| Message ID | 20121112110724.GA1678@elgon.mountain (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
On 11/12/2012 12:07 PM, Dan Carpenter wrote: > copy_to_user() returns the number of bytes remaining to be copied, but > we want to return a negative error code here. I fixed a couple of these > last year, but I missed this one. > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > I think there were only three copy_to/from_user() functions in this > file and they're all fixed now. > > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c > index b07ca2e..7290811 100644 > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c > @@ -110,6 +110,8 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data, > memcpy_fromio(bounce, &fifo_mem[SVGA_FIFO_3D_CAPS], size); > > ret = copy_to_user(buffer, bounce, size); > + if (ret) > + ret = -EFAULT; > vfree(bounce); > > if (unlikely(ret != 0)) Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c index b07ca2e..7290811 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c @@ -110,6 +110,8 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data, memcpy_fromio(bounce, &fifo_mem[SVGA_FIFO_3D_CAPS], size); ret = copy_to_user(buffer, bounce, size); + if (ret) + ret = -EFAULT; vfree(bounce); if (unlikely(ret != 0))
copy_to_user() returns the number of bytes remaining to be copied, but we want to return a negative error code here. I fixed a couple of these last year, but I missed this one. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- I think there were only three copy_to/from_user() functions in this file and they're all fixed now.