When i915_gem_execbuffer2_ioctl() is using user_access_begin(),
that's only to perform unsafe_put_user() so use
user_write_access_begin() in order to only open write access.

Signed-off-by: Christophe Leroy <christophe.le...@c-s.fr>
Reviewed-by: Kees Cook <keesc...@chromium.org>
---
v2: Rebased (one part of the patch flies away)
---
 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c 
b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
index 36d069504836..b4c903308590 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
@@ -2794,7 +2794,8 @@ i915_gem_execbuffer2_ioctl(struct drm_device *dev, void 
*data,
                 * And this range already got effectively checked earlier
                 * when we did the "copy_from_user()" above.
                 */
-               if (!user_access_begin(user_exec_list, count * 
sizeof(*user_exec_list)))
+               if (!user_write_access_begin(user_exec_list,
+                                            count * sizeof(*user_exec_list)))
                        goto end;
 
                for (i = 0; i < args->buffer_count; i++) {
@@ -2808,7 +2809,7 @@ i915_gem_execbuffer2_ioctl(struct drm_device *dev, void 
*data,
                                        end_user);
                }
 end_user:
-               user_access_end();
+               user_write_access_end();
 end:;
        }
 
-- 
2.25.0

Reply via email to