From cb77b79abf5ff8f4af07f7ebef196a003c826b7a Mon Sep 17 00:00:00 2001 From: Tvrtko Ursulin Date: Wed, 12 Nov 2025 09:27:32 +0000 Subject: [PATCH] drm/gem: Use vmemdup_array_user in drm_gem_objects_lookup MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Use a helper to shrink the code and separate the user and kernel slabs for better security. While at it lets remove the useless debug message. Signed-off-by: Tvrtko Ursulin Reviewed-by: André Almeida Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20251112092732.23584-1-tvrtko.ursulin@igalia.com --- drivers/gpu/drm/drm_gem.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index a1a9c828938ba..68168d58a7c86 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -783,7 +783,6 @@ static int objects_lookup(struct drm_file *filp, u32 *handle, int count, int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles, int count, struct drm_gem_object ***objs_out) { - struct drm_device *dev = filp->minor->dev; struct drm_gem_object **objs; u32 *handles; int ret; @@ -798,15 +797,9 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles, *objs_out = objs; - handles = kvmalloc_array(count, sizeof(u32), GFP_KERNEL); - if (!handles) { - ret = -ENOMEM; - goto out; - } - - if (copy_from_user(handles, bo_handles, count * sizeof(u32))) { - ret = -EFAULT; - drm_dbg_core(dev, "Failed to copy in GEM handles\n"); + handles = vmemdup_array_user(bo_handles, count, sizeof(u32)); + if (IS_ERR(handles)) { + ret = PTR_ERR(handles); goto out; } -- 2.47.3