leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

i915: return -EFAULT if copy_to_user fails

Browse Source 
copy_to_user returns the number of bytes remaining to be copied, but we
want to return a negative error code here.  These are returned to
userspace.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org
This commit is contained in:
Dan Carpenter 2010-06-19 15:12:51 +02:00 committed by Chris Wilson
parent df51e7aa2c
commit 9927a403ca
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/gpu/drm/i915/i915_dma.c
View File

@ -620,8 +620,10 @@ static int i915_batchbuffer(struct drm_device *dev, void *data,
ret = copy_from_user(cliprects, batch->cliprects,
batch->num_cliprects *
sizeof(struct drm_clip_rect));
if (ret != 0)
if (ret != 0) {
ret = -EFAULT;
goto fail_free;
}
}
mutex_lock(&dev->struct_mutex);
@ -662,8 +664,10 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data,
return -ENOMEM;
ret = copy_from_user(batch_data, cmdbuf->buf, cmdbuf->sz);
if (ret != 0)
if (ret != 0) {
ret = -EFAULT;
goto fail_batch_free;
}
if (cmdbuf->num_cliprects) {
cliprects = kcalloc(cmdbuf->num_cliprects,
@ -676,8 +680,10 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data,
ret = copy_from_user(cliprects, cmdbuf->cliprects,
cmdbuf->num_cliprects *
sizeof(struct drm_clip_rect));
if (ret != 0)
if (ret != 0) {
ret = -EFAULT;
goto fail_clip_free;
}
}
mutex_lock(&dev->struct_mutex);