diff --git a/[refs] b/[refs]
index 81418feabda1..21e07a9111c1 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 19a8f59ab8ceee751ea720085098355d53f727d6
+refs/heads/master: 9d5b3ffc42f7820e8ee07705496955e4c2c38dd9
diff --git a/trunk/drivers/char/drm/drm_drv.c b/trunk/drivers/char/drm/drm_drv.c
index 77e2fb7b7b37..0e7af53c87de 100644
--- a/trunk/drivers/char/drm/drm_drv.c
+++ b/trunk/drivers/char/drm/drm_drv.c
@@ -495,23 +495,25 @@ int drm_ioctl(struct inode *inode, struct file *filp,
 	} else {
 		if (cmd & (IOC_IN | IOC_OUT)) {
 			kdata = kmalloc(_IOC_SIZE(cmd), GFP_KERNEL);
-			if (!kdata)
-				return -ENOMEM;
+			if (!kdata) {
+				retcode = -ENOMEM;
+				goto err_i1;
+			}
 		}
 
 		if (cmd & IOC_IN) {
 			if (copy_from_user(kdata, (void __user *)arg,
 					   _IOC_SIZE(cmd)) != 0) {
-				retcode = -EACCES;
+				retcode = -EFAULT;
 				goto err_i1;
 			}
 		}
 		retcode = func(dev, kdata, file_priv);
 
-		if (cmd & IOC_OUT) {
+		if ((retcode == 0) && (cmd & IOC_OUT)) {
 			if (copy_to_user((void __user *)arg, kdata,
 					 _IOC_SIZE(cmd)) != 0)
-				retcode = -EACCES;
+				retcode = -EFAULT;
 		}
 	}