[PATCH 70/74] fast-sw-finish-ioctl

[Chris Wilson]

---
 drivers/gpu/drm/i915/i915_drv.c |  2 +-
 drivers/gpu/drm/i915/i915_drv.h |  5 +++--
 drivers/gpu/drm/i915/i915_gem.c | 25 +++++++++++++++++++------
 3 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 77d6bb895289..944f933f0e58 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -2665,7 +2665,7 @@ static const struct drm_ioctl_desc i915_ioctls[] = {
 	DRM_IOCTL_DEF_DRV(I915_GEM_MMAP, i915_gem_mmap_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_GEM_MMAP_GTT, i915_gem_mmap_gtt_ioctl, DRM_RENDER_ALLOW),
 	DRM_DRIVER_IOCTL_DEF(I915_GEM_SET_DOMAIN, i915_gem_set_domain_ioctl, DRM_RENDER_ALLOW),
-	DRM_IOCTL_DEF_DRV(I915_GEM_SW_FINISH, i915_gem_sw_finish_ioctl, DRM_RENDER_ALLOW),
+	DRM_DRIVER_IOCTL_DEF(I915_GEM_SW_FINISH, i915_gem_sw_finish_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_GEM_SET_TILING, i915_gem_set_tiling_ioctl, DRM_RENDER_ALLOW),
 	DRM_DRIVER_IOCTL_DEF(I915_GEM_GET_TILING, i915_gem_get_tiling_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(I915_GEM_GET_APERTURE, i915_gem_get_aperture_ioctl, DRM_RENDER_ALLOW),
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 15a566aaab49..030bc6937b0c 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -3410,8 +3410,9 @@ int i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
 long i915_gem_set_domain_ioctl(struct file *filp,
 			       unsigned int cmd,
 			       unsigned long data);
-int i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
-			     struct drm_file *file_priv);
+long i915_gem_sw_finish_ioctl(struct file *filp,
+			      unsigned int cmd,
+			      unsigned long data);
 int i915_gem_execbuffer(struct drm_device *dev, void *data,
 			struct drm_file *file_priv);
 int i915_gem_execbuffer2(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 295de06af22b..2e7ba0b5b719 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1681,15 +1681,24 @@ i915_gem_set_domain_ioctl(struct file *filp,
  * @data: ioctl data blob
  * @file: drm file
  */
-int
-i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
-			 struct drm_file *file)
+long
+i915_gem_sw_finish_ioctl(struct file *filp,
+			 unsigned int cmd,
+			 unsigned long data)
 {
-	struct drm_i915_gem_sw_finish *args = data;
+	struct drm_i915_gem_sw_finish __user *user = (typeof(user))data;
 	struct drm_i915_gem_object *obj;
+	u32 handle;
 
-	obj = i915_gem_object_lookup(file, args->handle);
-	if (!obj)
+	if (unlikely(!access_ok(VERIFY_READ, user, sizeof(*user))))
+		return -EFAULT;
+
+	user_access_begin();
+	unsafe_get_user(handle, &user->handle, err_user);
+	user_access_end();
+
+	obj = i915_gem_object_lookup(filp->private_data, handle);
+	if (unlikely(!obj))
 		return -ENOENT;
 
 	/* Pinned buffers may be scanout, so flush the cache */
@@ -1697,6 +1706,10 @@ i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
 	i915_gem_object_put(obj);
 
 	return 0;
+
+err_user:
+	user_access_end();
+	return -EFAULT;
 }
 
 /**
-- 
2.14.1