drm: use memdup_user() as a cleanup

drivers/gpu/drm/r128/r128_state.c:1014:10-17: WARNING opportunity for memdup_user
/c/kernel-tests/src/cocci/drivers/gpu/drm/r128/r128_state.c:1029:9-16: WARNING opportunity for memdup_user
/c/kernel-tests/src/cocci/drivers/gpu/drm/r128/r128_state.c:904:10-17: WARNING opportunity for memdup_user
/c/kernel-tests/src/cocci/drivers/gpu/drm/r128/r128_state.c:914:9-16: WARNING opportunity for memdup_user

 Use memdup_user rather than duplicating its implementation
 This is a little bit restricted to reduce false positives

Generated by: coccinelle/api/memdup_user.cocci

CC: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>

diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
index 818986b52e8c67d89a053f1938d1405687a9abe2..e806dacd452f7b9cc8c93d20308db93ea0ef0da6 100644 (file)
--- a/drivers/gpu/drm/r128/r128_state.c
+++ b/drivers/gpu/drm/r128/r128_state.c
@@ -901,25 +901,16 @@ static int r128_cce_dispatch_write_span(struct drm_device *dev,
                return -EFAULT;
 
        buffer_size = depth->n * sizeof(u32);
-       buffer = kmalloc(buffer_size, GFP_KERNEL);
-       if (buffer == NULL)
-               return -ENOMEM;
-       if (copy_from_user(buffer, depth->buffer, buffer_size)) {
-               kfree(buffer);
-               return -EFAULT;
-       }
+       buffer = memdup_user(depth->buffer, buffer_size);
+       if (IS_ERR(buffer))
+               return PTR_ERR(buffer);
 
        mask_size = depth->n * sizeof(u8);
        if (depth->mask) {
-               mask = kmalloc(mask_size, GFP_KERNEL);
-               if (mask == NULL) {
+               mask = memdup_user(depth->mask, mask_size);
+               if (IS_ERR(mask)) {
                        kfree(buffer);
-                       return -ENOMEM;
-               }
-               if (copy_from_user(mask, depth->mask, mask_size)) {
-                       kfree(buffer);
-                       kfree(mask);
-                       return -EFAULT;
+                       return PTR_ERR(mask);
                }
 
                for (i = 0; i < count; i++, x++) {
@@ -1011,34 +1002,21 @@ static int r128_cce_dispatch_write_pixels(struct drm_device *dev,
        }
 
        buffer_size = depth->n * sizeof(u32);
-       buffer = kmalloc(buffer_size, GFP_KERNEL);
-       if (buffer == NULL) {
-               kfree(x);
-               kfree(y);
-               return -ENOMEM;
-       }
-       if (copy_from_user(buffer, depth->buffer, buffer_size)) {
+       buffer = memdup_user(depth->buffer, buffer_size);
+       if (IS_ERR(buffer)) {
                kfree(x);
                kfree(y);
-               kfree(buffer);
-               return -EFAULT;
+               return PTR_ERR(buffer);
        }
 
        if (depth->mask) {
                mask_size = depth->n * sizeof(u8);
-               mask = kmalloc(mask_size, GFP_KERNEL);
-               if (mask == NULL) {
-                       kfree(x);
-                       kfree(y);
-                       kfree(buffer);
-                       return -ENOMEM;
-               }
-               if (copy_from_user(mask, depth->mask, mask_size)) {
+               mask = memdup_user(depth->mask, mask_size);
+               if (IS_ERR(mask)) {
                        kfree(x);
                        kfree(y);
                        kfree(buffer);
-                       kfree(mask);
-                       return -EFAULT;
+                       return PTR_ERR(mask);
                }
 
                for (i = 0; i < count; i++) {