drm: return -EFAULT if copy_to_user() fails

The copy_from_user() function returns the number of bytes remaining
to be copied but we want to return a negative error code.  Otherwise
the callers treat it as a successful copy.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190618131843.GA29463@mwanda

diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c
index bfc419e..ceca79b 100644 (file)
--- a/drivers/gpu/drm/drm_bufs.c
+++ b/drivers/gpu/drm/drm_bufs.c
@@ -1340,7 +1340,10 @@ static int copy_one_buf(void *data, int count, struct drm_buf_entry *from)
                                 .size = from->buf_size,
                                 .low_mark = from->low_mark,
                                 .high_mark = from->high_mark};
-       return copy_to_user(to, &v, offsetof(struct drm_buf_desc, flags));
+
+       if (copy_to_user(to, &v, offsetof(struct drm_buf_desc, flags)))
+               return -EFAULT;
+       return 0;
 }
 
 int drm_legacy_infobufs(struct drm_device *dev, void *data,

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 374b372..3972ebe 100644 (file)
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -375,7 +375,10 @@ static int copy_one_buf32(void *data, int count, struct drm_buf_entry *from)
                              .size = from->buf_size,
                              .low_mark = from->low_mark,
                              .high_mark = from->high_mark};
-       return copy_to_user(to + count, &v, offsetof(drm_buf_desc32_t, flags));
+
+       if (copy_to_user(to + count, &v, offsetof(drm_buf_desc32_t, flags)))
+               return -EFAULT;
+       return 0;
 }
 
 static int drm_legacy_infobufs32(struct drm_device *dev, void *data,