From 9f43e542a4e3bee069da939a151292fc5526e48f Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 24 May 2017 13:59:22 -0400
Subject: drm_compat_ioctl(): prepare for conversions to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 81 ++++++++++++++++++++++++++-------------------
 1 file changed, 47 insertions(+), 34 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index ae386783e3ea..3543639c48f3 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -1073,40 +1073,43 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
 }
 #endif
 
-static drm_ioctl_compat_t *drm_compat_ioctls[] = {
-	[DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
-	[DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique,
-	[DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)] = compat_drm_getmap,
-	[DRM_IOCTL_NR(DRM_IOCTL_GET_CLIENT32)] = compat_drm_getclient,
-	[DRM_IOCTL_NR(DRM_IOCTL_GET_STATS32)] = compat_drm_getstats,
-	[DRM_IOCTL_NR(DRM_IOCTL_SET_UNIQUE32)] = compat_drm_setunique,
-	[DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP32)] = compat_drm_addmap,
-	[DRM_IOCTL_NR(DRM_IOCTL_ADD_BUFS32)] = compat_drm_addbufs,
-	[DRM_IOCTL_NR(DRM_IOCTL_MARK_BUFS32)] = compat_drm_markbufs,
-	[DRM_IOCTL_NR(DRM_IOCTL_INFO_BUFS32)] = compat_drm_infobufs,
-	[DRM_IOCTL_NR(DRM_IOCTL_MAP_BUFS32)] = compat_drm_mapbufs,
-	[DRM_IOCTL_NR(DRM_IOCTL_FREE_BUFS32)] = compat_drm_freebufs,
-	[DRM_IOCTL_NR(DRM_IOCTL_RM_MAP32)] = compat_drm_rmmap,
-	[DRM_IOCTL_NR(DRM_IOCTL_SET_SAREA_CTX32)] = compat_drm_setsareactx,
-	[DRM_IOCTL_NR(DRM_IOCTL_GET_SAREA_CTX32)] = compat_drm_getsareactx,
-	[DRM_IOCTL_NR(DRM_IOCTL_RES_CTX32)] = compat_drm_resctx,
-	[DRM_IOCTL_NR(DRM_IOCTL_DMA32)] = compat_drm_dma,
+static struct {
+	drm_ioctl_compat_t *fn;
+	char *name;
+} drm_compat_ioctls[] = {
+	[DRM_IOCTL_NR(DRM_IOCTL_VERSION32)].fn = compat_drm_version,
+	[DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)].fn = compat_drm_getunique,
+	[DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)].fn = compat_drm_getmap,
+	[DRM_IOCTL_NR(DRM_IOCTL_GET_CLIENT32)].fn = compat_drm_getclient,
+	[DRM_IOCTL_NR(DRM_IOCTL_GET_STATS32)].fn = compat_drm_getstats,
+	[DRM_IOCTL_NR(DRM_IOCTL_SET_UNIQUE32)].fn = compat_drm_setunique,
+	[DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP32)].fn = compat_drm_addmap,
+	[DRM_IOCTL_NR(DRM_IOCTL_ADD_BUFS32)].fn = compat_drm_addbufs,
+	[DRM_IOCTL_NR(DRM_IOCTL_MARK_BUFS32)].fn = compat_drm_markbufs,
+	[DRM_IOCTL_NR(DRM_IOCTL_INFO_BUFS32)].fn = compat_drm_infobufs,
+	[DRM_IOCTL_NR(DRM_IOCTL_MAP_BUFS32)].fn = compat_drm_mapbufs,
+	[DRM_IOCTL_NR(DRM_IOCTL_FREE_BUFS32)].fn = compat_drm_freebufs,
+	[DRM_IOCTL_NR(DRM_IOCTL_RM_MAP32)].fn = compat_drm_rmmap,
+	[DRM_IOCTL_NR(DRM_IOCTL_SET_SAREA_CTX32)].fn = compat_drm_setsareactx,
+	[DRM_IOCTL_NR(DRM_IOCTL_GET_SAREA_CTX32)].fn = compat_drm_getsareactx,
+	[DRM_IOCTL_NR(DRM_IOCTL_RES_CTX32)].fn = compat_drm_resctx,
+	[DRM_IOCTL_NR(DRM_IOCTL_DMA32)].fn = compat_drm_dma,
 #if IS_ENABLED(CONFIG_AGP)
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ENABLE32)] = compat_drm_agp_enable,
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_INFO32)] = compat_drm_agp_info,
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ALLOC32)] = compat_drm_agp_alloc,
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_FREE32)] = compat_drm_agp_free,
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_BIND32)] = compat_drm_agp_bind,
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_UNBIND32)] = compat_drm_agp_unbind,
+	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ENABLE32)].fn = compat_drm_agp_enable,
+	[DRM_IOCTL_NR(DRM_IOCTL_AGP_INFO32)].fn = compat_drm_agp_info,
+	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ALLOC32)].fn = compat_drm_agp_alloc,
+	[DRM_IOCTL_NR(DRM_IOCTL_AGP_FREE32)].fn = compat_drm_agp_free,
+	[DRM_IOCTL_NR(DRM_IOCTL_AGP_BIND32)].fn = compat_drm_agp_bind,
+	[DRM_IOCTL_NR(DRM_IOCTL_AGP_UNBIND32)].fn = compat_drm_agp_unbind,
 #endif
-	[DRM_IOCTL_NR(DRM_IOCTL_SG_ALLOC32)] = compat_drm_sg_alloc,
-	[DRM_IOCTL_NR(DRM_IOCTL_SG_FREE32)] = compat_drm_sg_free,
+	[DRM_IOCTL_NR(DRM_IOCTL_SG_ALLOC32)].fn = compat_drm_sg_alloc,
+	[DRM_IOCTL_NR(DRM_IOCTL_SG_FREE32)].fn = compat_drm_sg_free,
 #if defined(CONFIG_X86) || defined(CONFIG_IA64)
-	[DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)] = compat_drm_update_draw,
+	[DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)].fn = compat_drm_update_draw,
 #endif
-	[DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)] = compat_drm_wait_vblank,
+	[DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)].fn = compat_drm_wait_vblank,
 #if defined(CONFIG_X86) || defined(CONFIG_IA64)
-	[DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)] = compat_drm_mode_addfb2,
+	[DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)].fn = compat_drm_mode_addfb2,
 #endif
 };
 
@@ -1137,13 +1140,23 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	if (nr >= ARRAY_SIZE(drm_compat_ioctls))
 		return drm_ioctl(filp, cmd, arg);
 
-	fn = drm_compat_ioctls[nr];
+	fn = drm_compat_ioctls[nr].fn;
+	if (!fn)
+		return drm_ioctl(filp, cmd, arg);
 
-	if (fn != NULL)
+	if (drm_compat_ioctls[nr].name) {
+		struct drm_file *file_priv = filp->private_data;
+		DRM_DEBUG("pid=%d, dev=0x%lx, auth=%d, %s\n",
+			  task_pid_nr(current),
+			  (long)old_encode_dev(file_priv->minor->kdev->devt),
+			  file_priv->authenticated,
+			  drm_compat_ioctls[nr].name);
 		ret = (*fn) (filp, cmd, arg);
-	else
-		ret = drm_ioctl(filp, cmd, arg);
-
+		if (ret)
+			DRM_DEBUG("ret = %d\n", ret);
+	} else {
+		ret = (*fn) (filp, cmd, arg);
+	}
 	return ret;
 }
 EXPORT_SYMBOL(drm_compat_ioctl);
-- 
cgit v1.2.3


From ff22ff9e734a9cc165adddcd59f93a1c450a01ce Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 24 May 2017 13:42:27 -0400
Subject: switch compat_drm_addbufs() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 3543639c48f3..e06289dbab44 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -32,6 +32,7 @@
 #include <linux/export.h>
 
 #include <drm/drmP.h>
+#include "drm_legacy.h"
 
 #define DRM_IOCTL_VERSION32		DRM_IOWR(0x00, drm_version32_t)
 #define DRM_IOCTL_GET_UNIQUE32		DRM_IOWR(0x01, drm_unique32_t)
@@ -378,26 +379,28 @@ static int compat_drm_addbufs(struct file *file, unsigned int cmd,
 			      unsigned long arg)
 {
 	drm_buf_desc32_t __user *argp = (void __user *)arg;
-	struct drm_buf_desc __user *buf;
+	drm_buf_desc32_t desc32;
+	struct drm_buf_desc desc;
 	int err;
-	unsigned long agp_start;
 
-	buf = compat_alloc_user_space(sizeof(*buf));
-	if (!buf || !access_ok(VERIFY_WRITE, argp, sizeof(*argp)))
+	if (copy_from_user(&desc32, argp, sizeof(drm_buf_desc32_t)))
 		return -EFAULT;
 
-	if (__copy_in_user(buf, argp, offsetof(drm_buf_desc32_t, agp_start))
-	    || __get_user(agp_start, &argp->agp_start)
-	    || __put_user(agp_start, &buf->agp_start))
-		return -EFAULT;
+	desc = (struct drm_buf_desc){
+		desc32.count, desc32.size, desc32.low_mark, desc32.high_mark,
+		desc32.flags, desc32.agp_start
+	};
 
-	err = drm_ioctl(file, DRM_IOCTL_ADD_BUFS, (unsigned long)buf);
+	err = drm_ioctl_kernel(file, drm_legacy_addbufs, &desc,
+				   DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 	if (err)
 		return err;
 
-	if (__copy_in_user(argp, buf, offsetof(drm_buf_desc32_t, agp_start))
-	    || __get_user(agp_start, &buf->agp_start)
-	    || __put_user(agp_start, &argp->agp_start))
+	desc32 = (drm_buf_desc32_t){
+		desc.count, desc.size, desc.low_mark, desc.high_mark,
+		desc.flags, desc.agp_start
+	};
+	if (copy_to_user(argp, &desc32, sizeof(drm_buf_desc32_t)))
 		return -EFAULT;
 
 	return 0;
@@ -1077,6 +1080,7 @@ static struct {
 	drm_ioctl_compat_t *fn;
 	char *name;
 } drm_compat_ioctls[] = {
+#define DRM_IOCTL32_DEF(n, f) [DRM_IOCTL_NR(n##32)] = {.fn = f, .name = #n}
 	[DRM_IOCTL_NR(DRM_IOCTL_VERSION32)].fn = compat_drm_version,
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)].fn = compat_drm_getunique,
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)].fn = compat_drm_getmap,
@@ -1084,7 +1088,7 @@ static struct {
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_STATS32)].fn = compat_drm_getstats,
 	[DRM_IOCTL_NR(DRM_IOCTL_SET_UNIQUE32)].fn = compat_drm_setunique,
 	[DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP32)].fn = compat_drm_addmap,
-	[DRM_IOCTL_NR(DRM_IOCTL_ADD_BUFS32)].fn = compat_drm_addbufs,
+	DRM_IOCTL32_DEF(DRM_IOCTL_ADD_BUFS, compat_drm_addbufs),
 	[DRM_IOCTL_NR(DRM_IOCTL_MARK_BUFS32)].fn = compat_drm_markbufs,
 	[DRM_IOCTL_NR(DRM_IOCTL_INFO_BUFS32)].fn = compat_drm_infobufs,
 	[DRM_IOCTL_NR(DRM_IOCTL_MAP_BUFS32)].fn = compat_drm_mapbufs,
-- 
cgit v1.2.3


From 012c6741c6aa916e276a0dd2f1c0020041540206 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 24 May 2017 14:11:03 -0400
Subject: switch compat_drm_version() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 42 ++++++++++++++++--------------------------
 1 file changed, 16 insertions(+), 26 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index e06289dbab44..db1db77f23da 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -33,6 +33,7 @@
 
 #include <drm/drmP.h>
 #include "drm_legacy.h"
+#include "drm_internal.h"
 
 #define DRM_IOCTL_VERSION32		DRM_IOWR(0x00, drm_version32_t)
 #define DRM_IOCTL_GET_UNIQUE32		DRM_IOWR(0x01, drm_unique32_t)
@@ -88,39 +89,28 @@ static int compat_drm_version(struct file *file, unsigned int cmd,
 			      unsigned long arg)
 {
 	drm_version32_t v32;
-	struct drm_version __user *version;
+	struct drm_version v;
 	int err;
 
 	if (copy_from_user(&v32, (void __user *)arg, sizeof(v32)))
 		return -EFAULT;
 
-	version = compat_alloc_user_space(sizeof(*version));
-	if (!version)
-		return -EFAULT;
-	if (__put_user(v32.name_len, &version->name_len)
-	    || __put_user((void __user *)(unsigned long)v32.name,
-			  &version->name)
-	    || __put_user(v32.date_len, &version->date_len)
-	    || __put_user((void __user *)(unsigned long)v32.date,
-			  &version->date)
-	    || __put_user(v32.desc_len, &version->desc_len)
-	    || __put_user((void __user *)(unsigned long)v32.desc,
-			  &version->desc))
-		return -EFAULT;
-
-	err = drm_ioctl(file,
-			DRM_IOCTL_VERSION, (unsigned long)version);
+	v = (struct drm_version) {
+		.name_len = v32.name_len,
+		.name = compat_ptr(v32.name),
+		.date_len = v32.date_len,
+		.date = compat_ptr(v32.date),
+		.desc_len = v32.desc_len,
+		.desc = compat_ptr(v32.desc),
+	};
+	err = drm_ioctl_kernel(file, drm_version, &v,
+			DRM_UNLOCKED|DRM_RENDER_ALLOW|DRM_CONTROL_ALLOW);
 	if (err)
 		return err;
 
-	if (__get_user(v32.version_major, &version->version_major)
-	    || __get_user(v32.version_minor, &version->version_minor)
-	    || __get_user(v32.version_patchlevel, &version->version_patchlevel)
-	    || __get_user(v32.name_len, &version->name_len)
-	    || __get_user(v32.date_len, &version->date_len)
-	    || __get_user(v32.desc_len, &version->desc_len))
-		return -EFAULT;
-
+	v32.version_major = v.version_major;
+	v32.version_minor = v.version_minor;
+	v32.version_patchlevel = v.version_patchlevel;
 	if (copy_to_user((void __user *)arg, &v32, sizeof(v32)))
 		return -EFAULT;
 	return 0;
@@ -1081,7 +1071,7 @@ static struct {
 	char *name;
 } drm_compat_ioctls[] = {
 #define DRM_IOCTL32_DEF(n, f) [DRM_IOCTL_NR(n##32)] = {.fn = f, .name = #n}
-	[DRM_IOCTL_NR(DRM_IOCTL_VERSION32)].fn = compat_drm_version,
+	DRM_IOCTL32_DEF(DRM_IOCTL_VERSION, compat_drm_version),
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)].fn = compat_drm_getunique,
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)].fn = compat_drm_getmap,
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_CLIENT32)].fn = compat_drm_getclient,
-- 
cgit v1.2.3


From 17e3dade62d6e95131ceba1535eb8d2e84b2e040 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 24 May 2017 14:15:20 -0400
Subject: switch compat_drm_getunique() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 21 ++++++++-------------
 1 file changed, 8 insertions(+), 13 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index db1db77f23da..e07ade98c29b 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -125,26 +125,21 @@ static int compat_drm_getunique(struct file *file, unsigned int cmd,
 				unsigned long arg)
 {
 	drm_unique32_t uq32;
-	struct drm_unique __user *u;
+	struct drm_unique uq;
 	int err;
 
 	if (copy_from_user(&uq32, (void __user *)arg, sizeof(uq32)))
 		return -EFAULT;
+	uq = (struct drm_unique){
+		.unique_len = uq32.unique_len,
+		.unique = compat_ptr(uq32.unique),
+	};
 
-	u = compat_alloc_user_space(sizeof(*u));
-	if (!u)
-		return -EFAULT;
-	if (__put_user(uq32.unique_len, &u->unique_len)
-	    || __put_user((void __user *)(unsigned long)uq32.unique,
-			  &u->unique))
-		return -EFAULT;
-
-	err = drm_ioctl(file, DRM_IOCTL_GET_UNIQUE, (unsigned long)u);
+	err = drm_ioctl_kernel(file, drm_getunique, &uq, DRM_UNLOCKED);
 	if (err)
 		return err;
 
-	if (__get_user(uq32.unique_len, &u->unique_len))
-		return -EFAULT;
+	uq32.unique_len = uq.unique_len;
 	if (copy_to_user((void __user *)arg, &uq32, sizeof(uq32)))
 		return -EFAULT;
 	return 0;
@@ -1072,7 +1067,7 @@ static struct {
 } drm_compat_ioctls[] = {
 #define DRM_IOCTL32_DEF(n, f) [DRM_IOCTL_NR(n##32)] = {.fn = f, .name = #n}
 	DRM_IOCTL32_DEF(DRM_IOCTL_VERSION, compat_drm_version),
-	[DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)].fn = compat_drm_getunique,
+	DRM_IOCTL32_DEF(DRM_IOCTL_GET_UNIQUE, compat_drm_getunique),
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)].fn = compat_drm_getmap,
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_CLIENT32)].fn = compat_drm_getclient,
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_STATS32)].fn = compat_drm_getstats,
-- 
cgit v1.2.3


From 56c275ccfba8c992544a8ec46439f7d0ff21177f Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 24 May 2017 14:20:21 -0400
Subject: compat_drm_setunique(): don't bother

native equivalent would just fail with -EINVAL; do the same
directly.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index e07ade98c29b..da2377cd86c2 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -148,21 +148,8 @@ static int compat_drm_getunique(struct file *file, unsigned int cmd,
 static int compat_drm_setunique(struct file *file, unsigned int cmd,
 				unsigned long arg)
 {
-	drm_unique32_t uq32;
-	struct drm_unique __user *u;
-
-	if (copy_from_user(&uq32, (void __user *)arg, sizeof(uq32)))
-		return -EFAULT;
-
-	u = compat_alloc_user_space(sizeof(*u));
-	if (!u)
-		return -EFAULT;
-	if (__put_user(uq32.unique_len, &u->unique_len)
-	    || __put_user((void __user *)(unsigned long)uq32.unique,
-			  &u->unique))
-		return -EFAULT;
-
-	return drm_ioctl(file, DRM_IOCTL_SET_UNIQUE, (unsigned long)u);
+	/* it's dead */
+	return -EINVAL;
 }
 
 typedef struct drm_map32 {
@@ -1071,7 +1058,7 @@ static struct {
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)].fn = compat_drm_getmap,
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_CLIENT32)].fn = compat_drm_getclient,
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_STATS32)].fn = compat_drm_getstats,
-	[DRM_IOCTL_NR(DRM_IOCTL_SET_UNIQUE32)].fn = compat_drm_setunique,
+	DRM_IOCTL32_DEF(DRM_IOCTL_SET_UNIQUE, compat_drm_setunique),
 	[DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP32)].fn = compat_drm_addmap,
 	DRM_IOCTL32_DEF(DRM_IOCTL_ADD_BUFS, compat_drm_addbufs),
 	[DRM_IOCTL_NR(DRM_IOCTL_MARK_BUFS32)].fn = compat_drm_markbufs,
-- 
cgit v1.2.3


From 8c4fe499cabfec5a8fbbc2919ceaae31341f6921 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 24 May 2017 14:26:39 -0400
Subject: switch compat_drm_getmap() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 33 ++++++++++++---------------------
 1 file changed, 12 insertions(+), 21 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index da2377cd86c2..1d067f59952d 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -166,32 +166,23 @@ static int compat_drm_getmap(struct file *file, unsigned int cmd,
 {
 	drm_map32_t __user *argp = (void __user *)arg;
 	drm_map32_t m32;
-	struct drm_map __user *map;
-	int idx, err;
-	void *handle;
-
-	if (get_user(idx, &argp->offset))
-		return -EFAULT;
+	struct drm_map map;
+	int err;
 
-	map = compat_alloc_user_space(sizeof(*map));
-	if (!map)
-		return -EFAULT;
-	if (__put_user(idx, &map->offset))
+	if (copy_from_user(&m32, argp, sizeof(m32)))
 		return -EFAULT;
 
-	err = drm_ioctl(file, DRM_IOCTL_GET_MAP, (unsigned long)map);
+	map.offset = m32.offset;
+	err = drm_ioctl_kernel(file, drm_legacy_getmap_ioctl, &map, DRM_UNLOCKED);
 	if (err)
 		return err;
 
-	if (__get_user(m32.offset, &map->offset)
-	    || __get_user(m32.size, &map->size)
-	    || __get_user(m32.type, &map->type)
-	    || __get_user(m32.flags, &map->flags)
-	    || __get_user(handle, &map->handle)
-	    || __get_user(m32.mtrr, &map->mtrr))
-		return -EFAULT;
-
-	m32.handle = (unsigned long)handle;
+	m32.offset = map.offset;
+	m32.size = map.size;
+	m32.type = map.type;
+	m32.flags = map.flags;
+	m32.handle = ptr_to_compat(map.handle);
+	m32.mtrr = map.mtrr;
 	if (copy_to_user(argp, &m32, sizeof(m32)))
 		return -EFAULT;
 	return 0;
@@ -1055,7 +1046,7 @@ static struct {
 #define DRM_IOCTL32_DEF(n, f) [DRM_IOCTL_NR(n##32)] = {.fn = f, .name = #n}
 	DRM_IOCTL32_DEF(DRM_IOCTL_VERSION, compat_drm_version),
 	DRM_IOCTL32_DEF(DRM_IOCTL_GET_UNIQUE, compat_drm_getunique),
-	[DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)].fn = compat_drm_getmap,
+	DRM_IOCTL32_DEF(DRM_IOCTL_GET_MAP, compat_drm_getmap),
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_CLIENT32)].fn = compat_drm_getclient,
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_STATS32)].fn = compat_drm_getstats,
 	DRM_IOCTL32_DEF(DRM_IOCTL_SET_UNIQUE, compat_drm_setunique),
-- 
cgit v1.2.3


From 5c7640ab625829fd08b7fa0160c6fd188e70b5fe Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 24 May 2017 17:54:09 -0400
Subject: switch compat_drm_infobufs() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 58 +++++++++++++++++++--------------------------
 1 file changed, 24 insertions(+), 34 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 1d067f59952d..0be62f20e524 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -396,52 +396,42 @@ typedef struct drm_buf_info32 {
 	u32 list;
 } drm_buf_info32_t;
 
+static int copy_one_buf32(void *data, int count, struct drm_buf_entry *from)
+{
+	drm_buf_info32_t *request = data;
+	drm_buf_desc32_t __user *to = compat_ptr(request->list);
+	drm_buf_desc32_t v = {.count = from->buf_count,
+			      .size = from->buf_size,
+			      .low_mark = from->low_mark,
+			      .high_mark = from->high_mark};
+	return copy_to_user(to + count, &v, offsetof(drm_buf_desc32_t, flags));
+}
+
+static int drm_legacy_infobufs32(struct drm_device *dev, void *data,
+			struct drm_file *file_priv)
+{
+	drm_buf_info32_t *request = data;
+	return __drm_legacy_infobufs(dev, data, &request->count, copy_one_buf32);
+}
+
 static int compat_drm_infobufs(struct file *file, unsigned int cmd,
 			       unsigned long arg)
 {
 	drm_buf_info32_t req32;
 	drm_buf_info32_t __user *argp = (void __user *)arg;
-	drm_buf_desc32_t __user *to;
-	struct drm_buf_info __user *request;
-	struct drm_buf_desc __user *list;
-	size_t nbytes;
-	int i, err;
-	int count, actual;
+	int err;
 
 	if (copy_from_user(&req32, argp, sizeof(req32)))
 		return -EFAULT;
 
-	count = req32.count;
-	to = (drm_buf_desc32_t __user *) (unsigned long)req32.list;
-	if (count < 0)
-		count = 0;
-	if (count > 0
-	    && !access_ok(VERIFY_WRITE, to, count * sizeof(drm_buf_desc32_t)))
-		return -EFAULT;
+	if (req32.count < 0)
+		req32.count = 0;
 
-	nbytes = sizeof(*request) + count * sizeof(struct drm_buf_desc);
-	request = compat_alloc_user_space(nbytes);
-	if (!request)
-		return -EFAULT;
-	list = (struct drm_buf_desc *) (request + 1);
-
-	if (__put_user(count, &request->count)
-	    || __put_user(list, &request->list))
-		return -EFAULT;
-
-	err = drm_ioctl(file, DRM_IOCTL_INFO_BUFS, (unsigned long)request);
+	err = drm_ioctl_kernel(file, drm_legacy_infobufs32, &req32, DRM_AUTH);
 	if (err)
 		return err;
 
-	if (__get_user(actual, &request->count))
-		return -EFAULT;
-	if (count >= actual)
-		for (i = 0; i < actual; ++i)
-			if (__copy_in_user(&to[i], &list[i],
-					   offsetof(struct drm_buf_desc, flags)))
-				return -EFAULT;
-
-	if (__put_user(actual, &argp->count))
+	if (put_user(req32.count, &argp->count))
 		return -EFAULT;
 
 	return 0;
@@ -1053,7 +1043,7 @@ static struct {
 	[DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP32)].fn = compat_drm_addmap,
 	DRM_IOCTL32_DEF(DRM_IOCTL_ADD_BUFS, compat_drm_addbufs),
 	[DRM_IOCTL_NR(DRM_IOCTL_MARK_BUFS32)].fn = compat_drm_markbufs,
-	[DRM_IOCTL_NR(DRM_IOCTL_INFO_BUFS32)].fn = compat_drm_infobufs,
+	DRM_IOCTL32_DEF(DRM_IOCTL_INFO_BUFS, compat_drm_infobufs),
 	[DRM_IOCTL_NR(DRM_IOCTL_MAP_BUFS32)].fn = compat_drm_mapbufs,
 	[DRM_IOCTL_NR(DRM_IOCTL_FREE_BUFS32)].fn = compat_drm_freebufs,
 	[DRM_IOCTL_NR(DRM_IOCTL_RM_MAP32)].fn = compat_drm_rmmap,
-- 
cgit v1.2.3


From 9e92662d01d87a54ee076cd1fcab8b199f6456eb Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 24 May 2017 19:10:32 -0400
Subject: switch compat_drm_getclient() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 29 ++++++++++++-----------------
 1 file changed, 12 insertions(+), 17 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 0be62f20e524..7f36cbe066da 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -263,29 +263,24 @@ static int compat_drm_getclient(struct file *file, unsigned int cmd,
 {
 	drm_client32_t c32;
 	drm_client32_t __user *argp = (void __user *)arg;
-	struct drm_client __user *client;
-	int idx, err;
+	struct drm_client client;
+	int err;
 
-	if (get_user(idx, &argp->idx))
+	if (copy_from_user(&c32, argp, sizeof(c32)))
 		return -EFAULT;
 
-	client = compat_alloc_user_space(sizeof(*client));
-	if (!client)
-		return -EFAULT;
-	if (__put_user(idx, &client->idx))
-		return -EFAULT;
+	client.idx = c32.idx;
 
-	err = drm_ioctl(file, DRM_IOCTL_GET_CLIENT, (unsigned long)client);
+	err = drm_ioctl_kernel(file, drm_getclient, &client, DRM_UNLOCKED);
 	if (err)
 		return err;
 
-	if (__get_user(c32.idx, &client->idx)
-	    || __get_user(c32.auth, &client->auth)
-	    || __get_user(c32.pid, &client->pid)
-	    || __get_user(c32.uid, &client->uid)
-	    || __get_user(c32.magic, &client->magic)
-	    || __get_user(c32.iocs, &client->iocs))
-		return -EFAULT;
+	c32.idx = client.idx;
+	c32.auth = client.auth;
+	c32.pid = client.pid;
+	c32.uid = client.uid;
+	c32.magic = client.magic;
+	c32.iocs = client.iocs;
 
 	if (copy_to_user(argp, &c32, sizeof(c32)))
 		return -EFAULT;
@@ -1037,7 +1032,7 @@ static struct {
 	DRM_IOCTL32_DEF(DRM_IOCTL_VERSION, compat_drm_version),
 	DRM_IOCTL32_DEF(DRM_IOCTL_GET_UNIQUE, compat_drm_getunique),
 	DRM_IOCTL32_DEF(DRM_IOCTL_GET_MAP, compat_drm_getmap),
-	[DRM_IOCTL_NR(DRM_IOCTL_GET_CLIENT32)].fn = compat_drm_getclient,
+	DRM_IOCTL32_DEF(DRM_IOCTL_GET_CLIENT, compat_drm_getclient),
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_STATS32)].fn = compat_drm_getstats,
 	DRM_IOCTL32_DEF(DRM_IOCTL_SET_UNIQUE, compat_drm_setunique),
 	[DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP32)].fn = compat_drm_addmap,
-- 
cgit v1.2.3


From 8547ee9d448be87858f59e3590fc54fc2574cd05 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 24 May 2017 19:18:06 -0400
Subject: switch compat_drm_getstats() to drm_ioctl_kernel()

The reason we call drm_ioctl_kernel() at all is that we want error
handling; conversions would be pointless there - user buffer is
simply zeroed.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 22 ++++------------------
 1 file changed, 4 insertions(+), 18 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 7f36cbe066da..d7c14274c8b2 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -298,28 +298,14 @@ typedef struct drm_stats32 {
 static int compat_drm_getstats(struct file *file, unsigned int cmd,
 			       unsigned long arg)
 {
-	drm_stats32_t s32;
 	drm_stats32_t __user *argp = (void __user *)arg;
-	struct drm_stats __user *stats;
-	int i, err;
-
-	memset(&s32, 0, sizeof(drm_stats32_t));
-	stats = compat_alloc_user_space(sizeof(*stats));
-	if (!stats)
-		return -EFAULT;
+	int err;
 
-	err = drm_ioctl(file, DRM_IOCTL_GET_STATS, (unsigned long)stats);
+	err = drm_ioctl_kernel(file, drm_noop, NULL, DRM_UNLOCKED);
 	if (err)
 		return err;
 
-	if (__get_user(s32.count, &stats->count))
-		return -EFAULT;
-	for (i = 0; i < 15; ++i)
-		if (__get_user(s32.data[i].value, &stats->data[i].value)
-		    || __get_user(s32.data[i].type, &stats->data[i].type))
-			return -EFAULT;
-
-	if (copy_to_user(argp, &s32, sizeof(s32)))
+	if (clear_user(argp, sizeof(drm_stats32_t)))
 		return -EFAULT;
 	return 0;
 }
@@ -1033,7 +1019,7 @@ static struct {
 	DRM_IOCTL32_DEF(DRM_IOCTL_GET_UNIQUE, compat_drm_getunique),
 	DRM_IOCTL32_DEF(DRM_IOCTL_GET_MAP, compat_drm_getmap),
 	DRM_IOCTL32_DEF(DRM_IOCTL_GET_CLIENT, compat_drm_getclient),
-	[DRM_IOCTL_NR(DRM_IOCTL_GET_STATS32)].fn = compat_drm_getstats,
+	DRM_IOCTL32_DEF(DRM_IOCTL_GET_STATS, compat_drm_getstats),
 	DRM_IOCTL32_DEF(DRM_IOCTL_SET_UNIQUE, compat_drm_setunique),
 	[DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP32)].fn = compat_drm_addmap,
 	DRM_IOCTL32_DEF(DRM_IOCTL_ADD_BUFS, compat_drm_addbufs),
-- 
cgit v1.2.3


From b36180a33b739ba563b002d0faeb7c6f7b7a2471 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 24 May 2017 19:27:36 -0400
Subject: switch compat_drm_addmap() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 33 +++++++++++++--------------------
 1 file changed, 13 insertions(+), 20 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index d7c14274c8b2..e625a8dfd56f 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -194,35 +194,28 @@ static int compat_drm_addmap(struct file *file, unsigned int cmd,
 {
 	drm_map32_t __user *argp = (void __user *)arg;
 	drm_map32_t m32;
-	struct drm_map __user *map;
+	struct drm_map map;
 	int err;
-	void *handle;
 
 	if (copy_from_user(&m32, argp, sizeof(m32)))
 		return -EFAULT;
 
-	map = compat_alloc_user_space(sizeof(*map));
-	if (!map)
-		return -EFAULT;
-	if (__put_user(m32.offset, &map->offset)
-	    || __put_user(m32.size, &map->size)
-	    || __put_user(m32.type, &map->type)
-	    || __put_user(m32.flags, &map->flags))
-		return -EFAULT;
+	map.offset = m32.offset;
+	map.size = m32.size;
+	map.type = m32.type;
+	map.flags = m32.flags;
 
-	err = drm_ioctl(file, DRM_IOCTL_ADD_MAP, (unsigned long)map);
+	err = drm_ioctl_kernel(file, drm_legacy_addmap_ioctl, &map,
+				DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 	if (err)
 		return err;
 
-	if (__get_user(m32.offset, &map->offset)
-	    || __get_user(m32.mtrr, &map->mtrr)
-	    || __get_user(handle, &map->handle))
-		return -EFAULT;
-
-	m32.handle = (unsigned long)handle;
-	if (m32.handle != (unsigned long)handle)
+	m32.offset = map.offset;
+	m32.mtrr = map.mtrr;
+	m32.handle = ptr_to_compat(map.handle);
+	if (map.handle != compat_ptr(m32.handle))
 		pr_err_ratelimited("compat_drm_addmap truncated handle %p for type %d offset %x\n",
-				   handle, m32.type, m32.offset);
+				   map.handle, m32.type, m32.offset);
 
 	if (copy_to_user(argp, &m32, sizeof(m32)))
 		return -EFAULT;
@@ -1021,7 +1014,7 @@ static struct {
 	DRM_IOCTL32_DEF(DRM_IOCTL_GET_CLIENT, compat_drm_getclient),
 	DRM_IOCTL32_DEF(DRM_IOCTL_GET_STATS, compat_drm_getstats),
 	DRM_IOCTL32_DEF(DRM_IOCTL_SET_UNIQUE, compat_drm_setunique),
-	[DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP32)].fn = compat_drm_addmap,
+	DRM_IOCTL32_DEF(DRM_IOCTL_ADD_MAP, compat_drm_addmap),
 	DRM_IOCTL32_DEF(DRM_IOCTL_ADD_BUFS, compat_drm_addbufs),
 	[DRM_IOCTL_NR(DRM_IOCTL_MARK_BUFS32)].fn = compat_drm_markbufs,
 	DRM_IOCTL32_DEF(DRM_IOCTL_INFO_BUFS, compat_drm_infobufs),
-- 
cgit v1.2.3


From dbae740e3688e7afc266518d08ad6a65eaf4f259 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 24 May 2017 19:30:28 -0400
Subject: switch compat_drm_markbufs() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index e625a8dfd56f..657fbe02ebd8 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -348,21 +348,17 @@ static int compat_drm_markbufs(struct file *file, unsigned int cmd,
 {
 	drm_buf_desc32_t b32;
 	drm_buf_desc32_t __user *argp = (void __user *)arg;
-	struct drm_buf_desc __user *buf;
+	struct drm_buf_desc __user buf;
 
 	if (copy_from_user(&b32, argp, sizeof(b32)))
 		return -EFAULT;
 
-	buf = compat_alloc_user_space(sizeof(*buf));
-	if (!buf)
-		return -EFAULT;
-
-	if (__put_user(b32.size, &buf->size)
-	    || __put_user(b32.low_mark, &buf->low_mark)
-	    || __put_user(b32.high_mark, &buf->high_mark))
-		return -EFAULT;
+	buf.size = b32.size;
+	buf.low_mark = b32.low_mark;
+	buf.high_mark = b32.high_mark;
 
-	return drm_ioctl(file, DRM_IOCTL_MARK_BUFS, (unsigned long)buf);
+	return drm_ioctl_kernel(file, drm_legacy_markbufs, &buf,
+				DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 }
 
 typedef struct drm_buf_info32 {
@@ -1016,7 +1012,7 @@ static struct {
 	DRM_IOCTL32_DEF(DRM_IOCTL_SET_UNIQUE, compat_drm_setunique),
 	DRM_IOCTL32_DEF(DRM_IOCTL_ADD_MAP, compat_drm_addmap),
 	DRM_IOCTL32_DEF(DRM_IOCTL_ADD_BUFS, compat_drm_addbufs),
-	[DRM_IOCTL_NR(DRM_IOCTL_MARK_BUFS32)].fn = compat_drm_markbufs,
+	DRM_IOCTL32_DEF(DRM_IOCTL_MARK_BUFS, compat_drm_markbufs),
 	DRM_IOCTL32_DEF(DRM_IOCTL_INFO_BUFS, compat_drm_infobufs),
 	[DRM_IOCTL_NR(DRM_IOCTL_MAP_BUFS32)].fn = compat_drm_mapbufs,
 	[DRM_IOCTL_NR(DRM_IOCTL_FREE_BUFS32)].fn = compat_drm_freebufs,
-- 
cgit v1.2.3


From 8c9e4cfb409838ca463933742560cbe8c5bd1601 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 25 May 2017 12:44:05 -0400
Subject: switch compat_drm_freebufs() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 657fbe02ebd8..14eaa25ac3fc 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -482,21 +482,15 @@ static int compat_drm_freebufs(struct file *file, unsigned int cmd,
 			       unsigned long arg)
 {
 	drm_buf_free32_t req32;
-	struct drm_buf_free __user *request;
+	struct drm_buf_free request;
 	drm_buf_free32_t __user *argp = (void __user *)arg;
 
 	if (copy_from_user(&req32, argp, sizeof(req32)))
 		return -EFAULT;
 
-	request = compat_alloc_user_space(sizeof(*request));
-	if (!request)
-		return -EFAULT;
-	if (__put_user(req32.count, &request->count)
-	    || __put_user((int __user *)(unsigned long)req32.list,
-			  &request->list))
-		return -EFAULT;
-
-	return drm_ioctl(file, DRM_IOCTL_FREE_BUFS, (unsigned long)request);
+	request.count = req32.count;
+	request.list = compat_ptr(req32.list);
+	return drm_ioctl_kernel(file, drm_legacy_freebufs, &request, DRM_AUTH);
 }
 
 typedef struct drm_ctx_priv_map32 {
@@ -1015,7 +1009,7 @@ static struct {
 	DRM_IOCTL32_DEF(DRM_IOCTL_MARK_BUFS, compat_drm_markbufs),
 	DRM_IOCTL32_DEF(DRM_IOCTL_INFO_BUFS, compat_drm_infobufs),
 	[DRM_IOCTL_NR(DRM_IOCTL_MAP_BUFS32)].fn = compat_drm_mapbufs,
-	[DRM_IOCTL_NR(DRM_IOCTL_FREE_BUFS32)].fn = compat_drm_freebufs,
+	DRM_IOCTL32_DEF(DRM_IOCTL_FREE_BUFS, compat_drm_freebufs),
 	[DRM_IOCTL_NR(DRM_IOCTL_RM_MAP32)].fn = compat_drm_rmmap,
 	[DRM_IOCTL_NR(DRM_IOCTL_SET_SAREA_CTX32)].fn = compat_drm_setsareactx,
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_SAREA_CTX32)].fn = compat_drm_getsareactx,
-- 
cgit v1.2.3


From 7900c6007a927da7944dd721dcdf69092829d4df Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 25 May 2017 12:47:00 -0400
Subject: switch compat_drm_setsareactx() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 14eaa25ac3fc..e8081216c7cb 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -502,21 +502,16 @@ static int compat_drm_setsareactx(struct file *file, unsigned int cmd,
 				  unsigned long arg)
 {
 	drm_ctx_priv_map32_t req32;
-	struct drm_ctx_priv_map __user *request;
+	struct drm_ctx_priv_map request;
 	drm_ctx_priv_map32_t __user *argp = (void __user *)arg;
 
 	if (copy_from_user(&req32, argp, sizeof(req32)))
 		return -EFAULT;
 
-	request = compat_alloc_user_space(sizeof(*request));
-	if (!request)
-		return -EFAULT;
-	if (__put_user(req32.ctx_id, &request->ctx_id)
-	    || __put_user((void *)(unsigned long)req32.handle,
-			  &request->handle))
-		return -EFAULT;
-
-	return drm_ioctl(file, DRM_IOCTL_SET_SAREA_CTX, (unsigned long)request);
+	request.ctx_id = req32.ctx_id;
+	request.handle = compat_ptr(req32.handle);
+	return drm_ioctl_kernel(file, drm_legacy_setsareactx, &request,
+				DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 }
 
 static int compat_drm_getsareactx(struct file *file, unsigned int cmd,
@@ -1011,7 +1006,7 @@ static struct {
 	[DRM_IOCTL_NR(DRM_IOCTL_MAP_BUFS32)].fn = compat_drm_mapbufs,
 	DRM_IOCTL32_DEF(DRM_IOCTL_FREE_BUFS, compat_drm_freebufs),
 	[DRM_IOCTL_NR(DRM_IOCTL_RM_MAP32)].fn = compat_drm_rmmap,
-	[DRM_IOCTL_NR(DRM_IOCTL_SET_SAREA_CTX32)].fn = compat_drm_setsareactx,
+	DRM_IOCTL32_DEF(DRM_IOCTL_SET_SAREA_CTX, compat_drm_setsareactx),
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_SAREA_CTX32)].fn = compat_drm_getsareactx,
 	[DRM_IOCTL_NR(DRM_IOCTL_RES_CTX32)].fn = compat_drm_resctx,
 	[DRM_IOCTL_NR(DRM_IOCTL_DMA32)].fn = compat_drm_dma,
-- 
cgit v1.2.3


From d7631e30434e7fcf025dd2a7cba879f203f7849b Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 25 May 2017 12:50:51 -0400
Subject: switch compat_drm_getsareactx() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index e8081216c7cb..2f017e368d5f 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -517,28 +517,21 @@ static int compat_drm_setsareactx(struct file *file, unsigned int cmd,
 static int compat_drm_getsareactx(struct file *file, unsigned int cmd,
 				  unsigned long arg)
 {
-	struct drm_ctx_priv_map __user *request;
+	struct drm_ctx_priv_map req;
+	drm_ctx_priv_map32_t req32;
 	drm_ctx_priv_map32_t __user *argp = (void __user *)arg;
 	int err;
-	unsigned int ctx_id;
-	void *handle;
-
-	if (!access_ok(VERIFY_WRITE, argp, sizeof(*argp))
-	    || __get_user(ctx_id, &argp->ctx_id))
-		return -EFAULT;
 
-	request = compat_alloc_user_space(sizeof(*request));
-	if (!request)
-		return -EFAULT;
-	if (__put_user(ctx_id, &request->ctx_id))
+	if (copy_from_user(&req32, argp, sizeof(req32)))
 		return -EFAULT;
 
-	err = drm_ioctl(file, DRM_IOCTL_GET_SAREA_CTX, (unsigned long)request);
+	req.ctx_id = req32.ctx_id;
+	err = drm_ioctl_kernel(file, drm_legacy_getsareactx, &req, DRM_AUTH);
 	if (err)
 		return err;
 
-	if (__get_user(handle, &request->handle)
-	    || __put_user((unsigned long)handle, &argp->handle))
+	req32.handle = ptr_to_compat(req.handle);
+	if (copy_to_user(argp, &req32, sizeof(req32)))
 		return -EFAULT;
 
 	return 0;
@@ -1007,7 +1000,7 @@ static struct {
 	DRM_IOCTL32_DEF(DRM_IOCTL_FREE_BUFS, compat_drm_freebufs),
 	[DRM_IOCTL_NR(DRM_IOCTL_RM_MAP32)].fn = compat_drm_rmmap,
 	DRM_IOCTL32_DEF(DRM_IOCTL_SET_SAREA_CTX, compat_drm_setsareactx),
-	[DRM_IOCTL_NR(DRM_IOCTL_GET_SAREA_CTX32)].fn = compat_drm_getsareactx,
+	DRM_IOCTL32_DEF(DRM_IOCTL_GET_SAREA_CTX, compat_drm_getsareactx),
 	[DRM_IOCTL_NR(DRM_IOCTL_RES_CTX32)].fn = compat_drm_resctx,
 	[DRM_IOCTL_NR(DRM_IOCTL_DMA32)].fn = compat_drm_dma,
 #if IS_ENABLED(CONFIG_AGP)
-- 
cgit v1.2.3


From 9e0756800fa2cd6f10116cd0d8b77bb41522370a Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 25 May 2017 12:53:59 -0400
Subject: switch compat_drm_resctx() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 2f017e368d5f..70cfb85b4385 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -547,26 +547,20 @@ static int compat_drm_resctx(struct file *file, unsigned int cmd,
 {
 	drm_ctx_res32_t __user *argp = (void __user *)arg;
 	drm_ctx_res32_t res32;
-	struct drm_ctx_res __user *res;
+	struct drm_ctx_res res;
 	int err;
 
 	if (copy_from_user(&res32, argp, sizeof(res32)))
 		return -EFAULT;
 
-	res = compat_alloc_user_space(sizeof(*res));
-	if (!res)
-		return -EFAULT;
-	if (__put_user(res32.count, &res->count)
-	    || __put_user((struct drm_ctx __user *) (unsigned long)res32.contexts,
-			  &res->contexts))
-		return -EFAULT;
-
-	err = drm_ioctl(file, DRM_IOCTL_RES_CTX, (unsigned long)res);
+	res.count = res32.count;
+	res.contexts = compat_ptr(res32.contexts);
+	err = drm_ioctl_kernel(file, drm_legacy_resctx, &res, DRM_AUTH);
 	if (err)
 		return err;
 
-	if (__get_user(res32.count, &res->count)
-	    || __put_user(res32.count, &argp->count))
+	res32.count = res.count;
+	if (copy_to_user(argp, &res32, sizeof(res32)))
 		return -EFAULT;
 
 	return 0;
@@ -1001,7 +995,7 @@ static struct {
 	[DRM_IOCTL_NR(DRM_IOCTL_RM_MAP32)].fn = compat_drm_rmmap,
 	DRM_IOCTL32_DEF(DRM_IOCTL_SET_SAREA_CTX, compat_drm_setsareactx),
 	DRM_IOCTL32_DEF(DRM_IOCTL_GET_SAREA_CTX, compat_drm_getsareactx),
-	[DRM_IOCTL_NR(DRM_IOCTL_RES_CTX32)].fn = compat_drm_resctx,
+	DRM_IOCTL32_DEF(DRM_IOCTL_RES_CTX, compat_drm_resctx),
 	[DRM_IOCTL_NR(DRM_IOCTL_DMA32)].fn = compat_drm_dma,
 #if IS_ENABLED(CONFIG_AGP)
 	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ENABLE32)].fn = compat_drm_agp_enable,
-- 
cgit v1.2.3


From c6f08966f50b5cf669387e0eb941a8f6b92a641d Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 25 May 2017 12:58:47 -0400
Subject: switch compat_drm_dma() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 38 +++++++++++++-------------------------
 1 file changed, 13 insertions(+), 25 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 70cfb85b4385..262b8a6cb0b0 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -584,38 +584,26 @@ static int compat_drm_dma(struct file *file, unsigned int cmd,
 {
 	drm_dma32_t d32;
 	drm_dma32_t __user *argp = (void __user *)arg;
-	struct drm_dma __user *d;
+	struct drm_dma d;
 	int err;
 
 	if (copy_from_user(&d32, argp, sizeof(d32)))
 		return -EFAULT;
 
-	d = compat_alloc_user_space(sizeof(*d));
-	if (!d)
-		return -EFAULT;
-
-	if (__put_user(d32.context, &d->context)
-	    || __put_user(d32.send_count, &d->send_count)
-	    || __put_user((int __user *)(unsigned long)d32.send_indices,
-			  &d->send_indices)
-	    || __put_user((int __user *)(unsigned long)d32.send_sizes,
-			  &d->send_sizes)
-	    || __put_user(d32.flags, &d->flags)
-	    || __put_user(d32.request_count, &d->request_count)
-	    || __put_user((int __user *)(unsigned long)d32.request_indices,
-			  &d->request_indices)
-	    || __put_user((int __user *)(unsigned long)d32.request_sizes,
-			  &d->request_sizes))
-		return -EFAULT;
-
-	err = drm_ioctl(file, DRM_IOCTL_DMA, (unsigned long)d);
+	d.context = d32.context;
+	d.send_count = d32.send_count;
+	d.send_indices = compat_ptr(d32.send_indices);
+	d.send_sizes = compat_ptr(d32.send_sizes);
+	d.flags = d32.flags;
+	d.request_count = d32.request_count;
+	d.request_indices = compat_ptr(d32.request_indices);
+	d.request_sizes = compat_ptr(d32.request_sizes);
+	err = drm_ioctl_kernel(file, drm_legacy_dma_ioctl, &d, DRM_AUTH);
 	if (err)
 		return err;
 
-	if (__get_user(d32.request_size, &d->request_size)
-	    || __get_user(d32.granted_count, &d->granted_count)
-	    || __put_user(d32.request_size, &argp->request_size)
-	    || __put_user(d32.granted_count, &argp->granted_count))
+	if (put_user(d.request_size, &argp->request_size)
+	    || put_user(d.granted_count, &argp->granted_count))
 		return -EFAULT;
 
 	return 0;
@@ -996,7 +984,7 @@ static struct {
 	DRM_IOCTL32_DEF(DRM_IOCTL_SET_SAREA_CTX, compat_drm_setsareactx),
 	DRM_IOCTL32_DEF(DRM_IOCTL_GET_SAREA_CTX, compat_drm_getsareactx),
 	DRM_IOCTL32_DEF(DRM_IOCTL_RES_CTX, compat_drm_resctx),
-	[DRM_IOCTL_NR(DRM_IOCTL_DMA32)].fn = compat_drm_dma,
+	DRM_IOCTL32_DEF(DRM_IOCTL_DMA, compat_drm_dma),
 #if IS_ENABLED(CONFIG_AGP)
 	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ENABLE32)].fn = compat_drm_agp_enable,
 	[DRM_IOCTL_NR(DRM_IOCTL_AGP_INFO32)].fn = compat_drm_agp_info,
-- 
cgit v1.2.3


From e92673eddeadfa599b57e13fc0c26b03ed939479 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 25 May 2017 13:17:17 -0400
Subject: compat_drm: switch AGP compat ioctls to drm_ioctl_kernel()

[folded a fix from Colin King]

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 109 ++++++++++++++++++--------------------------
 1 file changed, 44 insertions(+), 65 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 262b8a6cb0b0..b0d882022a1f 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -618,17 +618,13 @@ static int compat_drm_agp_enable(struct file *file, unsigned int cmd,
 				 unsigned long arg)
 {
 	drm_agp_mode32_t __user *argp = (void __user *)arg;
-	drm_agp_mode32_t m32;
-	struct drm_agp_mode __user *mode;
+	struct drm_agp_mode mode;
 
-	if (get_user(m32.mode, &argp->mode))
+	if (get_user(mode.mode, &argp->mode))
 		return -EFAULT;
 
-	mode = compat_alloc_user_space(sizeof(*mode));
-	if (put_user(m32.mode, &mode->mode))
-		return -EFAULT;
-
-	return drm_ioctl(file, DRM_IOCTL_AGP_ENABLE, (unsigned long)mode);
+	return drm_ioctl_kernel(file,  drm_agp_enable_ioctl, &mode,
+				DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 }
 
 typedef struct drm_agp_info32 {
@@ -650,28 +646,22 @@ static int compat_drm_agp_info(struct file *file, unsigned int cmd,
 {
 	drm_agp_info32_t __user *argp = (void __user *)arg;
 	drm_agp_info32_t i32;
-	struct drm_agp_info __user *info;
+	struct drm_agp_info info;
 	int err;
 
-	info = compat_alloc_user_space(sizeof(*info));
-	if (!info)
-		return -EFAULT;
-
-	err = drm_ioctl(file, DRM_IOCTL_AGP_INFO, (unsigned long)info);
+	err = drm_ioctl_kernel(file, drm_agp_info_ioctl, &info, DRM_AUTH);
 	if (err)
 		return err;
 
-	if (__get_user(i32.agp_version_major, &info->agp_version_major)
-	    || __get_user(i32.agp_version_minor, &info->agp_version_minor)
-	    || __get_user(i32.mode, &info->mode)
-	    || __get_user(i32.aperture_base, &info->aperture_base)
-	    || __get_user(i32.aperture_size, &info->aperture_size)
-	    || __get_user(i32.memory_allowed, &info->memory_allowed)
-	    || __get_user(i32.memory_used, &info->memory_used)
-	    || __get_user(i32.id_vendor, &info->id_vendor)
-	    || __get_user(i32.id_device, &info->id_device))
-		return -EFAULT;
-
+	i32.agp_version_major = info.agp_version_major;
+	i32.agp_version_minor = info.agp_version_minor;
+	i32.mode = info.mode;
+	i32.aperture_base = info.aperture_base;
+	i32.aperture_size = info.aperture_size;
+	i32.memory_allowed = info.memory_allowed;
+	i32.memory_used = info.memory_used;
+	i32.id_vendor = info.id_vendor;
+	i32.id_device = info.id_device;
 	if (copy_to_user(argp, &i32, sizeof(i32)))
 		return -EFAULT;
 
@@ -690,26 +680,24 @@ static int compat_drm_agp_alloc(struct file *file, unsigned int cmd,
 {
 	drm_agp_buffer32_t __user *argp = (void __user *)arg;
 	drm_agp_buffer32_t req32;
-	struct drm_agp_buffer __user *request;
+	struct drm_agp_buffer request;
 	int err;
 
 	if (copy_from_user(&req32, argp, sizeof(req32)))
 		return -EFAULT;
 
-	request = compat_alloc_user_space(sizeof(*request));
-	if (!request
-	    || __put_user(req32.size, &request->size)
-	    || __put_user(req32.type, &request->type))
-		return -EFAULT;
-
-	err = drm_ioctl(file, DRM_IOCTL_AGP_ALLOC, (unsigned long)request);
+	request.size = req32.size;
+	request.type = req32.type;
+	err = drm_ioctl_kernel(file, drm_agp_alloc_ioctl, &request,
+				DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 	if (err)
 		return err;
 
-	if (__get_user(req32.handle, &request->handle)
-	    || __get_user(req32.physical, &request->physical)
-	    || copy_to_user(argp, &req32, sizeof(req32))) {
-		drm_ioctl(file, DRM_IOCTL_AGP_FREE, (unsigned long)request);
+	req32.handle = request.handle;
+	req32.physical = request.physical;
+	if (copy_to_user(argp, &req32, sizeof(req32))) {
+		drm_ioctl_kernel(file, drm_agp_free_ioctl, &request,
+				DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 		return -EFAULT;
 	}
 
@@ -720,16 +708,13 @@ static int compat_drm_agp_free(struct file *file, unsigned int cmd,
 			       unsigned long arg)
 {
 	drm_agp_buffer32_t __user *argp = (void __user *)arg;
-	struct drm_agp_buffer __user *request;
-	u32 handle;
+	struct drm_agp_buffer request;
 
-	request = compat_alloc_user_space(sizeof(*request));
-	if (!request
-	    || get_user(handle, &argp->handle)
-	    || __put_user(handle, &request->handle))
+	if (get_user(request.handle, &argp->handle))
 		return -EFAULT;
 
-	return drm_ioctl(file, DRM_IOCTL_AGP_FREE, (unsigned long)request);
+	return drm_ioctl_kernel(file, drm_agp_free_ioctl, &request,
+				DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 }
 
 typedef struct drm_agp_binding32 {
@@ -742,34 +727,28 @@ static int compat_drm_agp_bind(struct file *file, unsigned int cmd,
 {
 	drm_agp_binding32_t __user *argp = (void __user *)arg;
 	drm_agp_binding32_t req32;
-	struct drm_agp_binding __user *request;
+	struct drm_agp_binding request;
 
 	if (copy_from_user(&req32, argp, sizeof(req32)))
 		return -EFAULT;
 
-	request = compat_alloc_user_space(sizeof(*request));
-	if (!request
-	    || __put_user(req32.handle, &request->handle)
-	    || __put_user(req32.offset, &request->offset))
-		return -EFAULT;
-
-	return drm_ioctl(file, DRM_IOCTL_AGP_BIND, (unsigned long)request);
+	request.handle = req32.handle;
+	request.offset = req32.offset;
+	return drm_ioctl_kernel(file, drm_agp_bind_ioctl, &request,
+				DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 }
 
 static int compat_drm_agp_unbind(struct file *file, unsigned int cmd,
 				 unsigned long arg)
 {
 	drm_agp_binding32_t __user *argp = (void __user *)arg;
-	struct drm_agp_binding __user *request;
-	u32 handle;
+	struct drm_agp_binding request;
 
-	request = compat_alloc_user_space(sizeof(*request));
-	if (!request
-	    || get_user(handle, &argp->handle)
-	    || __put_user(handle, &request->handle))
+	if (get_user(request.handle, &argp->handle))
 		return -EFAULT;
 
-	return drm_ioctl(file, DRM_IOCTL_AGP_UNBIND, (unsigned long)request);
+	return drm_ioctl_kernel(file, drm_agp_unbind_ioctl, &request,
+				DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 }
 #endif /* CONFIG_AGP */
 
@@ -986,12 +965,12 @@ static struct {
 	DRM_IOCTL32_DEF(DRM_IOCTL_RES_CTX, compat_drm_resctx),
 	DRM_IOCTL32_DEF(DRM_IOCTL_DMA, compat_drm_dma),
 #if IS_ENABLED(CONFIG_AGP)
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ENABLE32)].fn = compat_drm_agp_enable,
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_INFO32)].fn = compat_drm_agp_info,
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ALLOC32)].fn = compat_drm_agp_alloc,
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_FREE32)].fn = compat_drm_agp_free,
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_BIND32)].fn = compat_drm_agp_bind,
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_UNBIND32)].fn = compat_drm_agp_unbind,
+	DRM_IOCTL32_DEF(DRM_IOCTL_AGP_ENABLE, compat_drm_agp_enable),
+	DRM_IOCTL32_DEF(DRM_IOCTL_AGP_INFO, compat_drm_agp_info),
+	DRM_IOCTL32_DEF(DRM_IOCTL_AGP_ALLOC, compat_drm_agp_alloc),
+	DRM_IOCTL32_DEF(DRM_IOCTL_AGP_FREE, compat_drm_agp_free),
+	DRM_IOCTL32_DEF(DRM_IOCTL_AGP_BIND, compat_drm_agp_bind),
+	DRM_IOCTL32_DEF(DRM_IOCTL_AGP_UNBIND, compat_drm_agp_unbind),
 #endif
 	[DRM_IOCTL_NR(DRM_IOCTL_SG_ALLOC32)].fn = compat_drm_sg_alloc,
 	[DRM_IOCTL_NR(DRM_IOCTL_SG_FREE32)].fn = compat_drm_sg_free,
-- 
cgit v1.2.3


From 314ed7368cfcdf7936f2fa35dc48840344371847 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 25 May 2017 13:24:59 -0400
Subject: compat_drm: switch sg ioctls

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 30 ++++++++++++------------------
 1 file changed, 12 insertions(+), 18 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index b0d882022a1f..b986caa66430 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -761,23 +761,19 @@ static int compat_drm_sg_alloc(struct file *file, unsigned int cmd,
 			       unsigned long arg)
 {
 	drm_scatter_gather32_t __user *argp = (void __user *)arg;
-	struct drm_scatter_gather __user *request;
+	struct drm_scatter_gather request;
 	int err;
-	unsigned long x;
 
-	request = compat_alloc_user_space(sizeof(*request));
-	if (!request || !access_ok(VERIFY_WRITE, argp, sizeof(*argp))
-	    || __get_user(x, &argp->size)
-	    || __put_user(x, &request->size))
+	if (get_user(request.size, &argp->size))
 		return -EFAULT;
 
-	err = drm_ioctl(file, DRM_IOCTL_SG_ALLOC, (unsigned long)request);
+	err = drm_ioctl_kernel(file, drm_legacy_sg_alloc, &request,
+				DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 	if (err)
 		return err;
 
 	/* XXX not sure about the handle conversion here... */
-	if (__get_user(x, &request->handle)
-	    || __put_user(x >> PAGE_SHIFT, &argp->handle))
+	if (put_user(request.handle >> PAGE_SHIFT, &argp->handle))
 		return -EFAULT;
 
 	return 0;
@@ -787,16 +783,14 @@ static int compat_drm_sg_free(struct file *file, unsigned int cmd,
 			      unsigned long arg)
 {
 	drm_scatter_gather32_t __user *argp = (void __user *)arg;
-	struct drm_scatter_gather __user *request;
+	struct drm_scatter_gather request;
 	unsigned long x;
 
-	request = compat_alloc_user_space(sizeof(*request));
-	if (!request || !access_ok(VERIFY_WRITE, argp, sizeof(*argp))
-	    || __get_user(x, &argp->handle)
-	    || __put_user(x << PAGE_SHIFT, &request->handle))
+	if (get_user(x, &argp->handle))
 		return -EFAULT;
-
-	return drm_ioctl(file, DRM_IOCTL_SG_FREE, (unsigned long)request);
+	request.handle = x << PAGE_SHIFT;
+	return drm_ioctl_kernel(file, drm_legacy_sg_free, &request,
+				DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 }
 
 #if defined(CONFIG_X86) || defined(CONFIG_IA64)
@@ -972,8 +966,8 @@ static struct {
 	DRM_IOCTL32_DEF(DRM_IOCTL_AGP_BIND, compat_drm_agp_bind),
 	DRM_IOCTL32_DEF(DRM_IOCTL_AGP_UNBIND, compat_drm_agp_unbind),
 #endif
-	[DRM_IOCTL_NR(DRM_IOCTL_SG_ALLOC32)].fn = compat_drm_sg_alloc,
-	[DRM_IOCTL_NR(DRM_IOCTL_SG_FREE32)].fn = compat_drm_sg_free,
+	DRM_IOCTL32_DEF(DRM_IOCTL_SG_ALLOC, compat_drm_sg_alloc),
+	DRM_IOCTL32_DEF(DRM_IOCTL_SG_FREE, compat_drm_sg_free),
 #if defined(CONFIG_X86) || defined(CONFIG_IA64)
 	[DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)].fn = compat_drm_update_draw,
 #endif
-- 
cgit v1.2.3


From 1a36bf1da632670f9b0a1fc0d63dd65e0ad2483d Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 25 May 2017 13:28:51 -0400
Subject: switch compat_drm_update_draw()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index b986caa66430..752cb36a1cb7 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -806,22 +806,11 @@ static int compat_drm_update_draw(struct file *file, unsigned int cmd,
 				  unsigned long arg)
 {
 	drm_update_draw32_t update32;
-	struct drm_update_draw __user *request;
-	int err;
-
 	if (copy_from_user(&update32, (void __user *)arg, sizeof(update32)))
 		return -EFAULT;
 
-	request = compat_alloc_user_space(sizeof(*request));
-	if (!request ||
-	    __put_user(update32.handle, &request->handle) ||
-	    __put_user(update32.type, &request->type) ||
-	    __put_user(update32.num, &request->num) ||
-	    __put_user(update32.data, &request->data))
-		return -EFAULT;
-
-	err = drm_ioctl(file, DRM_IOCTL_UPDATE_DRAW, (unsigned long)request);
-	return err;
+	return drm_ioctl_kernel(file, drm_noop, NULL,
+				DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY);
 }
 #endif
 
@@ -969,7 +958,7 @@ static struct {
 	DRM_IOCTL32_DEF(DRM_IOCTL_SG_ALLOC, compat_drm_sg_alloc),
 	DRM_IOCTL32_DEF(DRM_IOCTL_SG_FREE, compat_drm_sg_free),
 #if defined(CONFIG_X86) || defined(CONFIG_IA64)
-	[DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)].fn = compat_drm_update_draw,
+	DRM_IOCTL32_DEF(DRM_IOCTL_UPDATE_DRAW, compat_drm_update_draw),
 #endif
 	[DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)].fn = compat_drm_wait_vblank,
 #if defined(CONFIG_X86) || defined(CONFIG_IA64)
-- 
cgit v1.2.3


From d5288c88c67c388091fa0281640b586b4941e3d5 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 25 May 2017 13:33:11 -0400
Subject: switch compat_drm_wait_vblank() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 752cb36a1cb7..60a7160a403f 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -837,29 +837,23 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
 {
 	drm_wait_vblank32_t __user *argp = (void __user *)arg;
 	drm_wait_vblank32_t req32;
-	union drm_wait_vblank __user *request;
+	union drm_wait_vblank req;
 	int err;
 
 	if (copy_from_user(&req32, argp, sizeof(req32)))
 		return -EFAULT;
 
-	request = compat_alloc_user_space(sizeof(*request));
-	if (!request
-	    || __put_user(req32.request.type, &request->request.type)
-	    || __put_user(req32.request.sequence, &request->request.sequence)
-	    || __put_user(req32.request.signal, &request->request.signal))
-		return -EFAULT;
-
-	err = drm_ioctl(file, DRM_IOCTL_WAIT_VBLANK, (unsigned long)request);
+	req.request.type = req32.request.type;
+	req.request.sequence = req32.request.sequence;
+	req.request.signal = req32.request.signal;
+	err = drm_ioctl_kernel(file, drm_wait_vblank, &req, DRM_UNLOCKED);
 	if (err)
 		return err;
 
-	if (__get_user(req32.reply.type, &request->reply.type)
-	    || __get_user(req32.reply.sequence, &request->reply.sequence)
-	    || __get_user(req32.reply.tval_sec, &request->reply.tval_sec)
-	    || __get_user(req32.reply.tval_usec, &request->reply.tval_usec))
-		return -EFAULT;
-
+	req32.reply.type = req.reply.type;
+	req32.reply.sequence = req.reply.sequence;
+	req32.reply.tval_sec = req.reply.tval_sec;
+	req32.reply.tval_usec = req.reply.tval_usec;
 	if (copy_to_user(argp, &req32, sizeof(req32)))
 		return -EFAULT;
 
@@ -960,7 +954,7 @@ static struct {
 #if defined(CONFIG_X86) || defined(CONFIG_IA64)
 	DRM_IOCTL32_DEF(DRM_IOCTL_UPDATE_DRAW, compat_drm_update_draw),
 #endif
-	[DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)].fn = compat_drm_wait_vblank,
+	DRM_IOCTL32_DEF(DRM_IOCTL_WAIT_VBLANK, compat_drm_wait_vblank),
 #if defined(CONFIG_X86) || defined(CONFIG_IA64)
 	[DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)].fn = compat_drm_mode_addfb2,
 #endif
-- 
cgit v1.2.3


From d6c5661321fc1ec33b37dbf115834250ff542325 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 25 May 2017 15:45:04 -0400
Subject: switch compat_drm_mode_addfb2() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 38 ++++++++++----------------------------
 1 file changed, 10 insertions(+), 28 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 60a7160a403f..bad1900c71dd 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -34,6 +34,7 @@
 #include <drm/drmP.h>
 #include "drm_legacy.h"
 #include "drm_internal.h"
+#include "drm_crtc_internal.h"
 
 #define DRM_IOCTL_VERSION32		DRM_IOWR(0x00, drm_version32_t)
 #define DRM_IOCTL_GET_UNIQUE32		DRM_IOWR(0x01, drm_unique32_t)
@@ -877,42 +878,23 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
 				  unsigned long arg)
 {
 	struct drm_mode_fb_cmd232 __user *argp = (void __user *)arg;
-	struct drm_mode_fb_cmd232 req32;
-	struct drm_mode_fb_cmd2 __user *req64;
-	int i;
+	struct drm_mode_fb_cmd2 __user req64;
 	int err;
 
-	if (copy_from_user(&req32, argp, sizeof(req32)))
+	if (copy_from_user(&req64, argp,
+			   offsetof(drm_mode_fb_cmd232_t, modifier)))
 		return -EFAULT;
 
-	req64 = compat_alloc_user_space(sizeof(*req64));
-
-	if (!access_ok(VERIFY_WRITE, req64, sizeof(*req64))
-	    || __put_user(req32.width, &req64->width)
-	    || __put_user(req32.height, &req64->height)
-	    || __put_user(req32.pixel_format, &req64->pixel_format)
-	    || __put_user(req32.flags, &req64->flags))
+	if (copy_from_user(&req64.modifier, &argp->modifier,
+			   sizeof(req64.modifier)))
 		return -EFAULT;
 
-	for (i = 0; i < 4; i++) {
-		if (__put_user(req32.handles[i], &req64->handles[i]))
-			return -EFAULT;
-		if (__put_user(req32.pitches[i], &req64->pitches[i]))
-			return -EFAULT;
-		if (__put_user(req32.offsets[i], &req64->offsets[i]))
-			return -EFAULT;
-		if (__put_user(req32.modifier[i], &req64->modifier[i]))
-			return -EFAULT;
-	}
-
-	err = drm_ioctl(file, DRM_IOCTL_MODE_ADDFB2, (unsigned long)req64);
+	err = drm_ioctl_kernel(file, drm_mode_addfb2, &req64,
+				DRM_CONTROL_ALLOW|DRM_UNLOCKED);
 	if (err)
 		return err;
 
-	if (__get_user(req32.fb_id, &req64->fb_id))
-		return -EFAULT;
-
-	if (copy_to_user(argp, &req32, sizeof(req32)))
+	if (put_user(req64.fb_id, &argp->fb_id))
 		return -EFAULT;
 
 	return 0;
@@ -956,7 +938,7 @@ static struct {
 #endif
 	DRM_IOCTL32_DEF(DRM_IOCTL_WAIT_VBLANK, compat_drm_wait_vblank),
 #if defined(CONFIG_X86) || defined(CONFIG_IA64)
-	[DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)].fn = compat_drm_mode_addfb2,
+	DRM_IOCTL32_DEF(DRM_IOCTL_MODE_ADDFB2, compat_drm_mode_addfb2),
 #endif
 };
 
-- 
cgit v1.2.3


From 6113252dd0c70486f67e1e3c5cac643828d238d6 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 25 May 2017 15:47:44 -0400
Subject: switch compat_drm_rmmap() to drm_ioctl_kernel()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index bad1900c71dd..57b0ae39169b 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -228,19 +228,13 @@ static int compat_drm_rmmap(struct file *file, unsigned int cmd,
 			    unsigned long arg)
 {
 	drm_map32_t __user *argp = (void __user *)arg;
-	struct drm_map __user *map;
+	struct drm_map map;
 	u32 handle;
 
 	if (get_user(handle, &argp->handle))
 		return -EFAULT;
-
-	map = compat_alloc_user_space(sizeof(*map));
-	if (!map)
-		return -EFAULT;
-	if (__put_user((void *)(unsigned long)handle, &map->handle))
-		return -EFAULT;
-
-	return drm_ioctl(file, DRM_IOCTL_RM_MAP, (unsigned long)map);
+	map.handle = compat_ptr(handle);
+	return drm_ioctl_kernel(file, drm_legacy_rmmap_ioctl, &map, DRM_AUTH);
 }
 
 typedef struct drm_client32 {
@@ -918,7 +912,7 @@ static struct {
 	DRM_IOCTL32_DEF(DRM_IOCTL_INFO_BUFS, compat_drm_infobufs),
 	[DRM_IOCTL_NR(DRM_IOCTL_MAP_BUFS32)].fn = compat_drm_mapbufs,
 	DRM_IOCTL32_DEF(DRM_IOCTL_FREE_BUFS, compat_drm_freebufs),
-	[DRM_IOCTL_NR(DRM_IOCTL_RM_MAP32)].fn = compat_drm_rmmap,
+	DRM_IOCTL32_DEF(DRM_IOCTL_RM_MAP, compat_drm_rmmap),
 	DRM_IOCTL32_DEF(DRM_IOCTL_SET_SAREA_CTX, compat_drm_setsareactx),
 	DRM_IOCTL32_DEF(DRM_IOCTL_GET_SAREA_CTX, compat_drm_getsareactx),
 	DRM_IOCTL32_DEF(DRM_IOCTL_RES_CTX, compat_drm_resctx),
-- 
cgit v1.2.3


From 87d3ce1169d329bc4cab41996fccb68c06b5725b Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 25 May 2017 16:24:20 -0400
Subject: switch compat_drm_mapbufs() to drm_ioctl_kernel()

Another horror like addbufs; this one is even uglier.  With that
done, drm_ioc32.c should be sane.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 drivers/gpu/drm/drm_ioc32.c | 70 ++++++++++++++++++++++-----------------------
 1 file changed, 34 insertions(+), 36 deletions(-)

(limited to 'drivers/gpu/drm/drm_ioc32.c')

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 57b0ae39169b..0e6ae9ceceb6 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -415,54 +415,52 @@ typedef struct drm_buf_map32 {
 	u32 list;		/**< Buffer information */
 } drm_buf_map32_t;
 
+static int map_one_buf32(void *data, int idx, unsigned long virtual,
+			struct drm_buf *buf)
+{
+	drm_buf_map32_t *request = data;
+	drm_buf_pub32_t __user *to = compat_ptr(request->list) + idx;
+	drm_buf_pub32_t v;
+
+	v.idx = buf->idx;
+	v.total = buf->total;
+	v.used = 0;
+	v.address = virtual + buf->offset;
+	if (copy_to_user(to, &v, sizeof(v)))
+		return -EFAULT;
+	return 0;
+}
+
+static int drm_legacy_mapbufs32(struct drm_device *dev, void *data,
+		       struct drm_file *file_priv)
+{
+	drm_buf_map32_t *request = data;
+	void __user *v;
+	int err = __drm_legacy_mapbufs(dev, data, &request->count,
+				    &v, map_one_buf32,
+				    file_priv);
+	request->virtual = ptr_to_compat(v);
+	return err;
+}
+
 static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
 			      unsigned long arg)
 {
 	drm_buf_map32_t __user *argp = (void __user *)arg;
 	drm_buf_map32_t req32;
-	drm_buf_pub32_t __user *list32;
-	struct drm_buf_map __user *request;
-	struct drm_buf_pub __user *list;
-	int i, err;
-	int count, actual;
-	size_t nbytes;
-	void __user *addr;
+	int err;
 
 	if (copy_from_user(&req32, argp, sizeof(req32)))
 		return -EFAULT;
-	count = req32.count;
-	list32 = (void __user *)(unsigned long)req32.list;
-
-	if (count < 0)
+	if (req32.count < 0)
 		return -EINVAL;
-	nbytes = sizeof(*request) + count * sizeof(struct drm_buf_pub);
-	request = compat_alloc_user_space(nbytes);
-	if (!request)
-		return -EFAULT;
-	list = (struct drm_buf_pub *) (request + 1);
 
-	if (__put_user(count, &request->count)
-	    || __put_user(list, &request->list))
-		return -EFAULT;
-
-	err = drm_ioctl(file, DRM_IOCTL_MAP_BUFS, (unsigned long)request);
+	err = drm_ioctl_kernel(file, drm_legacy_mapbufs32, &req32, DRM_AUTH);
 	if (err)
 		return err;
 
-	if (__get_user(actual, &request->count))
-		return -EFAULT;
-	if (count >= actual)
-		for (i = 0; i < actual; ++i)
-			if (__copy_in_user(&list32[i], &list[i],
-					   offsetof(struct drm_buf_pub, address))
-			    || __get_user(addr, &list[i].address)
-			    || __put_user((unsigned long)addr,
-					  &list32[i].address))
-				return -EFAULT;
-
-	if (__put_user(actual, &argp->count)
-	    || __get_user(addr, &request->virtual)
-	    || __put_user((unsigned long)addr, &argp->virtual))
+	if (put_user(req32.count, &argp->count)
+	    || put_user(req32.virtual, &argp->virtual))
 		return -EFAULT;
 
 	return 0;
@@ -910,7 +908,7 @@ static struct {
 	DRM_IOCTL32_DEF(DRM_IOCTL_ADD_BUFS, compat_drm_addbufs),
 	DRM_IOCTL32_DEF(DRM_IOCTL_MARK_BUFS, compat_drm_markbufs),
 	DRM_IOCTL32_DEF(DRM_IOCTL_INFO_BUFS, compat_drm_infobufs),
-	[DRM_IOCTL_NR(DRM_IOCTL_MAP_BUFS32)].fn = compat_drm_mapbufs,
+	DRM_IOCTL32_DEF(DRM_IOCTL_MAP_BUFS, compat_drm_mapbufs),
 	DRM_IOCTL32_DEF(DRM_IOCTL_FREE_BUFS, compat_drm_freebufs),
 	DRM_IOCTL32_DEF(DRM_IOCTL_