From 6545135a5ed2eac064f23bee3a19a81cfffbe573 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Tue, 20 Jun 2017 13:39:14 +0200 Subject: [PATCH] drm/qxl: fix __user annotations Drop them from u64 fields, tag local variables correctly instead. While being at it switch the code to use u64_to_user_ptr(). Signed-off-by: Gerd Hoffmann Acked-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20170620113916.6967-2-kraxel@redhat.com --- drivers/gpu/drm/qxl/qxl_ioctl.c | 17 +++++++++-------- include/uapi/drm/qxl_drm.h | 6 +++--- 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 0b82a87916ae..31effed4a3c8 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -163,7 +163,7 @@ static int qxl_process_single_command(struct qxl_device *qdev, return -EINVAL; if (!access_ok(VERIFY_READ, - (void *)(unsigned long)cmd->command, + u64_to_user_ptr(cmd->command), cmd->command_size)) return -EFAULT; @@ -183,7 +183,9 @@ static int qxl_process_single_command(struct qxl_device *qdev, /* TODO copy slow path code from i915 */ fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE)); - unwritten = __copy_from_user_inatomic_nocache(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE), (void *)(unsigned long)cmd->command, cmd->command_size); + unwritten = __copy_from_user_inatomic_nocache + (fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE), + u64_to_user_ptr(cmd->command), cmd->command_size); { struct qxl_drawable *draw = fb_cmd; @@ -201,10 +203,9 @@ static int qxl_process_single_command(struct qxl_device *qdev, num_relocs = 0; for (i = 0; i < cmd->relocs_num; ++i) { struct drm_qxl_reloc reloc; + struct drm_qxl_reloc __user *u = u64_to_user_ptr(cmd->relocs); - if (copy_from_user(&reloc, - &((struct drm_qxl_reloc *)(uintptr_t)cmd->relocs)[i], - sizeof(reloc))) { + if (copy_from_user(&reloc, u + i, sizeof(reloc))) { ret = -EFAULT; goto out_free_bos; } @@ -282,10 +283,10 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data, for (cmd_num = 0; cmd_num < execbuffer->commands_num; ++cmd_num) { - struct drm_qxl_command *commands = - (struct drm_qxl_command *)(uintptr_t)execbuffer->commands; + struct drm_qxl_command __user *commands = + u64_to_user_ptr(execbuffer->commands); - if (copy_from_user(&user_cmd, &commands[cmd_num], + if (copy_from_user(&user_cmd, commands + cmd_num, sizeof(user_cmd))) return -EFAULT; diff --git a/include/uapi/drm/qxl_drm.h b/include/uapi/drm/qxl_drm.h index 7eef42213051..880999d2d863 100644 --- a/include/uapi/drm/qxl_drm.h +++ b/include/uapi/drm/qxl_drm.h @@ -80,8 +80,8 @@ struct drm_qxl_reloc { }; struct drm_qxl_command { - __u64 __user command; /* void* */ - __u64 __user relocs; /* struct drm_qxl_reloc* */ + __u64 command; /* void* */ + __u64 relocs; /* struct drm_qxl_reloc* */ __u32 type; __u32 command_size; __u32 relocs_num; @@ -91,7 +91,7 @@ struct drm_qxl_command { struct drm_qxl_execbuffer { __u32 flags; /* for future use */ __u32 commands_num; - __u64 __user commands; /* struct drm_qxl_command* */ + __u64 commands; /* struct drm_qxl_command* */ }; struct drm_qxl_update_area { -- 2.20.1