drm/vmwgfx: return -EFAULT for copy_to_user errors
Subsystems (4)
PATCH 1/1 drm/vmwgfx: return -EFAULT for copy_to_user errors
copy_to/from_user() returns the number of bytes remaining to be copied but we want to return a negative error code here. This gets returned to userspace.
Signed-off-by Dan Carpenter <[email protected]>
drivers/gpu/drm/vmwgfx/vmwgfx_resource.c +6 -2
@@ -597,8 +597,10 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data, ret =copy_from_user (srf->sizes, user_sizes, srf->num_sizes *sizeof (*srf->sizes)); -if (unlikely (ret !=0 )) +if (unlikely (ret !=0 )) { + ret = -EFAULT ; goto out_err1; + }if (srf->scanout && srf->num_sizes = 1 &&
@@ -697,9 +699,11 @@ int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,if (user_sizes) ret =copy_to_user (user_sizes, srf->sizes, srf->num_sizes *sizeof (*srf->sizes)); -if (unlikely (ret !=0 )) +if (unlikely (ret !=0 )) {DRM_ERROR ("copy_to_user failed %p %u\n" , user_sizes, srf->num_sizes); + ret = -EFAULT ; + } out_bad_resource: out_no_reference:ttm_base_object_unref (&base);
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +1 -0
@@ -644,6 +644,7 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data, ret =copy_from_user (cmd, user_cmd, arg->command_size);if (unlikely (ret !=0 )) { + ret = -EFAULT ;DRM_ERROR ("Failed copying commands.\n" ); goto out_commit; }