amd/amdgpu/amdgpu_userq_fence.c

601 	struct drm_amdgpu_userq_wait *wait_info = data;
612 	num_read_bo_handles = wait_info->num_bo_read_handles;
613 	bo_handles_read = memdup_user(u64_to_user_ptr(wait_info->bo_read_handles),
618 	num_write_bo_handles = wait_info->num_bo_write_handles;
619 	bo_handles_write = memdup_user(u64_to_user_ptr(wait_info->bo_write_handles),
626 	num_syncobj = wait_info->num_syncobj_handles;
627 	syncobj_handles = memdup_user(u64_to_user_ptr(wait_info->syncobj_handles),
634 	num_points = wait_info->num_syncobj_timeline_handles;
635 	timeline_handles = memdup_user(u64_to_user_ptr(wait_info->syncobj_timeline_handles),
642 	timeline_points = memdup_user(u64_to_user_ptr(wait_info->syncobj_timeline_points),
697 	if (!wait_info->num_fences) {
758 		wait_info->num_fences = num_fences;
761 		fence_info = kmalloc_array(wait_info->num_fences, sizeof(*fence_info), GFP_KERNEL);
768 		fences = kmalloc_array(wait_info->num_fences, sizeof(*fences), GFP_KERNEL);
781 				if (WARN_ON_ONCE(num_fences >= wait_info->num_fences)) {
798 				if (WARN_ON_ONCE(num_fences >= wait_info->num_fences)) {
822 					if (WARN_ON_ONCE(num_fences >= wait_info->num_fences)) {
846 			if (WARN_ON_ONCE(num_fences >= wait_info->num_fences)) {
860 		waitq = idr_find(&userq_mgr->userq_idr, wait_info->waitq_id);
910 		wait_info->num_fences = cnt;
912 		if (copy_to_user(u64_to_user_ptr(wait_info->out_fences),
913 				 fence_info, wait_info->num_fences * sizeof(*fence_info))) {