Three independent fixes in and around amdxdna_drm_sync_bo_ioctl(). None of
them depend on each other.
Patch 1 refuses an I/O memory mapping of an imported BO, which the driver
currently stores as if it were an ordinary kernel address. Patches 2 and 3
fix two ways the ioctl mishandles its own range: a zero length reaching
drm_clflush_virt_range(), and an offset and size added to the BO address
without an overflow check, one level above a function that checks the same
arithmetic.
Changes in v3:
- dropped the range patch ("flush only the requested range") and the
quiet-vmap patch that existed only to serve it. Christian NAKed
flushing an imported dma-buf, and the numbers in that patch came from
exactly that case; I also have not tested its premise on a matching
tree.
- patch 1: corrected a wrong sentence in the commit message about which
errno drm_gem_vmap_locked() returns.
- patch 2: also says what changes for an imported BO, where a zero-length
request currently flushes the whole scatterlist.
Refusing a sync on a genuinely foreign import is still being discussed on
the v2 thread and is not part of this series.
v2: https://lore.kernel.org/all/[email protected]/
Compile-tested on drm-misc-next only: x86_64 defconfig with
DRM_ACCEL_AMDXDNA=m, gcc 16.2.1, no W=1 warnings. Not booted, and not run
on hardware.
Taimuraz Kaitmazov (3):
accel/amdxdna: refuse an I/O memory mapping of an imported BO
accel/amdxdna: return early from a zero-length flush
accel/amdxdna: check the sync range for overflow on a device BO
drivers/accel/amdxdna/amdxdna_gem.c | 22 ++++++++++++++++++----
1 file changed, 18 insertions(+), 4 deletions(-)
--
2.55.0
