提交 35b62a89 编写于 作者: C Chris Wilson

drm/i915: Skip pread/pwrite if size to copy is 0.

Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
上级 df6d075a
...@@ -576,7 +576,7 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data, ...@@ -576,7 +576,7 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
struct drm_i915_gem_pread *args = data; struct drm_i915_gem_pread *args = data;
struct drm_gem_object *obj; struct drm_gem_object *obj;
struct drm_i915_gem_object *obj_priv; struct drm_i915_gem_object *obj_priv;
int ret; int ret = 0;
obj = drm_gem_object_lookup(dev, file_priv, args->handle); obj = drm_gem_object_lookup(dev, file_priv, args->handle);
if (obj == NULL) if (obj == NULL)
...@@ -586,14 +586,17 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data, ...@@ -586,14 +586,17 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
/* Bounds check source. */ /* Bounds check source. */
if (args->offset > obj->size || args->size > obj->size - args->offset) { if (args->offset > obj->size || args->size > obj->size - args->offset) {
ret = -EINVAL; ret = -EINVAL;
goto err; goto out;
} }
if (args->size == 0)
goto out;
if (!access_ok(VERIFY_WRITE, if (!access_ok(VERIFY_WRITE,
(char __user *)(uintptr_t)args->data_ptr, (char __user *)(uintptr_t)args->data_ptr,
args->size)) { args->size)) {
ret = -EFAULT; ret = -EFAULT;
goto err; goto out;
} }
if (i915_gem_object_needs_bit17_swizzle(obj)) { if (i915_gem_object_needs_bit17_swizzle(obj)) {
...@@ -605,7 +608,7 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data, ...@@ -605,7 +608,7 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
file_priv); file_priv);
} }
err: out:
drm_gem_object_unreference_unlocked(obj); drm_gem_object_unreference_unlocked(obj);
return ret; return ret;
} }
...@@ -1059,14 +1062,17 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data, ...@@ -1059,14 +1062,17 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
/* Bounds check destination. */ /* Bounds check destination. */
if (args->offset > obj->size || args->size > obj->size - args->offset) { if (args->offset > obj->size || args->size > obj->size - args->offset) {
ret = -EINVAL; ret = -EINVAL;
goto err; goto out;
} }
if (args->size == 0)
goto out;
if (!access_ok(VERIFY_READ, if (!access_ok(VERIFY_READ,
(char __user *)(uintptr_t)args->data_ptr, (char __user *)(uintptr_t)args->data_ptr,
args->size)) { args->size)) {
ret = -EFAULT; ret = -EFAULT;
goto err; goto out;
} }
/* We can only do the GTT pwrite on untiled buffers, as otherwise /* We can only do the GTT pwrite on untiled buffers, as otherwise
...@@ -1100,7 +1106,7 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data, ...@@ -1100,7 +1106,7 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
DRM_INFO("pwrite failed %d\n", ret); DRM_INFO("pwrite failed %d\n", ret);
#endif #endif
err: out:
drm_gem_object_unreference_unlocked(obj); drm_gem_object_unreference_unlocked(obj);
return ret; return ret;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册