1 files changed, 26 insertions, 20 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 2a0025f3e98e..90b1d6753b9d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -469,14 +469,17 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                 return -ENOENT;
         obj_priv = to_intel_bo(obj);
 
-        /* Bounds check source.
-         *
-         * XXX: This could use review for overflow issues...
-         */
-        if (args->offset > obj->size || args->size > obj->size ||
-            args->offset + args->size > obj->size) {
-                drm_gem_object_unreference_unlocked(obj);
-                return -EINVAL;
+        /* Bounds check source.  */
+        if (args->offset > obj->size || args->size > obj->size - args->offset) {
+                ret = -EINVAL;
+                goto err;
+        }
+
+        if (!access_ok(VERIFY_WRITE,
+                       (char __user *)(uintptr_t)args->data_ptr,
+                       args->size)) {
+                ret = -EFAULT;
+                goto err;
         }
 
         if (i915_gem_object_needs_bit17_swizzle(obj)) {
@@ -488,8 +491,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                                                         file_priv);
         }
 
+err:
         drm_gem_object_unreference_unlocked(obj);
-
         return ret;
 }
 
@@ -578,8 +581,6 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
 
         user_data = (char __user *) (uintptr_t) args->data_ptr;
         remain = args->size;
-        if (!access_ok(VERIFY_READ, user_data, remain))
-                return -EFAULT;
 
 
         mutex_lock(&dev->struct_mutex);
@@ -932,14 +933,17 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                 return -ENOENT;
         obj_priv = to_intel_bo(obj);
 
-        /* Bounds check destination.
-         *
-         * XXX: This could use review for overflow issues...
-         */
-        if (args->offset > obj->size || args->size > obj->size ||
-            args->offset + args->size > obj->size) {
-                drm_gem_object_unreference_unlocked(obj);
-                return -EINVAL;
+        /* Bounds check destination. */
+        if (args->offset > obj->size || args->size > obj->size - args->offset) {
+                ret = -EINVAL;
+                goto err;
+        }
+
+        if (!access_ok(VERIFY_READ,
+                       (char __user *)(uintptr_t)args->data_ptr,
+                       args->size)) {
+                ret = -EFAULT;
+                goto err;
         }
 
         /* We can only do the GTT pwrite on untiled buffers, as otherwise
@@ -973,8 +977,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                 DRM_INFO("pwrite failed %d\n", ret);
 #endif
 
+err:
         drm_gem_object_unreference_unlocked(obj);
-
         return ret;
 }
 
@@ -3256,6 +3260,8 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                                   (int) reloc->offset,
                                   reloc->read_domains,
                                   reloc->write_domain);
+                        drm_gem_object_unreference(target_obj);
+                        i915_gem_object_unpin(obj);
                         return -EINVAL;
                 }
                 if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||