]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
authorTvrtko Ursulin <tvrtko.ursulin@igalia.com>
Thu, 12 Jun 2025 10:44:27 +0000 (11:44 +0100)
committerAlex Deucher <alexander.deucher@amd.com>
Mon, 15 Sep 2025 20:51:40 +0000 (16:51 -0400)
Replace kmalloc_array() + copy_from_user() with memdup_array_user().

This shrinks the source code and improves separation between the kernel
and userspace slabs.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c

index 2ac9729e4c86d126db85eaa91831db5189bf170a..0e41589a7f18be9240171dd13b96aec3c2e8f356 100644 (file)
@@ -1767,30 +1767,21 @@ int amdgpu_cs_wait_fences_ioctl(struct drm_device *dev, void *data,
 {
        struct amdgpu_device *adev = drm_to_adev(dev);
        union drm_amdgpu_wait_fences *wait = data;
-       uint32_t fence_count = wait->in.fence_count;
-       struct drm_amdgpu_fence *fences_user;
        struct drm_amdgpu_fence *fences;
        int r;
 
        /* Get the fences from userspace */
-       fences = kmalloc_array(fence_count, sizeof(struct drm_amdgpu_fence),
-                       GFP_KERNEL);
-       if (fences == NULL)
-               return -ENOMEM;
-
-       fences_user = u64_to_user_ptr(wait->in.fences);
-       if (copy_from_user(fences, fences_user,
-               sizeof(struct drm_amdgpu_fence) * fence_count)) {
-               r = -EFAULT;
-               goto err_free_fences;
-       }
+       fences = memdup_array_user(u64_to_user_ptr(wait->in.fences),
+                                  wait->in.fence_count,
+                                  sizeof(struct drm_amdgpu_fence));
+       if (IS_ERR(fences))
+               return PTR_ERR(fences);
 
        if (wait->in.wait_all)
                r = amdgpu_cs_wait_all_fences(adev, filp, wait, fences);
        else
                r = amdgpu_cs_wait_any_fence(adev, filp, wait, fences);
 
-err_free_fences:
        kfree(fences);
 
        return r;