diff --git a/shared-core/r300_cmdbuf.c b/shared-core/r300_cmdbuf.c index 6952eaac..6290c024 100644 --- a/shared-core/r300_cmdbuf.c +++ b/shared-core/r300_cmdbuf.c @@ -712,7 +712,7 @@ static int r300_scratch(drm_radeon_private_t *dev_priv, u32 i, buf_idx, h_pending; RING_LOCALS; - if (cmdbuf->bufsz < sizeof(u64) + header.scratch.n_bufs * sizeof(buf_idx) ) { + if (cmdbuf->bufsz < sizeof(uint64_t) + header.scratch.n_bufs * sizeof(buf_idx) ) { return DRM_ERR(EINVAL); } @@ -724,8 +724,8 @@ static int r300_scratch(drm_radeon_private_t *dev_priv, ref_age_base = *(u32 **)cmdbuf->buf; - cmdbuf->buf += sizeof(u64); - cmdbuf->bufsz -= sizeof(u64); + cmdbuf->buf += sizeof(uint64_t); + cmdbuf->bufsz -= sizeof(uint64_t); for (i=0; i < header.scratch.n_bufs; i++) { buf_idx = *(u32 *)cmdbuf->buf; diff --git a/shared-core/radeon_state.c b/shared-core/radeon_state.c index f6a66112..478dcef0 100644 --- a/shared-core/radeon_state.c +++ b/shared-core/radeon_state.c @@ -2782,7 +2782,7 @@ static int radeon_cp_cmdbuf(DRM_IOCTL_ARGS) DRM_GET_PRIV_WITH_RETURN(filp_priv, filp); DRM_COPY_FROM_USER_IOCTL(cmdbuf, - (drm_radeon_cmd_buffer_t __user *) data, + (drm_radeon_kcmd_buffer_t __user *) data, sizeof(cmdbuf)); RING_SPACE_TEST_WITH_RETURN(dev_priv);