Merge drm/drm-next into drm-intel-next-queued

[linux-2.6-block.git] / drivers / gpu / drm / i915 / i915_gem_execbuffer.c

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 844bd5ad87bc4b5bd84a481aa0fa94a270db83f0..5b7cd7add63e6c4dff5b07ab5639b5c29fe5face 100644 (file)
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -26,7 +26,7 @@
  *
  */
 
-#include <linux/dma_remapping.h>
+#include <linux/intel-iommu.h>
 #include <linux/reservation.h>
 #include <linux/sync_file.h>
 #include <linux/uaccess.h>
@@ -1447,7 +1447,7 @@ static int eb_relocate_vma(struct i915_execbuffer *eb, struct i915_vma *vma)
         * to read. However, if the array is not writable the user loses
         * the updated relocation values.
         */
-       if (unlikely(!access_ok(VERIFY_READ, urelocs, remain*sizeof(*urelocs))))
+       if (unlikely(!access_ok(urelocs, remain*sizeof(*urelocs))))
                return -EFAULT;
 
        do {
@@ -1554,7 +1554,7 @@ static int check_relocations(const struct drm_i915_gem_exec_object2 *entry)
 
        addr = u64_to_user_ptr(entry->relocs_ptr);
        size *= sizeof(struct drm_i915_gem_relocation_entry);
-       if (!access_ok(VERIFY_READ, addr, size))
+       if (!access_ok(addr, size))
                return -EFAULT;
 
        end = addr + size;
@@ -1605,6 +1605,7 @@ static int eb_copy_relocations(const struct i915_execbuffer *eb)
                                             (char __user *)urelocs + copied,
                                             len)) {
 end_user:
+                               user_access_end();
                                kvfree(relocs);
                                err = -EFAULT;
                                goto err;
@@ -1623,7 +1624,9 @@ end_user:
                 * happened we would make the mistake of assuming that the
                 * relocations were valid.
                 */
-               user_access_begin();
+               if (!user_access_begin(urelocs, size))
+                       goto end_user;
+
                for (copied = 0; copied < nreloc; copied++)
                        unsafe_put_user(-1,
                                        &urelocs[copied].presumed_offset,
@@ -2090,7 +2093,7 @@ get_fence_array(struct drm_i915_gem_execbuffer2 *args,
                return ERR_PTR(-EINVAL);
 
        user = u64_to_user_ptr(args->cliprects_ptr);
-       if (!access_ok(VERIFY_READ, user, nfences * sizeof(*user)))
+       if (!access_ok(user, nfences * sizeof(*user)))
                return ERR_PTR(-EFAULT);
 
        fences = kvmalloc_array(nfences, sizeof(*fences),
@@ -2157,7 +2160,7 @@ await_fence_array(struct i915_execbuffer *eb,
                if (!(flags & I915_EXEC_FENCE_WAIT))
                        continue;
 
-               drm_syncobj_search_fence(syncobj, 0, 0, &fence);
+               fence = drm_syncobj_fence_get(syncobj);
                if (!fence)
                        return -EINVAL;
 
@@ -2186,7 +2189,7 @@ signal_fence_array(struct i915_execbuffer *eb,
                if (!(flags & I915_EXEC_FENCE_SIGNAL))
                        continue;
 
-               drm_syncobj_replace_fence(syncobj, 0, fence);
+               drm_syncobj_replace_fence(syncobj, fence);
        }
 }
 
@@ -2605,7 +2608,16 @@ i915_gem_execbuffer2_ioctl(struct drm_device *dev, void *data,
                unsigned int i;
 
                /* Copy the new buffer offsets back to the user's exec list. */
-               user_access_begin();
+               /*
+                * Note: count * sizeof(*user_exec_list) does not overflow,
+                * because we checked 'count' in check_buffer_count().
+                *
+                * And this range already got effectively checked earlier
+                * when we did the "copy_from_user()" above.
+                */
+               if (!user_access_begin(user_exec_list, count * sizeof(*user_exec_list)))
+                       goto end_user;
+
                for (i = 0; i < args->buffer_count; i++) {
                        if (!(exec2_list[i].offset & UPDATE))
                                continue;