amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_handle
into the doorbell domain. For a regular BO, TTM moves it with
ttm_bo_move_null() and its contents are lost. Since an importer on the
same device gets the exporter's GEM object, a client can do this to a
buffer another client shared with it.
Reject BOs that were not created in the doorbell domain.
Fixes: f09c1e6077ab ("drm/amdgpu: generate doorbell index for userqueue")
Signed-off-by: Jesse Zhang <[email protected]>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
index 89e03d3a930c..a5733a18dc52 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
@@ -477,6 +477,16 @@ amdgpu_userq_get_doorbell_index(struct amdgpu_userq_mgr
*uq_mgr,
return -EINVAL;
}
+ /*
+ * Pinning a regular BO into the doorbell domain would discard its
+ * contents, possibly those of a buffer shared by another client.
+ */
+ if (!(gem_to_amdgpu_bo(gobj)->preferred_domains &
AMDGPU_GEM_DOMAIN_DOORBELL)) {
+ drm_file_err(uq_mgr->file, "Doorbell handle is not a doorbell
BO\n");
+ drm_gem_object_put(gobj);
+ return -EINVAL;
+ }
+
db_obj->obj = amdgpu_bo_ref(gem_to_amdgpu_bo(gobj));
drm_gem_object_put(gobj);
--
2.50.1
