summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--linux-core/i915_ioc32.c20
1 files changed, 19 insertions, 1 deletions
diff --git a/linux-core/i915_ioc32.c b/linux-core/i915_ioc32.c
index b878e21c..0b8fff19 100644
--- a/linux-core/i915_ioc32.c
+++ b/linux-core/i915_ioc32.c
@@ -196,6 +196,7 @@ static int compat_i915_execbuffer(struct file *file, unsigned int cmd,
{
drm_i915_execbuffer32_t req32;
struct drm_i915_execbuffer __user *request;
+ int err;
if (copy_from_user(&req32, (void __user *) arg, sizeof(req32)))
return -EFAULT;
@@ -218,8 +219,25 @@ static int compat_i915_execbuffer(struct file *file, unsigned int cmd,
&request->batch.cliprects))
return -EFAULT;
- return drm_ioctl(file->f_dentry->d_inode, file,
+ err = drm_ioctl(file->f_dentry->d_inode, file,
DRM_IOCTL_I915_EXECBUFFER, (unsigned long)request);
+
+ if (err)
+ return err;
+
+ if (__get_user(req32.fence_arg.handle, &request->fence_arg.handle)
+ || __get_user(req32.fence_arg.fence_class, &request->fence_arg.fence_class)
+ || __get_user(req32.fence_arg.type, &request->fence_arg.type)
+ || __get_user(req32.fence_arg.flags, &request->fence_arg.flags)
+ || __get_user(req32.fence_arg.signaled, &request->fence_arg.signaled)
+ || __get_user(req32.fence_arg.error, &request->fence_arg.error)
+ || __get_user(req32.fence_arg.sequence, &request->fence_arg.sequence))
+ return -EFAULT;
+
+ if (copy_to_user((void __user *)arg, &req32, sizeof(req32)))
+ return -EFAULT;
+
+ return 0;
}