[PATCH 59/74] fast-sw-finish-ioctl

[Chris Wilson]

---
 drivers/gpu/drm/i915/i915_drv.c |  2 +-
 drivers/gpu/drm/i915/i915_drv.h |  5 +++--
 drivers/gpu/drm/i915/i915_gem.c | 25 +++++++++++++++++++------
 3 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 3ea943917db0..feb778c998cf 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -2656,7 +2656,7 @@ static const struct drm_ioctl_desc i915_ioctls[] = {
 	DRM_IOCTL_DEF_DRV(I915_GEM_MMAP, i915_gem_mmap_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_GEM_MMAP_GTT, i915_gem_mmap_gtt_ioctl, DRM_RENDER_ALLOW),
 	DRM_DRIVER_IOCTL_DEF(I915_GEM_SET_DOMAIN, i915_gem_set_domain_ioctl, DRM_RENDER_ALLOW),
-	DRM_IOCTL_DEF_DRV(I915_GEM_SW_FINISH, i915_gem_sw_finish_ioctl, DRM_RENDER_ALLOW),
+	DRM_DRIVER_IOCTL_DEF(I915_GEM_SW_FINISH, i915_gem_sw_finish_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_GEM_SET_TILING, i915_gem_set_tiling_ioctl, DRM_RENDER_ALLOW),
 	DRM_DRIVER_IOCTL_DEF(I915_GEM_GET_TILING, i915_gem_get_tiling_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_GEM_GET_APERTURE, i915_gem_get_aperture_ioctl, DRM_RENDER_ALLOW),
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index c2f56d3700c6..21df62ed83d7 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -3253,8 +3253,9 @@ int i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
 long i915_gem_set_domain_ioctl(struct file *filp,
 			       unsigned int cmd,
 			       unsigned long data);
-int i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
-			     struct drm_file *file_priv);
+long i915_gem_sw_finish_ioctl(struct file *filp,
+			      unsigned int cmd,
+			      unsigned long data);
 int i915_gem_execbuffer(struct drm_device *dev, void *data,
 			struct drm_file *file_priv);
 int i915_gem_execbuffer2(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index c0e8d333dafe..8f014961e1a3 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1710,15 +1710,24 @@ i915_gem_set_domain_ioctl(struct file *filp,
  * @data: ioctl data blob
  * @file: drm file
  */
-int
-i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
-			 struct drm_file *file)
+long
+i915_gem_sw_finish_ioctl(struct file *filp,
+			 unsigned int cmd,
+			 unsigned long data)
 {
-	struct drm_i915_gem_sw_finish *args = data;
+	struct drm_i915_gem_sw_finish __user *user = (typeof(user))data;
 	struct drm_i915_gem_object *obj;
+	u32 handle;
 
-	obj = i915_gem_object_lookup(file, args->handle);
-	if (!obj)
+	if (unlikely(!access_ok(VERIFY_READ, user, sizeof(*user))))
+		return -EFAULT;
+
+	user_access_begin();
+	unsafe_get_user(handle, &user->handle, err_user);
+	user_access_end();
+
+	obj = i915_gem_object_lookup(filp->private_data, handle);
+	if (unlikely(!obj))
 		return -ENOENT;
 
 	/* Pinned buffers may be scanout, so flush the cache */
@@ -1726,6 +1735,10 @@ i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
 	i915_gem_object_put(obj);
 
 	return 0;
+
+err_user:
+	user_access_end();
+	return -EFAULT;
 }
 
 /**
-- 
2.13.2