Several independent error paths in the Rocket job submission ioctl can be triggered by unprivileged userspace. This series validates userspace BO counts before passing them to helpers with signed count parameters, collects implicit dependencies before the scheduler job is armed, and propagates the first per-job submission error to userspace.
The series was tested on RK3588 with zero task counts, invalid task pointers, invalid BO handles, and oversized BO counts. The requests returned the expected error codes without warnings or errors in the kernel log. Changes in v5: - Replaced the nickname in the author identity and Signed-off-by tags with my real name, as requested by Greg Kroah-Hartman. Changes in v4: - Added Sidong Yang's Reviewed-by tags, using the corrected email address. - Dropped Cc: stable from patch 3 because propagating submission errors changes userspace-visible ioctl behavior. - Rebased onto the current drm-misc-next branch. Changes in v3: - Kept the individual count checks before GEM lookup, but changed bo_count to int so check_add_overflow() rejects combined counts above INT_MAX, as suggested by Sidong Yang. Changes in v2: - Split the three independent fixes into separate patches as suggested by Sidong Yang. - Rebased onto the then-current drm-misc-next branch. - Dropped incidental blank-line-only changes from the original patch. - Added Sidong Yang's Tested-by tag. v4: https://lore.kernel.org/r/[email protected] v3: https://lore.kernel.org/r/[email protected] v2: https://lore.kernel.org/r/[email protected] v1: https://lore.kernel.org/r/[email protected] Haoming Gao (3): accel/rocket: Validate BO handle counts on job submission accel/rocket: Collect job dependencies before arming accel/rocket: Propagate job submission errors drivers/accel/rocket/rocket_job.c | 32 ++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) base-commit: f9c2f70ee41544717b3c209083073db1e21f919b -- 2.43.0
