Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 76a1ea61 authored by Christian König's avatar Christian König Committed by Alex Deucher
Browse files

drm/amdgpu: validate the context id in the dependencies 



Just to make sure userspace don't send nonsense to the kernel.

Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Reviewed-by: default avatarJammy Zhou <Jammy.Zhou@amd.com>
parent 12f1384d

drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c

+10 −1
Original line number Diff line number Diff line
@@ -669,6 +669,7 @@ static int amdgpu_cs_ib_fill(struct amdgpu_device *adev, 
static int amdgpu_cs_dependencies(struct amdgpu_device *adev,

				  struct amdgpu_cs_parser *p)

{

	struct amdgpu_fpriv *fpriv = p->filp->driver_priv;

	struct amdgpu_ib *ib;

	int i, j, r;
@@ -694,6 +695,7 @@ static int amdgpu_cs_dependencies(struct amdgpu_device *adev, 
		for (j = 0; j < num_deps; ++j) {

			struct amdgpu_fence *fence;

			struct amdgpu_ring *ring;

			struct amdgpu_ctx *ctx;



			r = amdgpu_cs_get_ring(adev, deps[j].ip_type,

					       deps[j].ip_instance,
@@ -701,14 +703,21 @@ static int amdgpu_cs_dependencies(struct amdgpu_device *adev, 
			if (r)

				return r;



			ctx = amdgpu_ctx_get(fpriv, deps[j].ctx_id);

			if (ctx == NULL)

				return -EINVAL;



			r = amdgpu_fence_recreate(ring, p->filp,

						  deps[j].handle,

						  &fence);

			if (r)

			if (r) {

				amdgpu_ctx_put(ctx);

				return r;

			}



			amdgpu_sync_fence(&ib->sync, fence);

			amdgpu_fence_unref(&fence);

			amdgpu_ctx_put(ctx);

		}

	}