From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Sat, 10 Jul 2010 14:30:04 +0000 Subject: [patch] vmwgfx: return -EFAULT if copy_to_user fails Message-Id: <20100710143003.GZ19184@bicker> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: David Airlie Cc: Dave Airlie , kernel-janitors@vger.kernel.org, Thomas Hellstrom , dri-devel@lists.freedesktop.org copy_to_user() returns the number of bytes remaining to be copied, but we want to return a negative error code. This gets copied to user space. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c index f1d6261..437ac78 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c @@ -972,6 +972,7 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data, ret = copy_from_user(rects, user_rects, rects_size); if (unlikely(ret != 0)) { DRM_ERROR("Failed to get rects.\n"); + ret = -EFAULT; goto out_free; } From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [patch] vmwgfx: return -EFAULT if copy_to_user fails Date: Sat, 10 Jul 2010 16:30:04 +0200 Message-ID: <20100710143003.GZ19184@bicker> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail-fx0-f49.google.com (mail-fx0-f49.google.com [209.85.161.49]) by gabe.freedesktop.org (Postfix) with ESMTP id 0D9349E75D for ; Sat, 10 Jul 2010 07:31:39 -0700 (PDT) Received: by fxm3 with SMTP id 3so1830824fxm.36 for ; Sat, 10 Jul 2010 07:31:39 -0700 (PDT) Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org Errors-To: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org To: David Airlie Cc: Dave Airlie , kernel-janitors@vger.kernel.org, Thomas Hellstrom , dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org copy_to_user() returns the number of bytes remaining to be copied, but we want to return a negative error code. This gets copied to user space. Signed-off-by: Dan Carpenter diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c index f1d6261..437ac78 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c @@ -972,6 +972,7 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data, ret = copy_from_user(rects, user_rects, rects_size); if (unlikely(ret != 0)) { DRM_ERROR("Failed to get rects.\n"); + ret = -EFAULT; goto out_free; }