@@ -178,25 +178,17 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
178178 struct amdgpu_fpriv * fpriv = p -> filp -> driver_priv ;
179179 unsigned int num_ibs [AMDGPU_CS_GANG_SIZE ] = { };
180180 struct amdgpu_vm * vm = & fpriv -> vm ;
181- uint64_t * chunk_array_user ;
182181 uint64_t * chunk_array ;
183182 uint32_t uf_offset = 0 ;
184183 size_t size ;
185184 int ret ;
186185 int i ;
187186
188- chunk_array = kvmalloc_array (cs -> in .num_chunks , sizeof (uint64_t ),
189- GFP_KERNEL );
190- if (!chunk_array )
191- return - ENOMEM ;
192-
193- /* get chunks */
194- chunk_array_user = u64_to_user_ptr (cs -> in .chunks );
195- if (copy_from_user (chunk_array , chunk_array_user ,
196- sizeof (uint64_t )* cs -> in .num_chunks )) {
197- ret = - EFAULT ;
198- goto free_chunk ;
199- }
187+ chunk_array = memdup_array_user (u64_to_user_ptr (cs -> in .chunks ),
188+ cs -> in .num_chunks ,
189+ sizeof (uint64_t ));
190+ if (IS_ERR (chunk_array ))
191+ return PTR_ERR (chunk_array );
200192
201193 p -> nchunks = cs -> in .num_chunks ;
202194 p -> chunks = kvmalloc_array (p -> nchunks , sizeof (struct amdgpu_cs_chunk ),
@@ -209,7 +201,6 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
209201 for (i = 0 ; i < p -> nchunks ; i ++ ) {
210202 struct drm_amdgpu_cs_chunk __user * chunk_ptr = NULL ;
211203 struct drm_amdgpu_cs_chunk user_chunk ;
212- uint32_t __user * cdata ;
213204
214205 chunk_ptr = u64_to_user_ptr (chunk_array [i ]);
215206 if (copy_from_user (& user_chunk , chunk_ptr ,
@@ -222,20 +213,16 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
222213 p -> chunks [i ].length_dw = user_chunk .length_dw ;
223214
224215 size = p -> chunks [i ].length_dw ;
225- cdata = u64_to_user_ptr (user_chunk .chunk_data );
226216
227- p -> chunks [i ].kdata = kvmalloc_array (size , sizeof (uint32_t ),
228- GFP_KERNEL );
229- if (p -> chunks [i ].kdata == NULL ) {
230- ret = - ENOMEM ;
217+ p -> chunks [i ].kdata = vmemdup_array_user (u64_to_user_ptr (user_chunk .chunk_data ),
218+ size ,
219+ sizeof (uint32_t ));
220+ if (IS_ERR (p -> chunks [i ].kdata )) {
221+ ret = PTR_ERR (p -> chunks [i ].kdata );
231222 i -- ;
232223 goto free_partial_kdata ;
233224 }
234225 size *= sizeof (uint32_t );
235- if (copy_from_user (p -> chunks [i ].kdata , cdata , size )) {
236- ret = - EFAULT ;
237- goto free_partial_kdata ;
238- }
239226
240227 /* Assume the worst on the following checks */
241228 ret = - EINVAL ;
@@ -286,7 +273,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
286273 }
287274 }
288275
289- if (!p -> gang_size ) {
276+ if (!p -> gang_size || ( amdgpu_sriov_vf ( p -> adev ) && p -> gang_size > 1 ) ) {
290277 ret = - EINVAL ;
291278 goto free_all_kdata ;
292279 }
@@ -1767,30 +1754,21 @@ int amdgpu_cs_wait_fences_ioctl(struct drm_device *dev, void *data,
17671754{
17681755 struct amdgpu_device * adev = drm_to_adev (dev );
17691756 union drm_amdgpu_wait_fences * wait = data ;
1770- uint32_t fence_count = wait -> in .fence_count ;
1771- struct drm_amdgpu_fence * fences_user ;
17721757 struct drm_amdgpu_fence * fences ;
17731758 int r ;
17741759
17751760 /* Get the fences from userspace */
1776- fences = kmalloc_array (fence_count , sizeof (struct drm_amdgpu_fence ),
1777- GFP_KERNEL );
1778- if (fences == NULL )
1779- return - ENOMEM ;
1780-
1781- fences_user = u64_to_user_ptr (wait -> in .fences );
1782- if (copy_from_user (fences , fences_user ,
1783- sizeof (struct drm_amdgpu_fence ) * fence_count )) {
1784- r = - EFAULT ;
1785- goto err_free_fences ;
1786- }
1761+ fences = memdup_array_user (u64_to_user_ptr (wait -> in .fences ),
1762+ wait -> in .fence_count ,
1763+ sizeof (struct drm_amdgpu_fence ));
1764+ if (IS_ERR (fences ))
1765+ return PTR_ERR (fences );
17871766
17881767 if (wait -> in .wait_all )
17891768 r = amdgpu_cs_wait_all_fences (adev , filp , wait , fences );
17901769 else
17911770 r = amdgpu_cs_wait_any_fence (adev , filp , wait , fences );
17921771
1793- err_free_fences :
17941772 kfree (fences );
17951773
17961774 return r ;
0 commit comments