From: Tvrtko Ursulin Date: Fri, 5 Dec 2025 13:40:29 +0000 (+0000) Subject: drm/amdgpu/userq: Use memdup_array_user in amdgpu_userq_wait_ioctl X-Git-Tag: v7.1-rc1~167^2~31^2~84 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fb1bf29acdd5283ec1d3f291b509a060d940cf1f;p=thirdparty%2Fkernel%2Flinux.git drm/amdgpu/userq: Use memdup_array_user in amdgpu_userq_wait_ioctl Use the existing helper instead of multiplying the size. Signed-off-by: Tvrtko Ursulin Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher --- diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c index 8013260e29dca..506aaae0f897e 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c @@ -679,23 +679,24 @@ int amdgpu_userq_wait_ioctl(struct drm_device *dev, void *data, } num_syncobj = wait_info->num_syncobj_handles; - syncobj_handles = memdup_user(u64_to_user_ptr(wait_info->syncobj_handles), - size_mul(sizeof(u32), num_syncobj)); + syncobj_handles = memdup_array_user(u64_to_user_ptr(wait_info->syncobj_handles), + num_syncobj, sizeof(u32)); if (IS_ERR(syncobj_handles)) { r = PTR_ERR(syncobj_handles); goto free_bo_handles_write; } num_points = wait_info->num_syncobj_timeline_handles; - timeline_handles = memdup_user(u64_to_user_ptr(wait_info->syncobj_timeline_handles), - sizeof(u32) * num_points); + timeline_handles = memdup_array_user(u64_to_user_ptr(wait_info->syncobj_timeline_handles), + num_points, sizeof(u32)); if (IS_ERR(timeline_handles)) { r = PTR_ERR(timeline_handles); goto free_syncobj_handles; } - timeline_points = memdup_user(u64_to_user_ptr(wait_info->syncobj_timeline_points), - sizeof(u32) * num_points); + timeline_points = memdup_array_user(u64_to_user_ptr(wait_info->syncobj_timeline_points), + num_points, sizeof(u32)); + if (IS_ERR(timeline_points)) { r = PTR_ERR(timeline_points); goto free_timeline_handles;