drm/i915: Fix use of uninitialized var in 40a5f0de

i915_gem_put_relocs_to_user returned an uninitialized value which
got returned to userspace. This caused libdrm in my setup to never
get out of a do{}while() loop retrying i915_gem_execbuffer.

result was hanging X, overheating of cpu and 2-3gb of logfile-spam.

This patch adresses the issue by
 1. initializing vars in this file where necessary
 2. correcting wrongly interpreted return values of copy_[from/to]_user

Signed-off-by: Florian Mickler <florian@mickler.org>
[anholt: cleanups of unnecessary changes, consistency in APIs]
Signed-off-by: Eric Anholt <eric@anholt.net>

1 files changed, 22 insertions, 12 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 33ab07b0d712..6f7d0e27036f 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -141,15 +141,18 @@ fast_shmem_read(struct page **pages,
                 int length)
 {
         char __iomem *vaddr;
-        int ret;
+        int unwritten;
 
         vaddr = kmap_atomic(pages[page_base >> PAGE_SHIFT], KM_USER0);
         if (vaddr == NULL)
                 return -ENOMEM;
-        ret = __copy_to_user_inatomic(data, vaddr + page_offset, length);
+        unwritten = __copy_to_user_inatomic(data, vaddr + page_offset, length);
         kunmap_atomic(vaddr, KM_USER0);
 
-        return ret;
+        if (unwritten)
+                return -EFAULT;
+
+        return 0;
 }
 
 static inline int
@@ -3000,13 +3003,13 @@ i915_gem_get_relocs_from_user(struct drm_i915_gem_exec_object *exec_list,
                         drm_free(*relocs, reloc_count * sizeof(**relocs),
                                  DRM_MEM_DRIVER);
                         *relocs = NULL;
-                        return ret;
+                        return -EFAULT;
                 }
 
                 reloc_index += exec_list[i].relocation_count;
         }
 
-        return ret;
+        return 0;
 }
 
 static int
@@ -3015,23 +3018,28 @@ i915_gem_put_relocs_to_user(struct drm_i915_gem_exec_object *exec_list,
                             struct drm_i915_gem_relocation_entry *relocs)
 {
         uint32_t reloc_count = 0, i;
-        int ret;
+        int ret = 0;
 
         for (i = 0; i < buffer_count; i++) {
                 struct drm_i915_gem_relocation_entry __user *user_relocs;
+                int unwritten;
 
                 user_relocs = (void __user *)(uintptr_t)exec_list[i].relocs_ptr;
 
-                if (ret == 0) {
-                        ret = copy_to_user(user_relocs,
-                                           &relocs[reloc_count],
-                                           exec_list[i].relocation_count *
-                                           sizeof(*relocs));
+                unwritten = copy_to_user(user_relocs,
+                                         &relocs[reloc_count],
+                                         exec_list[i].relocation_count *
+                                         sizeof(*relocs));
+
+                if (unwritten) {
+                        ret = -EFAULT;
+                        goto err;
                 }
 
                 reloc_count += exec_list[i].relocation_count;
         }
 
+err:
         drm_free(relocs, reloc_count * sizeof(*relocs), DRM_MEM_DRIVER);
 
         return ret;
@@ -3306,10 +3314,12 @@ err:
                                    (uintptr_t) args->buffers_ptr,
                                    exec_list,
                                    sizeof(*exec_list) * args->buffer_count);
-                if (ret)
+                if (ret) {
+                        ret = -EFAULT;
                         DRM_ERROR("failed to copy %d exec entries "
                                   "back to user (%d)\n",
                                   args->buffer_count, ret);
+                }
         }
 
         /* Copy the updated relocations out regardless of current error