Commit fec5f8e8 authored by Pierre-Eric Pelloux-Prayer's avatar Pierre-Eric Pelloux-Prayer Committed by Alex Deucher
Browse files

drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit 



Before this commit, only submits with both a BO_HANDLES chunk and a
'bo_list_handle' would be rejected (by amdgpu_cs_parser_bos).

But if UMD sent multiple BO_HANDLES, what would happen is:
* only the last one would be really used
* all the others would leak memory as amdgpu_cs_p1_bo_handles would
  overwrite the previous p->bo_list value

This commit rejects submissions with multiple BO_HANDLES chunks to
match the implementation of the parser.

Signed-off-by: default avatarPierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 80237bfc

drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c

+4 −0
Original line number Diff line number Diff line
@@ -263,6 +263,10 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, 
			if (size < sizeof(struct drm_amdgpu_bo_list_in))

				goto free_partial_kdata;



			/* Only a single BO list is allowed to simplify handling. */

			if (p->bo_list)

				ret = -EINVAL;



			ret = amdgpu_cs_p1_bo_handles(p, p->chunks[i].kdata);

			if (ret)

				goto free_partial_kdata;