291 	u32 cmdbuf, target;  in host1x_reloc_copy_from_user()  local
294 	err = get_user(cmdbuf, &src->cmdbuf.handle);  in host1x_reloc_copy_from_user()
298 	err = get_user(dest->cmdbuf.offset, &src->cmdbuf.offset);  in host1x_reloc_copy_from_user()
314 	dest->cmdbuf.bo = host1x_bo_lookup(file, cmdbuf);  in host1x_reloc_copy_from_user()
315 	if (!dest->cmdbuf.bo)  in host1x_reloc_copy_from_user()
381 		struct drm_tegra_cmdbuf cmdbuf;  in tegra_drm_submit()  local
386 		if (copy_from_user(&cmdbuf, user_cmdbufs, sizeof(cmdbuf))) {  in tegra_drm_submit()
395 		if (cmdbuf.words > CDMA_GATHER_FETCHES_MAX_NB) {  in tegra_drm_submit()
400 		bo = host1x_bo_lookup(file, cmdbuf.handle);  in tegra_drm_submit()
406 		offset = (u64)cmdbuf.offset + (u64)cmdbuf.words * sizeof(u32);  in tegra_drm_submit()
420 		host1x_job_add_gather(job, bo, cmdbuf.words, cmdbuf.offset);  in tegra_drm_submit()
437 		obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);  in tegra_drm_submit()
445 		if (reloc->cmdbuf.offset & 3 ||  in tegra_drm_submit()
446 		    reloc->cmdbuf.offset >= obj->gem.size) {  in tegra_drm_submit()