From b05240ef28dc6e3757a7652701eb3bddc41e447d Mon Sep 17 00:00:00 2001
From: Rebecca Schultz Zavin <rebecca@android.com>
Date: Thu, 28 Feb 2013 16:43:12 -0800
Subject: [PATCH] --- yaml --- r: 363272 b: refs/heads/master c:
 92ea915adb5565b522902a7b3f0a33ede16bb797 h: refs/heads/master v: v3

---
 [refs]                               | 2 +-
 trunk/drivers/staging/android/sync.c | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/[refs] b/[refs]
index 8951454904e7..47dbbf5186a2 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: c5b86b7418f46220a623277718d6a909f520477b
+refs/heads/master: 92ea915adb5565b522902a7b3f0a33ede16bb797
diff --git a/trunk/drivers/staging/android/sync.c b/trunk/drivers/staging/android/sync.c
index 61c27bdc5d0b..c4a3c1d7946c 100644
--- a/trunk/drivers/staging/android/sync.c
+++ b/trunk/drivers/staging/android/sync.c
@@ -647,8 +647,13 @@ static long sync_fence_ioctl_merge(struct sync_fence *fence, unsigned long arg)
 	struct sync_fence *fence2, *fence3;
 	struct sync_merge_data data;
 
-	if (copy_from_user(&data, (void __user *)arg, sizeof(data)))
-		return -EFAULT;
+	if (fd < 0)
+		return fd;
+
+	if (copy_from_user(&data, (void __user *)arg, sizeof(data))) {
+		err = -EFAULT;
+		goto err_put_fd;
+	}
 
 	fence2 = sync_fence_fdget(data.fd2);
 	if (fence2 == NULL) {