1 files changed, 13 insertions, 0 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 6e85496f9164..5041ebe3fdf9 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3399,6 +3399,15 @@ i915_gem_execbuffer_relocate(struct drm_i915_gem_object *obj,
                         iowrite32(reloc.delta, reloc_entry);
                         io_mapping_unmap_atomic(reloc_page, KM_USER0);
                 }
+
+                /* and update the user's relocation entry */
+                reloc.presumed_offset = target_offset;
+                if (__copy_to_user_inatomic(&user_relocs[i].presumed_offset,
+                                              &reloc.presumed_offset,
+                                              sizeof(reloc.presumed_offset))) {
+                    ret = -EFAULT;
+                    break;
+                }
         }
 
         drm_gem_object_unreference(target_obj);
@@ -3560,6 +3569,10 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
                 if (!access_ok(VERIFY_READ, ptr, length))
                         return -EFAULT;
 
+                /* we may also need to update the presumed offsets */
+                if (!access_ok(VERIFY_WRITE, ptr, length))
+                        return -EFAULT;
+
                 if (fault_in_pages_readable(ptr, length))
                         return -EFAULT;
         }