mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-05 00:20:32 +00:00
drm: return -EFAULT if copy_to_user() fails
[ Upstream commit 74b67efa8d
]
The copy_from_user() function returns the number of bytes remaining
to be copied but we want to return a negative error code. Otherwise
the callers treat it as a successful copy.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190618131843.GA29463@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
4c938a635f
commit
a02ac12d2d
2 changed files with 8 additions and 2 deletions
|
@ -1321,7 +1321,10 @@ static int copy_one_buf(void *data, int count, struct drm_buf_entry *from)
|
|||
.size = from->buf_size,
|
||||
.low_mark = from->low_mark,
|
||||
.high_mark = from->high_mark};
|
||||
return copy_to_user(to, &v, offsetof(struct drm_buf_desc, flags));
|
||||
|
||||
if (copy_to_user(to, &v, offsetof(struct drm_buf_desc, flags)))
|
||||
return -EFAULT;
|
||||
return 0;
|
||||
}
|
||||
|
||||
int drm_legacy_infobufs(struct drm_device *dev, void *data,
|
||||
|
|
|
@ -372,7 +372,10 @@ static int copy_one_buf32(void *data, int count, struct drm_buf_entry *from)
|
|||
.size = from->buf_size,
|
||||
.low_mark = from->low_mark,
|
||||
.high_mark = from->high_mark};
|
||||
return copy_to_user(to + count, &v, offsetof(drm_buf_desc32_t, flags));
|
||||
|
||||
if (copy_to_user(to + count, &v, offsetof(drm_buf_desc32_t, flags)))
|
||||
return -EFAULT;
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int drm_legacy_infobufs32(struct drm_device *dev, void *data,
|
||||
|
|
Loading…
Reference in a new issue