drm: fix a LOR issue on FreeBSD for savage driver

Correct a LOR issue on FreeBSD by allocating temporary space and doing a single
DRM_COPY_FROM_USER rather than DRM_VERIFYAREA_READ followed by tons of
DRM_COPY_FROM_USER_UNCHECKED.  I don't like the look of the temporary space
allocation, but I like the simplification in the rest of the file.  Tested
with glxgears, tuxracer, and q3 on a savage4.

From: Eric Anholt <anholt@freebsd.org>
Signed-off-by: Dave Airlie <airlied@linux.ie>

1 files changed, 7 insertions, 16 deletions

diff --git a/drivers/char/drm/savage_drv.h b/drivers/char/drm/savage_drv.h
index 2f73558fb9cf..dd46cb85439c 100644
--- a/drivers/char/drm/savage_drv.h
+++ b/drivers/char/drm/savage_drv.h
@@ -1,5 +1,5 @@
-/* savage_drv.h -- Private header for the savage driver
- *
+/* savage_drv.h -- Private header for the savage driver */
+/*
  * Copyright 2004  Felix Kuehling
  * All Rights Reserved.
  *
@@ -192,7 +192,7 @@ typedef struct drm_savage_private {
         /* Err, there is a macro wait_event in include/linux/wait.h.
          * Avoid unwanted macro expansion. */
         void (*emit_clip_rect) (struct drm_savage_private * dev_priv,
-                                drm_clip_rect_t * pbox);
+                                const drm_clip_rect_t * pbox);
         void (*dma_flush) (struct drm_savage_private * dev_priv);
 } drm_savage_private_t;
 
@@ -217,9 +217,9 @@ extern void savage_reclaim_buffers(drm_device_t * dev, DRMFILE filp);
 
 /* state functions */
 extern void savage_emit_clip_rect_s3d(drm_savage_private_t * dev_priv,
-                                      drm_clip_rect_t * pbox);
+                                      const drm_clip_rect_t * pbox);
 extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,
-                                     drm_clip_rect_t * pbox);
+                                     const drm_clip_rect_t * pbox);
 
 #define SAVAGE_FB_SIZE_S3       0x01000000      /*  16MB */
 #define SAVAGE_FB_SIZE_S4       0x02000000      /*  32MB */
@@ -502,15 +502,6 @@ extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,
 
 #define BCI_WRITE( val ) *bci_ptr++ = (uint32_t)(val)
 
-#define BCI_COPY_FROM_USER(src,n) do {                          \
-    unsigned int i;                                             \
-    for (i = 0; i < n; ++i) {                                   \
-        uint32_t val;                                           \
-        DRM_GET_USER_UNCHECKED(val, &((uint32_t*)(src))[i]);    \
-        BCI_WRITE(val);                                         \
-    }                                                           \
-} while(0)
-
 /*
  * command DMA support
  */
@@ -536,8 +527,8 @@ extern void savage_emit_clip_rect_s4(drm_savage_private_t * dev_priv,
 
 #define DMA_WRITE( val ) *dma_ptr++ = (uint32_t)(val)
 
-#define DMA_COPY_FROM_USER(src,n) do {                          \
-        DRM_COPY_FROM_USER_UNCHECKED(dma_ptr, (src), (n)*4);    \
+#define DMA_COPY(src, n) do {                                   \
+        memcpy(dma_ptr, (src), (n)*4);                          \
         dma_ptr += n;                                           \
 } while(0)