Commit 9b8eb4d1 authored by Dan Carpenter's avatar Dan Carpenter Committed by Dave Airlie
Browse files

drm/vmwgfx: return -EFAULT for copy_to_user errors



copy_to/from_user() returns the number of bytes remaining to be copied
but we want to return a negative error code here.  This gets returned to
userspace.
Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent e902a358
...@@ -644,6 +644,7 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data, ...@@ -644,6 +644,7 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
ret = copy_from_user(cmd, user_cmd, arg->command_size); ret = copy_from_user(cmd, user_cmd, arg->command_size);
if (unlikely(ret != 0)) { if (unlikely(ret != 0)) {
ret = -EFAULT;
DRM_ERROR("Failed copying commands.\n"); DRM_ERROR("Failed copying commands.\n");
goto out_commit; goto out_commit;
} }
......
...@@ -597,8 +597,10 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data, ...@@ -597,8 +597,10 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
ret = copy_from_user(srf->sizes, user_sizes, ret = copy_from_user(srf->sizes, user_sizes,
srf->num_sizes * sizeof(*srf->sizes)); srf->num_sizes * sizeof(*srf->sizes));
if (unlikely(ret != 0)) if (unlikely(ret != 0)) {
ret = -EFAULT;
goto out_err1; goto out_err1;
}
if (srf->scanout && if (srf->scanout &&
srf->num_sizes == 1 && srf->num_sizes == 1 &&
...@@ -697,9 +699,11 @@ int vmw_surface_reference_ioctl(struct drm_device *dev, void *data, ...@@ -697,9 +699,11 @@ int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
if (user_sizes) if (user_sizes)
ret = copy_to_user(user_sizes, srf->sizes, ret = copy_to_user(user_sizes, srf->sizes,
srf->num_sizes * sizeof(*srf->sizes)); srf->num_sizes * sizeof(*srf->sizes));
if (unlikely(ret != 0)) if (unlikely(ret != 0)) {
DRM_ERROR("copy_to_user failed %p %u\n", DRM_ERROR("copy_to_user failed %p %u\n",
user_sizes, srf->num_sizes); user_sizes, srf->num_sizes);
ret = -EFAULT;
}
out_bad_resource: out_bad_resource:
out_no_reference: out_no_reference:
ttm_base_object_unref(&base); ttm_base_object_unref(&base);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment