drm: fixup some of the ioctl function exit paths

Signed-off-by: Dave Airlie <airlied@linux.ie>

diff --git a/drivers/char/drm/drm_drv.c b/drivers/char/drm/drm_drv.c
index 77e2fb7b7b3707be0eec8a8d892c7cd16c9463df..0e7af53c87deda41d66e61957732b64586d1391d 100644 (file)
--- a/drivers/char/drm/drm_drv.c
+++ b/drivers/char/drm/drm_drv.c
@@ -495,23 +495,25 @@ int drm_ioctl(struct inode *inode, struct file *filp,
        } else {
                if (cmd & (IOC_IN | IOC_OUT)) {
                        kdata = kmalloc(_IOC_SIZE(cmd), GFP_KERNEL);
-                       if (!kdata)
-                               return -ENOMEM;
+                       if (!kdata) {
+                               retcode = -ENOMEM;
+                               goto err_i1;
+                       }
                }
 
                if (cmd & IOC_IN) {
                        if (copy_from_user(kdata, (void __user *)arg,
                                           _IOC_SIZE(cmd)) != 0) {
-                               retcode = -EACCES;
+                               retcode = -EFAULT;
                                goto err_i1;
                        }
                }
                retcode = func(dev, kdata, file_priv);
 
-               if (cmd & IOC_OUT) {
+               if ((retcode == 0) && (cmd & IOC_OUT)) {
                        if (copy_to_user((void __user *)arg, kdata,
                                         _IOC_SIZE(cmd)) != 0)
-                               retcode = -EACCES;
+                               retcode = -EFAULT;
                }
        }