If the allocation fails the current code returns success.  If
copy_from_user() fails it returns the number of bytes remaining instead
of -EFAULT.

Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>

diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 47a095f..303f23c 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -544,14 +544,15 @@ vc4_cl_lookup_bos(struct drm_device *dev,

        handles = drm_malloc_ab(exec->bo_count, sizeof(uint32_t));
        if (!handles) {
+               ret = -ENOMEM;
                DRM_ERROR("Failed to allocate incoming GEM handles\n");
                goto fail;
        }

-       ret = copy_from_user(handles,
-                            (void __user *)(uintptr_t)args->bo_handles,
-                            exec->bo_count * sizeof(uint32_t));
-       if (ret) {
+       if (copy_from_user(handles,
+                          (void __user *)(uintptr_t)args->bo_handles,
+                          exec->bo_count * sizeof(uint32_t))) {
+               ret = -EFAULT;
                DRM_ERROR("Failed to copy in GEM handles\n");
                goto fail;
        }

Reply via email to