aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/gpu
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/gpu')
-rw-r--r--drivers/gpu/drm/drm_drv.c15
1 files changed, 10 insertions, 5 deletions
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index c26ee0822a05..c4ada8b6295b 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -421,6 +421,7 @@ int drm_ioctl(struct inode *inode, struct file *filp,
421 drm_ioctl_t *func; 421 drm_ioctl_t *func;
422 unsigned int nr = DRM_IOCTL_NR(cmd); 422 unsigned int nr = DRM_IOCTL_NR(cmd);
423 int retcode = -EINVAL; 423 int retcode = -EINVAL;
424 char stack_kdata[128];
424 char *kdata = NULL; 425 char *kdata = NULL;
425 426
426 atomic_inc(&dev->ioctl_count); 427 atomic_inc(&dev->ioctl_count);
@@ -459,10 +460,14 @@ int drm_ioctl(struct inode *inode, struct file *filp,
459 retcode = -EACCES; 460 retcode = -EACCES;
460 } else { 461 } else {
461 if (cmd & (IOC_IN | IOC_OUT)) { 462 if (cmd & (IOC_IN | IOC_OUT)) {
462 kdata = kmalloc(_IOC_SIZE(cmd), GFP_KERNEL); 463 if (_IOC_SIZE(cmd) <= sizeof(stack_kdata)) {
463 if (!kdata) { 464 kdata = stack_kdata;
464 retcode = -ENOMEM; 465 } else {
465 goto err_i1; 466 kdata = kmalloc(_IOC_SIZE(cmd), GFP_KERNEL);
467 if (!kdata) {
468 retcode = -ENOMEM;
469 goto err_i1;
470 }
466 } 471 }
467 } 472 }
468 473
@@ -483,7 +488,7 @@ int drm_ioctl(struct inode *inode, struct file *filp,
483 } 488 }
484 489
485 err_i1: 490 err_i1:
486 if (kdata) 491 if (kdata != stack_kdata)
487 kfree(kdata); 492 kfree(kdata);
488 atomic_dec(&dev->ioctl_count); 493 atomic_dec(&dev->ioctl_count);
489 if (retcode) 494 if (retcode)