diff options
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/i915/i915_debugfs.c | 13 | ||||
| -rw-r--r-- | drivers/gpu/drm/i915/intel_pipe_crc.c | 13 |
2 files changed, 6 insertions, 20 deletions
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c index 870c470177b5..1003511f28cc 100644 --- a/drivers/gpu/drm/i915/i915_debugfs.c +++ b/drivers/gpu/drm/i915/i915_debugfs.c @@ -3702,16 +3702,10 @@ static ssize_t i915_displayport_test_active_write(struct file *file, if (len == 0) return 0; - input_buffer = kmalloc(len + 1, GFP_KERNEL); - if (!input_buffer) - return -ENOMEM; + input_buffer = memdup_user_nul(ubuf, len); + if (IS_ERR(input_buffer)) + return PTR_ERR(input_buffer); - if (copy_from_user(input_buffer, ubuf, len)) { - status = -EFAULT; - goto out; - } - - input_buffer[len] = '\0'; DRM_DEBUG_DRIVER("Copied %d bytes from user\n", (unsigned int)len); drm_connector_list_iter_begin(dev, &conn_iter); @@ -3737,7 +3731,6 @@ static ssize_t i915_displayport_test_active_write(struct file *file, } } drm_connector_list_iter_end(&conn_iter); -out: kfree(input_buffer); if (status < 0) return status; diff --git a/drivers/gpu/drm/i915/intel_pipe_crc.c b/drivers/gpu/drm/i915/intel_pipe_crc.c index 647426c75b0a..8fbd2bd0877f 100644 --- a/drivers/gpu/drm/i915/intel_pipe_crc.c +++ b/drivers/gpu/drm/i915/intel_pipe_crc.c @@ -853,19 +853,12 @@ static ssize_t display_crc_ctl_write(struct file *file, const char __user *ubuf, return -E2BIG; } - tmpbuf = kmalloc(len + 1, GFP_KERNEL); - if (!tmpbuf) - return -ENOMEM; - - if (copy_from_user(tmpbuf, ubuf, len)) { - ret = -EFAULT; - goto out; - } - tmpbuf[len] = '\0'; + tmpbuf = memdup_user_nul(ubuf, len); + if (IS_ERR(tmpbuf)) + return PTR_ERR(tmpbuf); ret = display_crc_ctl_parse(dev_priv, tmpbuf, len); -out: kfree(tmpbuf); if (ret < 0) return ret; |