1 files changed, 42 insertions, 43 deletions

diff --git a/linux/bufs.c b/linux/bufs.c
index c00f051a..28e0eb5f 100644
--- a/linux/bufs.c
+++ b/linux/bufs.c
@@ -133,12 +133,13 @@ int drm_addmap(struct inode *inode, struct file *filp, unsigned int cmd,
 	dev->maplist[dev->map_count-1] = map;
 	up(&dev->struct_sem);
 
-	copy_to_user_ret((drm_map_t *)arg, map, sizeof(*map), -EFAULT);
+	if (copy_to_user((drm_map_t *)arg, map, sizeof(*map)))
+		return -EFAULT;
 	if (map->type != _DRM_SHM) {
-		copy_to_user_ret(&((drm_map_t *)arg)->handle,
+		if (copy_to_user(&((drm_map_t *)arg)->handle,
 				 &map->offset,
-				 sizeof(map->offset),
-				 -EFAULT);
+				 sizeof(map->offset)))
+			return -EFAULT;
 	}		
 	return 0;
 }
@@ -166,10 +167,10 @@ int drm_addbufs(struct inode *inode, struct file *filp, unsigned int cmd,
 
 	if (!dma) return -EINVAL;
 
-	copy_from_user_ret(&request,
+	if (copy_from_user(&request,
 			   (drm_buf_desc_t *)arg,
-			   sizeof(request),
-			   -EFAULT);
+			   sizeof(request)))
+		return -EFAULT;
 
 	count	   = request.count;
 	order	   = drm_order(request.size);
@@ -295,10 +296,10 @@ int drm_addbufs(struct inode *inode, struct file *filp, unsigned int cmd,
 	request.count = entry->buf_count;
 	request.size  = size;
 
-	copy_to_user_ret((drm_buf_desc_t *)arg,
+	if (copy_to_user((drm_buf_desc_t *)arg,
 			 &request,
-			 sizeof(request),
-			 -EFAULT);
+			 sizeof(request)))
+		return -EFAULT;
 	
 	atomic_dec(&dev->buf_alloc);
 	return 0;
@@ -324,10 +325,10 @@ int drm_infobufs(struct inode *inode, struct file *filp, unsigned int cmd,
 	++dev->buf_use;		/* Can't allocate more after this call */
 	spin_unlock(&dev->count_lock);
 
-	copy_from_user_ret(&request,
+	if (copy_from_user(&request,
 			   (drm_buf_info_t *)arg,
-			   sizeof(request),
-			   -EFAULT);
+			   sizeof(request)))
+		return -EFAULT;
 
 	for (i = 0, count = 0; i < DRM_MAX_ORDER+1; i++) {
 		if (dma->bufs[i].buf_count) ++count;
@@ -338,28 +339,26 @@ int drm_infobufs(struct inode *inode, struct file *filp, unsigned int cmd,
 	if (request.count >= count) {
 		for (i = 0, count = 0; i < DRM_MAX_ORDER+1; i++) {
 			if (dma->bufs[i].buf_count) {
-				copy_to_user_ret(&request.list[count].count,
+				if (copy_to_user(&request.list[count].count,
 						 &dma->bufs[i].buf_count,
 						 sizeof(dma->bufs[0]
-							.buf_count),
-						 -EFAULT);
-				copy_to_user_ret(&request.list[count].size,
+							.buf_count)) ||
+				    copy_to_user(&request.list[count].size,
 						 &dma->bufs[i].buf_size,
-						 sizeof(dma->bufs[0].buf_size),
-						 -EFAULT);
-				copy_to_user_ret(&request.list[count].low_mark,
+						 sizeof(dma->bufs[0].buf_size)) ||
+				    copy_to_user(&request.list[count].low_mark,
 						 &dma->bufs[i]
 						 .freelist.low_mark,
 						 sizeof(dma->bufs[0]
-							.freelist.low_mark),
-						 -EFAULT);
-				copy_to_user_ret(&request.list[count]
+							.freelist.low_mark)) ||
+				    copy_to_user(&request.list[count]
 						 .high_mark,
 						 &dma->bufs[i]
 						 .freelist.high_mark,
 						 sizeof(dma->bufs[0]
-							.freelist.high_mark),
-						 -EFAULT);
+							.freelist.high_mark)))
+					return -EFAULT;
+
 				DRM_DEBUG("%d %d %d %d %d\n",
 					  i,
 					  dma->bufs[i].buf_count,
@@ -372,10 +371,10 @@ int drm_infobufs(struct inode *inode, struct file *filp, unsigned int cmd,
 	}
 	request.count = count;
 
-	copy_to_user_ret((drm_buf_info_t *)arg,
+	if (copy_to_user((drm_buf_info_t *)arg,
 			 &request,
-			 sizeof(request),
-			 -EFAULT);
+			 sizeof(request)))
+		return -EFAULT;
 	
 	return 0;
 }
@@ -392,10 +391,10 @@ int drm_markbufs(struct inode *inode, struct file *filp, unsigned int cmd,
 
 	if (!dma) return -EINVAL;
 
-	copy_from_user_ret(&request,
+	if (copy_from_user(&request,
 			   (drm_buf_desc_t *)arg,
-			   sizeof(request),
-			   -EFAULT);
+			   sizeof(request)))
+		return -EFAULT;
 
 	DRM_DEBUG("%d, %d, %d\n",
 		  request.size, request.low_mark, request.high_mark);
@@ -427,17 +426,17 @@ int drm_freebufs(struct inode *inode, struct file *filp, unsigned int cmd,
 
 	if (!dma) return -EINVAL;
 
-	copy_from_user_ret(&request,
+	if (copy_from_user(&request,
 			   (drm_buf_free_t *)arg,
-			   sizeof(request),
-			   -EFAULT);
+			   sizeof(request)))
+		return -EFAULT;
 
 	DRM_DEBUG("%d\n", request.count);
 	for (i = 0; i < request.count; i++) {
-		copy_from_user_ret(&idx,
+		if (copy_from_user(&idx,
 				   &request.list[i],
-				   sizeof(idx),
-				   -EFAULT);
+				   sizeof(idx)))
+			return -EFAULT;
 		if (idx < 0 || idx >= dma->buf_count) {
 			DRM_ERROR("Index %d (of %d max)\n",
 				  idx, dma->buf_count - 1);
@@ -480,10 +479,10 @@ int drm_mapbufs(struct inode *inode, struct file *filp, unsigned int cmd,
 	++dev->buf_use;		/* Can't allocate more after this call */
 	spin_unlock(&dev->count_lock);
 
-	copy_from_user_ret(&request,
+	if (copy_from_user(&request,
 			   (drm_buf_map_t *)arg,
-			   sizeof(request),
-			   -EFAULT);
+			   sizeof(request)))
+		return -EFAULT;
 
 	if (request.count >= dma->buf_count) {
 		down(&current->mm->mmap_sem);
@@ -529,10 +528,10 @@ done:
 	request.count = dma->buf_count;
 	DRM_DEBUG("%d buffers, retcode = %d\n", request.count, retcode);
 
-	copy_to_user_ret((drm_buf_map_t *)arg,
+	if (copy_to_user((drm_buf_map_t *)arg,
 			 &request,
-			 sizeof(request),
-			 -EFAULT);
+			 sizeof(request)))
+		return -EFAULT;
 
 	return retcode;
 }