From 65c4777de54a39b2722a4b1ff3306d044014d511 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 17 Dec 2015 15:36:28 +0300 Subject: drm/vc4: copy_to_user() returns the number of bytes remaining The copy_to/from_user() functions return the number of bytes remaining to be copied. We want to return error codes here. Also it's a bad idea to print an error message if a copy from user fails because users can use that to spam /var/log/messages which is annoying so I removed those. Fixes: 214613656b51 ('drm/vc4: Add an interface for capturing the GPU state after a hang.') Signed-off-by: Dan Carpenter Reviewed-by: Eric Anholt --- drivers/gpu/drm/vc4/vc4_gem.c | 37 ++++++++++++++++++------------------- 1 file changed, 18 insertions(+), 19 deletions(-) (limited to 'drivers/gpu/drm/vc4') diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c index 39f29e7..461a16c 100644 --- a/drivers/gpu/drm/vc4/vc4_gem.c +++ b/drivers/gpu/drm/vc4/vc4_gem.c @@ -71,7 +71,7 @@ vc4_get_hang_state_ioctl(struct drm_device *dev, void *data, struct vc4_dev *vc4 = to_vc4_dev(dev); unsigned long irqflags; u32 i; - int ret; + int ret = 0; spin_lock_irqsave(&vc4->job_lock, irqflags); kernel_state = vc4->hang_state; @@ -119,9 +119,11 @@ vc4_get_hang_state_ioctl(struct drm_device *dev, void *data, bo_state[i].size = vc4_bo->base.base.size; } - ret = copy_to_user((void __user *)(uintptr_t)get_state->bo, - bo_state, - state->bo_count * sizeof(*bo_state)); + if (copy_to_user((void __user *)(uintptr_t)get_state->bo, + bo_state, + state->bo_count * sizeof(*bo_state))) + ret = -EFAULT; + kfree(bo_state); err_free: @@ -554,27 +556,24 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec) exec->shader_state = temp + exec_size; exec->shader_state_size = args->shader_rec_count; - ret = copy_from_user(bin, - (void __user *)(uintptr_t)args->bin_cl, - args->bin_cl_size); - if (ret) { - DRM_ERROR("Failed to copy in bin cl\n"); + if (copy_from_user(bin, + (void __user *)(uintptr_t)args->bin_cl, + args->bin_cl_size)) { + ret = -EFAULT; goto fail; } - ret = copy_from_user(exec->shader_rec_u, - (void __user *)(uintptr_t)args->shader_rec, - args->shader_rec_size); - if (ret) { - DRM_ERROR("Failed to copy in shader recs\n"); + if (copy_from_user(exec->shader_rec_u, + (void __user *)(uintptr_t)args->shader_rec, + args->shader_rec_size)) { + ret = -EFAULT; goto fail; } - ret = copy_from_user(exec->uniforms_u, - (void __user *)(uintptr_t)args->uniforms, - args->uniforms_size); - if (ret) { - DRM_ERROR("Failed to copy in uniforms cl\n"); + if (copy_from_user(exec->uniforms_u, + (void __user *)(uintptr_t)args->uniforms, + args->uniforms_size)) { + ret = -EFAULT; goto fail; } -- cgit v1.1 From 7e5082fbc00cc157e57a70cdb6b9bbb21289afb1 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 17 Dec 2015 15:39:08 +0300 Subject: drm/vc4: allocate enough memory in vc4_save_hang_state() "state" is smaller than "kernel_state" so we end up corrupting memory. Fixes: 214613656b51 ('drm/vc4: Add an interface for capturing the GPU state after a hang.') Signed-off-by: Dan Carpenter Reviewed-by: Eric Anholt --- drivers/gpu/drm/vc4/vc4_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/gpu/drm/vc4') diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c index 461a16c..1928c0a 100644 --- a/drivers/gpu/drm/vc4/vc4_gem.c +++ b/drivers/gpu/drm/vc4/vc4_gem.c @@ -145,7 +145,7 @@ vc4_save_hang_state(struct drm_device *dev) unsigned long irqflags; unsigned int i, unref_list_count; - kernel_state = kcalloc(1, sizeof(*state), GFP_KERNEL); + kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL); if (!kernel_state) return; -- cgit v1.1 From 5645e785cea2f33acdc5e5cee62b3ce8a00f1169 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 17 Dec 2015 15:40:20 +0300 Subject: drm/vc4: fix an error code "exec->exec_bo" is NULL at this point so this code returns success. We want to return -ENOMEM. Fixes: d5b1a78a772f ('drm/vc4: Add support for drawing 3D frames.') Signed-off-by: Dan Carpenter Reviewed-by: Eric Anholt --- drivers/gpu/drm/vc4/vc4_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/gpu/drm/vc4') diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c index 1928c0a..48ce30a 100644 --- a/drivers/gpu/drm/vc4/vc4_gem.c +++ b/drivers/gpu/drm/vc4/vc4_gem.c @@ -580,7 +580,7 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec) bo = vc4_bo_create(dev, exec_size, true); if (!bo) { DRM_ERROR("Couldn't allocate BO for binning\n"); - ret = PTR_ERR(exec->exec_bo); + ret = -ENOMEM; goto fail; } exec->exec_bo = &bo->base; -- cgit v1.1