From: Chris Wilson Date: Sun, 26 Sep 2010 19:23:38 +0000 (+0100) Subject: drm/i915: Skip pread/pwrite if size to copy is 0. X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=35b62a89b0723ca05831f2edfff6deebe1806f21;p=GitHub%2Fexynos8895%2Fandroid_kernel_samsung_universal8895.git drm/i915: Skip pread/pwrite if size to copy is 0. Signed-off-by: Chris Wilson --- diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index dba82022bd3e..29e97c075421 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -576,7 +576,7 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data, struct drm_i915_gem_pread *args = data; struct drm_gem_object *obj; struct drm_i915_gem_object *obj_priv; - int ret; + int ret = 0; obj = drm_gem_object_lookup(dev, file_priv, args->handle); if (obj == NULL) @@ -586,14 +586,17 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data, /* Bounds check source. */ if (args->offset > obj->size || args->size > obj->size - args->offset) { ret = -EINVAL; - goto err; + goto out; } + if (args->size == 0) + goto out; + if (!access_ok(VERIFY_WRITE, (char __user *)(uintptr_t)args->data_ptr, args->size)) { ret = -EFAULT; - goto err; + goto out; } if (i915_gem_object_needs_bit17_swizzle(obj)) { @@ -605,7 +608,7 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data, file_priv); } -err: +out: drm_gem_object_unreference_unlocked(obj); return ret; } @@ -1059,14 +1062,17 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data, /* Bounds check destination. */ if (args->offset > obj->size || args->size > obj->size - args->offset) { ret = -EINVAL; - goto err; + goto out; } + if (args->size == 0) + goto out; + if (!access_ok(VERIFY_READ, (char __user *)(uintptr_t)args->data_ptr, args->size)) { ret = -EFAULT; - goto err; + goto out; } /* We can only do the GTT pwrite on untiled buffers, as otherwise @@ -1100,7 +1106,7 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data, DRM_INFO("pwrite failed %d\n", ret); #endif -err: +out: drm_gem_object_unreference_unlocked(obj); return ret; }