->num_cliprects) {

	if (cmdbuf->num_cliprects) {

		cliprects = kcalloc(cmdbuf->num_cliprects,

		cliprects = kcalloc(cmdbuf->num_cliprects,
@@ -676,9 +680,11 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data, 
		ret = copy_from_user(cliprects, cmdbuf->cliprects,

		ret = copy_from_user(cliprects, cmdbuf->cliprects,

				     cmdbuf->num_cliprects *

				     cmdbuf->num_cliprects *

				     sizeof(struct drm_clip_rect));

				     sizeof(struct drm_clip_rect));

		if (ret != 0)

		if (ret != 0) {

			ret = -EFAULT;

			goto fail_clip_free;

			goto fail_clip_free;

		}

		}

	}





	mutex_lock(&dev->struct_mutex);

	mutex_lock(&dev->struct_mutex);

	ret = i915_dispatch_cmdbuffer(dev, cmdbuf, cliprects, batch_data);

	ret = i915_dispatch_cmdbuffer(dev, cmdbuf, cliprects, batch_data);