eb_copy_relocations() only do unsafe_put_user(), it only requires write access to user.
Use user_write_access_begin() instead of user_access_begin().
Signed-off-by: Christophe Leroy christophe.leroy@csgroup.eu --- Resending with mm list in addition
drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c index 5964e67c7d36..f7a7bb45274b 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c @@ -1907,14 +1907,14 @@ static int eb_copy_relocations(const struct i915_execbuffer *eb) * happened we would make the mistake of assuming that the * relocations were valid. */ - if (!user_access_begin(urelocs, size)) + if (!user_write_access_begin(urelocs, size)) goto end;
for (copied = 0; copied < nreloc; copied++) unsafe_put_user(-1, &urelocs[copied].presumed_offset, end_user); - user_access_end(); + user_write_access_end();
eb->exec[i].relocs_ptr = (uintptr_t)relocs; } @@ -1922,7 +1922,7 @@ static int eb_copy_relocations(const struct i915_execbuffer *eb) return 0;
end_user: - user_access_end(); + user_write_access_end(); end: kvfree(relocs); err = -EFAULT;