Commit 5805977e authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/drm-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/drm-2.6:
  drm: Copy back ioctl data to userspace regardless of return code.
  drm: Round size of SHM maps to PAGE_SIZE
parents a9523f45 9b6fe313
...@@ -170,6 +170,14 @@ static int drm_addmap_core(struct drm_device * dev, resource_size_t offset, ...@@ -170,6 +170,14 @@ static int drm_addmap_core(struct drm_device * dev, resource_size_t offset,
} }
DRM_DEBUG("offset = 0x%08llx, size = 0x%08lx, type = %d\n", DRM_DEBUG("offset = 0x%08llx, size = 0x%08lx, type = %d\n",
(unsigned long long)map->offset, map->size, map->type); (unsigned long long)map->offset, map->size, map->type);
/* page-align _DRM_SHM maps. They are allocated here so there is no security
* hole created by that and it works around various broken drivers that use
* a non-aligned quantity to map the SAREA. --BenH
*/
if (map->type == _DRM_SHM)
map->size = PAGE_ALIGN(map->size);
if ((map->offset & (~(resource_size_t)PAGE_MASK)) || (map->size & (~PAGE_MASK))) { if ((map->offset & (~(resource_size_t)PAGE_MASK)) || (map->size & (~PAGE_MASK))) {
drm_free(map, sizeof(*map), DRM_MEM_MAPS); drm_free(map, sizeof(*map), DRM_MEM_MAPS);
return -EINVAL; return -EINVAL;
......
...@@ -481,7 +481,7 @@ int drm_ioctl(struct inode *inode, struct file *filp, ...@@ -481,7 +481,7 @@ int drm_ioctl(struct inode *inode, struct file *filp,
} }
retcode = func(dev, kdata, file_priv); retcode = func(dev, kdata, file_priv);
if ((retcode == 0) && (cmd & IOC_OUT)) { if (cmd & IOC_OUT) {
if (copy_to_user((void __user *)arg, kdata, if (copy_to_user((void __user *)arg, kdata,
_IOC_SIZE(cmd)) != 0) _IOC_SIZE(cmd)) != 0)
retcode = -EFAULT; retcode = -EFAULT;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment