Commit cb77b79a authored by Tvrtko Ursulin's avatar Tvrtko Ursulin Committed by Tvrtko Ursulin
Browse files

drm/gem: Use vmemdup_array_user in drm_gem_objects_lookup 



Use a helper to shrink the code and separate the user and kernel slabs for
better security.

While at it lets remove the useless debug message.

Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@igalia.com>
Reviewed-by: default avatarAndré Almeida <andrealmeid@igalia.com>
Signed-off-by: default avatarTvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20251112092732.23584-1-tvrtko.ursulin@igalia.com
parent 04c7adb5

drivers/gpu/drm/drm_gem.c

+3 −10
Original line number Diff line number Diff line
@@ -783,7 +783,6 @@ static int objects_lookup(struct drm_file *filp, u32 *handle, int count, 
int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles,

			   int count, struct drm_gem_object ***objs_out)

{

	struct drm_device *dev = filp->minor->dev;

	struct drm_gem_object **objs;

	u32 *handles;

	int ret;
@@ -798,15 +797,9 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles, 


	*objs_out = objs;



	handles = kvmalloc_array(count, sizeof(u32), GFP_KERNEL);

	if (!handles) {

		ret = -ENOMEM;

		goto out;

	}



	if (copy_from_user(handles, bo_handles, count * sizeof(u32))) {

		ret = -EFAULT;

		drm_dbg_core(dev, "Failed to copy in GEM handles\n");

	handles = vmemdup_array_user(bo_handles, count, sizeof(u32));

	if (IS_ERR(handles)) {

		ret = PTR_ERR(handles);

		goto out;

	}