diff options
| -rw-r--r-- | drivers/gpu/drm/drm_drv.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index c26ee0822a05..c4ada8b6295b 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c | |||
| @@ -421,6 +421,7 @@ int drm_ioctl(struct inode *inode, struct file *filp, | |||
| 421 | drm_ioctl_t *func; | 421 | drm_ioctl_t *func; |
| 422 | unsigned int nr = DRM_IOCTL_NR(cmd); | 422 | unsigned int nr = DRM_IOCTL_NR(cmd); |
| 423 | int retcode = -EINVAL; | 423 | int retcode = -EINVAL; |
| 424 | char stack_kdata[128]; | ||
| 424 | char *kdata = NULL; | 425 | char *kdata = NULL; |
| 425 | 426 | ||
| 426 | atomic_inc(&dev->ioctl_count); | 427 | atomic_inc(&dev->ioctl_count); |
| @@ -459,10 +460,14 @@ int drm_ioctl(struct inode *inode, struct file *filp, | |||
| 459 | retcode = -EACCES; | 460 | retcode = -EACCES; |
| 460 | } else { | 461 | } else { |
| 461 | if (cmd & (IOC_IN | IOC_OUT)) { | 462 | if (cmd & (IOC_IN | IOC_OUT)) { |
| 462 | kdata = kmalloc(_IOC_SIZE(cmd), GFP_KERNEL); | 463 | if (_IOC_SIZE(cmd) <= sizeof(stack_kdata)) { |
| 463 | if (!kdata) { | 464 | kdata = stack_kdata; |
| 464 | retcode = -ENOMEM; | 465 | } else { |
| 465 | goto err_i1; | 466 | kdata = kmalloc(_IOC_SIZE(cmd), GFP_KERNEL); |
| 467 | if (!kdata) { | ||
| 468 | retcode = -ENOMEM; | ||
| 469 | goto err_i1; | ||
| 470 | } | ||
| 466 | } | 471 | } |
| 467 | } | 472 | } |
| 468 | 473 | ||
| @@ -483,7 +488,7 @@ int drm_ioctl(struct inode *inode, struct file *filp, | |||
| 483 | } | 488 | } |
| 484 | 489 | ||
| 485 | err_i1: | 490 | err_i1: |
| 486 | if (kdata) | 491 | if (kdata != stack_kdata) |
| 487 | kfree(kdata); | 492 | kfree(kdata); |
| 488 | atomic_dec(&dev->ioctl_count); | 493 | atomic_dec(&dev->ioctl_count); |
| 489 | if (retcode) | 494 | if (retcode) |
