Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
drm/qxl: fix __user annotations
Drop them from u64 fields, tag local variables correctly instead.
While being at it switch the code to use u64_to_user_ptr().
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Daniel Vetter <daniel@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20170620113916.6967-2-kraxel@redhat.com
+12
-11
+9
-8
drivers/gpu/drm/qxl/qxl_ioctl.c
+9
-8
drivers/gpu/drm/qxl/qxl_ioctl.c
···
163
163
return -EINVAL;
164
164
165
165
if (!access_ok(VERIFY_READ,
166
-
(void *)(unsigned long)cmd->command,
166
+
u64_to_user_ptr(cmd->command),
167
167
cmd->command_size))
168
168
return -EFAULT;
169
169
···
183
183
184
184
/* TODO copy slow path code from i915 */
185
185
fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE));
186
-
unwritten = __copy_from_user_inatomic_nocache(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE), (void *)(unsigned long)cmd->command, cmd->command_size);
186
+
unwritten = __copy_from_user_inatomic_nocache
187
+
(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE),
188
+
u64_to_user_ptr(cmd->command), cmd->command_size);
187
189
188
190
{
189
191
struct qxl_drawable *draw = fb_cmd;
···
203
201
num_relocs = 0;
204
202
for (i = 0; i < cmd->relocs_num; ++i) {
205
203
struct drm_qxl_reloc reloc;
204
+
struct drm_qxl_reloc __user *u = u64_to_user_ptr(cmd->relocs);
206
205
207
-
if (copy_from_user(&reloc,
208
-
&((struct drm_qxl_reloc *)(uintptr_t)cmd->relocs)[i],
209
-
sizeof(reloc))) {
206
+
if (copy_from_user(&reloc, u + i, sizeof(reloc))) {
210
207
ret = -EFAULT;
211
208
goto out_free_bos;
212
209
}
···
283
282
284
283
for (cmd_num = 0; cmd_num < execbuffer->commands_num; ++cmd_num) {
285
284
286
-
struct drm_qxl_command *commands =
287
-
(struct drm_qxl_command *)(uintptr_t)execbuffer->commands;
285
+
struct drm_qxl_command __user *commands =
286
+
u64_to_user_ptr(execbuffer->commands);
288
287
289
-
if (copy_from_user(&user_cmd, &commands[cmd_num],
288
+
if (copy_from_user(&user_cmd, commands + cmd_num,
290
289
sizeof(user_cmd)))
291
290
return -EFAULT;
292
291
+3
-3
include/uapi/drm/qxl_drm.h
+3
-3
include/uapi/drm/qxl_drm.h
···
80
80
};
81
81
82
82
struct drm_qxl_command {
83
-
__u64 __user command; /* void* */
84
-
__u64 __user relocs; /* struct drm_qxl_reloc* */
83
+
__u64 command; /* void* */
84
+
__u64 relocs; /* struct drm_qxl_reloc* */
85
85
__u32 type;
86
86
__u32 command_size;
87
87
__u32 relocs_num;
···
91
91
struct drm_qxl_execbuffer {
92
92
__u32 flags; /* for future use */
93
93
__u32 commands_num;
94
-
__u64 __user commands; /* struct drm_qxl_command* */
94
+
__u64 commands; /* struct drm_qxl_command* */
95
95
};
96
96
97
97
struct drm_qxl_update_area {