diff options
Diffstat (limited to 'drivers/gpu/drm/tegra/drm.c')
| -rw-r--r-- | drivers/gpu/drm/tegra/drm.c | 34 |
1 files changed, 19 insertions, 15 deletions
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c index 28e178137718..07eba596d458 100644 --- a/drivers/gpu/drm/tegra/drm.c +++ b/drivers/gpu/drm/tegra/drm.c | |||
| @@ -135,11 +135,11 @@ int tegra_drm_submit(struct tegra_drm_context *context, | |||
| 135 | unsigned int num_relocs = args->num_relocs; | 135 | unsigned int num_relocs = args->num_relocs; |
| 136 | unsigned int num_waitchks = args->num_waitchks; | 136 | unsigned int num_waitchks = args->num_waitchks; |
| 137 | struct drm_tegra_cmdbuf __user *cmdbufs = | 137 | struct drm_tegra_cmdbuf __user *cmdbufs = |
| 138 | (void * __user)(uintptr_t)args->cmdbufs; | 138 | (void __user *)(uintptr_t)args->cmdbufs; |
| 139 | struct drm_tegra_reloc __user *relocs = | 139 | struct drm_tegra_reloc __user *relocs = |
| 140 | (void * __user)(uintptr_t)args->relocs; | 140 | (void __user *)(uintptr_t)args->relocs; |
| 141 | struct drm_tegra_waitchk __user *waitchks = | 141 | struct drm_tegra_waitchk __user *waitchks = |
| 142 | (void * __user)(uintptr_t)args->waitchks; | 142 | (void __user *)(uintptr_t)args->waitchks; |
| 143 | struct drm_tegra_syncpt syncpt; | 143 | struct drm_tegra_syncpt syncpt; |
| 144 | struct host1x_job *job; | 144 | struct host1x_job *job; |
| 145 | int err; | 145 | int err; |
| @@ -163,9 +163,10 @@ int tegra_drm_submit(struct tegra_drm_context *context, | |||
| 163 | struct drm_tegra_cmdbuf cmdbuf; | 163 | struct drm_tegra_cmdbuf cmdbuf; |
| 164 | struct host1x_bo *bo; | 164 | struct host1x_bo *bo; |
| 165 | 165 | ||
| 166 | err = copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf)); | 166 | if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) { |
| 167 | if (err) | 167 | err = -EFAULT; |
| 168 | goto fail; | 168 | goto fail; |
| 169 | } | ||
| 169 | 170 | ||
| 170 | bo = host1x_bo_lookup(drm, file, cmdbuf.handle); | 171 | bo = host1x_bo_lookup(drm, file, cmdbuf.handle); |
| 171 | if (!bo) { | 172 | if (!bo) { |
| @@ -178,10 +179,11 @@ int tegra_drm_submit(struct tegra_drm_context *context, | |||
| 178 | cmdbufs++; | 179 | cmdbufs++; |
| 179 | } | 180 | } |
| 180 | 181 | ||
| 181 | err = copy_from_user(job->relocarray, relocs, | 182 | if (copy_from_user(job->relocarray, relocs, |
| 182 | sizeof(*relocs) * num_relocs); | 183 | sizeof(*relocs) * num_relocs)) { |
| 183 | if (err) | 184 | err = -EFAULT; |
| 184 | goto fail; | 185 | goto fail; |
| 186 | } | ||
| 185 | 187 | ||
| 186 | while (num_relocs--) { | 188 | while (num_relocs--) { |
| 187 | struct host1x_reloc *reloc = &job->relocarray[num_relocs]; | 189 | struct host1x_reloc *reloc = &job->relocarray[num_relocs]; |
| @@ -199,15 +201,17 @@ int tegra_drm_submit(struct tegra_drm_context *context, | |||
| 199 | } | 201 | } |
| 200 | } | 202 | } |
| 201 | 203 | ||
| 202 | err = copy_from_user(job->waitchk, waitchks, | 204 | if (copy_from_user(job->waitchk, waitchks, |
| 203 | sizeof(*waitchks) * num_waitchks); | 205 | sizeof(*waitchks) * num_waitchks)) { |
| 204 | if (err) | 206 | err = -EFAULT; |
| 205 | goto fail; | 207 | goto fail; |
| 208 | } | ||
| 206 | 209 | ||
| 207 | err = copy_from_user(&syncpt, (void * __user)(uintptr_t)args->syncpts, | 210 | if (copy_from_user(&syncpt, (void __user *)(uintptr_t)args->syncpts, |
| 208 | sizeof(syncpt)); | 211 | sizeof(syncpt))) { |
| 209 | if (err) | 212 | err = -EFAULT; |
| 210 | goto fail; | 213 | goto fail; |
| 214 | } | ||
| 211 | 215 | ||
| 212 | job->is_addr_reg = context->client->ops->is_addr_reg; | 216 | job->is_addr_reg = context->client->ops->is_addr_reg; |
| 213 | job->syncpt_incrs = syncpt.incrs; | 217 | job->syncpt_incrs = syncpt.incrs; |
| @@ -573,7 +577,7 @@ static void tegra_debugfs_cleanup(struct drm_minor *minor) | |||
| 573 | } | 577 | } |
| 574 | #endif | 578 | #endif |
| 575 | 579 | ||
| 576 | struct drm_driver tegra_drm_driver = { | 580 | static struct drm_driver tegra_drm_driver = { |
| 577 | .driver_features = DRIVER_MODESET | DRIVER_GEM, | 581 | .driver_features = DRIVER_MODESET | DRIVER_GEM, |
| 578 | .load = tegra_drm_load, | 582 | .load = tegra_drm_load, |
| 579 | .unload = tegra_drm_unload, | 583 | .unload = tegra_drm_unload, |
