drm/qxl: fix __user annotations

Drop them from u64 fields, tag local variables correctly instead.
While being at it switch the code to use u64_to_user_ptr().

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Daniel Vetter <daniel@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20170620113916.6967-2-kraxel@redhat.com

diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 0b82a87..31effed 100644 (file)
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -163,7 +163,7 @@ static int qxl_process_single_command(struct qxl_device *qdev,
                return -EINVAL;
 
        if (!access_ok(VERIFY_READ,
-                      (void *)(unsigned long)cmd->command,
+                      u64_to_user_ptr(cmd->command),
                       cmd->command_size))
                return -EFAULT;
 
@@ -183,7 +183,9 @@ static int qxl_process_single_command(struct qxl_device *qdev,
 
        /* TODO copy slow path code from i915 */
        fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE));
-       unwritten = __copy_from_user_inatomic_nocache(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE), (void *)(unsigned long)cmd->command, cmd->command_size);
+       unwritten = __copy_from_user_inatomic_nocache
+               (fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE),
+                u64_to_user_ptr(cmd->command), cmd->command_size);
 
        {
                struct qxl_drawable *draw = fb_cmd;
@@ -201,10 +203,9 @@ static int qxl_process_single_command(struct qxl_device *qdev,
        num_relocs = 0;
        for (i = 0; i < cmd->relocs_num; ++i) {
                struct drm_qxl_reloc reloc;
+               struct drm_qxl_reloc __user *u = u64_to_user_ptr(cmd->relocs);
 
-               if (copy_from_user(&reloc,
-                                      &((struct drm_qxl_reloc *)(uintptr_t)cmd->relocs)[i],
-                                      sizeof(reloc))) {
+               if (copy_from_user(&reloc, u + i, sizeof(reloc))) {
                        ret = -EFAULT;
                        goto out_free_bos;
                }
@@ -282,10 +283,10 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
 
        for (cmd_num = 0; cmd_num < execbuffer->commands_num; ++cmd_num) {
 
-               struct drm_qxl_command *commands =
-                       (struct drm_qxl_command *)(uintptr_t)execbuffer->commands;
+               struct drm_qxl_command __user *commands =
+                       u64_to_user_ptr(execbuffer->commands);
 
-               if (copy_from_user(&user_cmd, &commands[cmd_num],
+               if (copy_from_user(&user_cmd, commands + cmd_num,
                                       sizeof(user_cmd)))
                        return -EFAULT;
 

diff --git a/include/uapi/drm/qxl_drm.h b/include/uapi/drm/qxl_drm.h
index 7eef422..880999d 100644 (file)
--- a/include/uapi/drm/qxl_drm.h
+++ b/include/uapi/drm/qxl_drm.h
@@ -80,8 +80,8 @@ struct drm_qxl_reloc {
 };
 
 struct drm_qxl_command {
-       __u64    __user command; /* void* */
-       __u64    __user relocs; /* struct drm_qxl_reloc* */
+       __u64           command; /* void* */
+       __u64           relocs; /* struct drm_qxl_reloc* */
        __u32           type;
        __u32           command_size;
        __u32           relocs_num;
@@ -91,7 +91,7 @@ struct drm_qxl_command {
 struct drm_qxl_execbuffer {
        __u32           flags;          /* for future use */
        __u32           commands_num;
-       __u64    __user commands;       /* struct drm_qxl_command* */
+       __u64           commands;       /* struct drm_qxl_command* */
 };
 
 struct drm_qxl_update_area {