drm/gem: Use vmemdup_array_user in drm_gem_objects_lookup

Use a helper to shrink the code and separate the user and kernel slabs for
better security.

While at it lets remove the useless debug message.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Reviewed-by: André Almeida <andrealmeid@igalia.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20251112092732.23584-1-tvrtko.ursulin@igalia.com

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index a1a9c828938ba34f880a69a01742434ad27b7c65..68168d58a7c866b1686d2104000640cb8bbcb313 100644 (file)
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -783,7 +783,6 @@ static int objects_lookup(struct drm_file *filp, u32 *handle, int count,
 int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles,
                           int count, struct drm_gem_object ***objs_out)
 {
-       struct drm_device *dev = filp->minor->dev;
        struct drm_gem_object **objs;
        u32 *handles;
        int ret;
@@ -798,15 +797,9 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles,
 
        *objs_out = objs;
 
-       handles = kvmalloc_array(count, sizeof(u32), GFP_KERNEL);
-       if (!handles) {
-               ret = -ENOMEM;
-               goto out;
-       }
-
-       if (copy_from_user(handles, bo_handles, count * sizeof(u32))) {
-               ret = -EFAULT;
-               drm_dbg_core(dev, "Failed to copy in GEM handles\n");
+       handles = vmemdup_array_user(bo_handles, count, sizeof(u32));
+       if (IS_ERR(handles)) {
+               ret = PTR_ERR(handles);
                goto out;
        }