linux.git/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c, branch v6.9

drm/amdgpu: fix error handling in amdgpu_bo_list_get()

2023-11-09T21:59:57+00:00

We should not leak the pointer where we couldn't grab the reference
on to the caller because it can be that the error handling still
tries to put the reference then.

Signed-off-by: Christian König 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org

drm/amdgpu: Annotate struct amdgpu_bo_list with __counted_by

2023-10-05T21:59:35+00:00

Prepare for the coming implementation by GCC and Clang of the __counted_by
attribute. Flexible array members annotated with __counted_by can have
their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for
array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
functions).

As found with Coccinelle[1], add __counted_by for struct amdgpu_bo_list.
Additionally, since the element count member must be set before accessing
the annotated flexible array member, move its initialization earlier.

Cc: Alex Deucher 
Cc: "Christian König" 
Cc: "Pan, Xinhui" 
Cc: David Airlie 
Cc: Daniel Vetter 
Cc: "Gustavo A. R. Silva" 
Cc: Luben Tuikov 
Cc: Christophe JAILLET 
Cc: Felix Kuehling 
Cc: amd-gfx@lists.freedesktop.org
Cc: dri-devel@lists.freedesktop.org
Cc: linux-hardening@vger.kernel.org
Link: https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci [1]
Reviewed-by: Luben Tuikov 
Reviewed-by: Christian König 
Signed-off-by: Kees Cook 
Signed-off-by: Alex Deucher

drm/amdgpu: Use kvzalloc() to simplify code

2023-08-30T19:26:47+00:00

kvzalloc() can be used instead of kvmalloc() + memset() + explicit NULL
assignments.

It is less verbose and more future proof.

Signed-off-by: Christophe JAILLET 
Signed-off-by: Alex Deucher

drm/amdgpu: Remove amdgpu_bo_list_array_entry()

2023-08-30T19:26:45+00:00

Now that there is an explicit flexible array at the end of 'struct
amdgpu_bo_list', it can be used to remove amdgpu_bo_list_array_entry() and
simplify some macro.

Signed-off-by: Christophe JAILLET 
Signed-off-by: Alex Deucher

drm/amdgpu: Remove a redundant sanity check

2023-08-30T19:26:38+00:00

The case where 'num_entries' is too big, is already handled by
struct_size(), because kvmalloc() would fail.

It will return -ENOMEM instead of -EINVAL, but it is only related to a
unlikely to happen sanity check.

Signed-off-by: Christophe JAILLET 
Signed-off-by: Alex Deucher

drm/amdgpu: Explicitly add a flexible array at the end of 'struct amdgpu_bo_list'

2023-08-30T19:26:32+00:00

'struct amdgpu_bo_list' is really used as if it was ended by a flex array.
So make it more explicit and add a 'struct amdgpu_bo_list_entry entries[]'
field at the end of the structure.

This way, struct_size() can be used when it is allocated.
It is less verbose.

Signed-off-by: Christophe JAILLET 
Signed-off-by: Alex Deucher

drm/amdgpu: use the new drm_exec object for CS v3

2023-07-12T12:14:50+00:00

Use the new component here as well and remove the old handling.

v2: drop dupplicate handling
v3: fix memory leak pointed out by Tatsuyuki

Signed-off-by: Christian König 
Acked-by: Alex Deucher 
Link: https://patchwork.freedesktop.org/patch/msgid/20230711133122.3710-7-christian.koenig@amd.com

drm/amdgpu: fix userptr HMM range handling v2

2022-11-17T05:23:30+00:00

The basic problem here is that it's not allowed to page fault while
holding the reservation lock.

So it can happen that multiple processes try to validate an userptr
at the same time.

Work around that by putting the HMM range object into the mutex
protected bo list for now.

v2: make sure range is set to NULL in case of an error

Signed-off-by: Christian König 
Reviewed-by: Alex Deucher 
Reviewed-by: Felix Kuehling 
CC: stable@vger.kernel.org
Signed-off-by: Alex Deucher

drm/amdgpu: Protect the amdgpu_bo_list list with a mutex v2

2022-07-20T20:23:34+00:00

Protect the struct amdgpu_bo_list with a mutex. This is used during command
submission in order to avoid buffer object corruption as recorded in
the link below.

v2 (chk): Keep the mutex looked for the whole CS to avoid using the
	  list from multiple CS threads at the same time.

Suggested-by: Christian König 
Cc: Alex Deucher 
Cc: Andrey Grodzovsky 
Cc: Vitaly Prosyak 
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2048
Signed-off-by: Luben Tuikov 
Signed-off-by: Christian König 
Tested-by: Luben Tuikov 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org

drm/amdgpu: fix warning for overflow check

2021-09-29T21:30:00+00:00

The overflow check in amdgpu_bo_list_create() causes a warning with
clang-14 on 64-bit architectures, since the limit can never be
exceeded.

drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c:74:18: error: result of comparison of constant 256204778801521549 with expression of type 'unsigned int' is always false [-Werror,-Wtautological-constant-out-of-range-compare]
        if (num_entries > (SIZE_MAX - sizeof(struct amdgpu_bo_list))
            ~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The check remains useful for 32-bit architectures, so just avoid the
warning by using size_t as the type for the count.

Fixes: 920990cb080a ("drm/amdgpu: allocate the bo_list array after the list")
Reviewed-by: Christian König 
Signed-off-by: Arnd Bergmann 
Signed-off-by: Alex Deucher