tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

drm/xe: Use copy_from_user() instead of __copy_from_user()

copy_from_user() has more checks and is more safer than
__copy_from_user()

Suggested-by: Kees Cook <kees@kernel.org>
Signed-off-by: Harish Chegondi <harish.chegondi@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Link: https://lore.kernel.org/r/acabf20aa8621c7bc8de09b1bffb8d14b5376484.1746126614.git.harish.chegondi@intel.com

authored by

Harish Chegondi and committed by
Ashutosh Dixit aef87a5f 12370bfc

+16 -17
+2 -2
drivers/gpu/drm/xe/xe_bo.c
··· 2569 2569 int err; 2570 2570 u32 idx; 2571 2571 2572 - err = __copy_from_user(&ext, address, sizeof(ext)); 2572 + err = copy_from_user(&ext, address, sizeof(ext)); 2573 2573 if (XE_IOCTL_DBG(xe, err)) 2574 2574 return -EFAULT; 2575 2575 ··· 2606 2606 if (XE_IOCTL_DBG(xe, ext_number >= MAX_USER_EXTENSIONS)) 2607 2607 return -E2BIG; 2608 2608 2609 - err = __copy_from_user(&ext, address, sizeof(ext)); 2609 + err = copy_from_user(&ext, address, sizeof(ext)); 2610 2610 if (XE_IOCTL_DBG(xe, err)) 2611 2611 return -EFAULT; 2612 2612
+2 -2
drivers/gpu/drm/xe/xe_eu_stall.c
··· 283 283 int err; 284 284 u32 idx; 285 285 286 - err = __copy_from_user(&ext, address, sizeof(ext)); 286 + err = copy_from_user(&ext, address, sizeof(ext)); 287 287 if (XE_IOCTL_DBG(xe, err)) 288 288 return -EFAULT; 289 289 ··· 313 313 if (XE_IOCTL_DBG(xe, ext_number >= MAX_USER_EXTENSIONS)) 314 314 return -E2BIG; 315 315 316 - err = __copy_from_user(&ext, address, sizeof(ext)); 316 + err = copy_from_user(&ext, address, sizeof(ext)); 317 317 if (XE_IOCTL_DBG(xe, err)) 318 318 return -EFAULT; 319 319
+2 -2
drivers/gpu/drm/xe/xe_exec.c
··· 176 176 } 177 177 178 178 if (xe_exec_queue_is_parallel(q)) { 179 - err = __copy_from_user(addresses, addresses_user, sizeof(u64) * 180 - q->width); 179 + err = copy_from_user(addresses, addresses_user, sizeof(u64) * 180 + q->width); 181 181 if (err) { 182 182 err = -EFAULT; 183 183 goto err_syncs;
+4 -5
drivers/gpu/drm/xe/xe_exec_queue.c
··· 479 479 int err; 480 480 u32 idx; 481 481 482 - err = __copy_from_user(&ext, address, sizeof(ext)); 482 + err = copy_from_user(&ext, address, sizeof(ext)); 483 483 if (XE_IOCTL_DBG(xe, err)) 484 484 return -EFAULT; 485 485 ··· 518 518 if (XE_IOCTL_DBG(xe, ext_number >= MAX_USER_EXTENSIONS)) 519 519 return -E2BIG; 520 520 521 - err = __copy_from_user(&ext, address, sizeof(ext)); 521 + err = copy_from_user(&ext, address, sizeof(ext)); 522 522 if (XE_IOCTL_DBG(xe, err)) 523 523 return -EFAULT; 524 524 ··· 618 618 if (XE_IOCTL_DBG(xe, !len || len > XE_HW_ENGINE_MAX_INSTANCE)) 619 619 return -EINVAL; 620 620 621 - err = __copy_from_user(eci, user_eci, 622 - sizeof(struct drm_xe_engine_class_instance) * 623 - len); 621 + err = copy_from_user(eci, user_eci, 622 + sizeof(struct drm_xe_engine_class_instance) * len); 624 623 if (XE_IOCTL_DBG(xe, err)) 625 624 return -EFAULT; 626 625
+3 -3
drivers/gpu/drm/xe/xe_oa.c
··· 1301 1301 int err; 1302 1302 u32 idx; 1303 1303 1304 - err = __copy_from_user(&ext, address, sizeof(ext)); 1304 + err = copy_from_user(&ext, address, sizeof(ext)); 1305 1305 if (XE_IOCTL_DBG(oa->xe, err)) 1306 1306 return -EFAULT; 1307 1307 ··· 1338 1338 if (XE_IOCTL_DBG(oa->xe, ext_number >= MAX_USER_EXTENSIONS)) 1339 1339 return -E2BIG; 1340 1340 1341 - err = __copy_from_user(&ext, address, sizeof(ext)); 1341 + err = copy_from_user(&ext, address, sizeof(ext)); 1342 1342 if (XE_IOCTL_DBG(oa->xe, err)) 1343 1343 return -EFAULT; 1344 1344 ··· 2281 2281 return -EACCES; 2282 2282 } 2283 2283 2284 - err = __copy_from_user(&param, u64_to_user_ptr(data), sizeof(param)); 2284 + err = copy_from_user(&param, u64_to_user_ptr(data), sizeof(param)); 2285 2285 if (XE_IOCTL_DBG(oa->xe, err)) 2286 2286 return -EFAULT; 2287 2287
+3 -3
drivers/gpu/drm/xe/xe_vm.c
··· 3101 3101 if (!*bind_ops) 3102 3102 return args->num_binds > 1 ? -ENOBUFS : -ENOMEM; 3103 3103 3104 - err = __copy_from_user(*bind_ops, bind_user, 3105 - sizeof(struct drm_xe_vm_bind_op) * 3106 - args->num_binds); 3104 + err = copy_from_user(*bind_ops, bind_user, 3105 + sizeof(struct drm_xe_vm_bind_op) * 3106 + args->num_binds); 3107 3107 if (XE_IOCTL_DBG(xe, err)) { 3108 3108 err = -EFAULT; 3109 3109 goto free_bind_ops;