Patch 3 rejects misaligned regcmd addresses and out-of-range regcmd counts at submission. It is unchanged from v1.
Patches 1 and 2 fix two pre-existing issues from Sashiko's review of v1. Of its other findings, the ignored submit error [1], the iommu_group leak [2] and the unchecked allocation in rocket_job_open() [3] are handled by patches already on the list. Until [1] lands, a job that patch 3 rejects is dropped, but the ioctl still returns 0. The __u32 regcmd cannot truncate an IOVA, as the rockchip IOMMU aperture is 32-bit. Tested on RK3588 (ROCK 5B+): Teflon MobileNet v1 output and latency are unchanged, the bad regcmd values are rejected, and an injected drm_sched_init() failure fails probe cleanly. Changes in v2: - Add patches 1 and 2. - Rebase onto drm-misc-next. v1: https://lore.kernel.org/r/[email protected]/ [1] https://lore.kernel.org/r/[email protected]/ [2] https://lore.kernel.org/r/[email protected]/ [3] https://lore.kernel.org/r/[email protected]/ Sidong Yang (3): accel/rocket: Don't tear down the scheduler when drm_sched_init() fails accel/rocket: Use an unsigned index to copy the job's tasks accel/rocket: Validate task regcmd address and count on submission drivers/accel/rocket/rocket_job.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) base-commit: 70456f05d4b6396b22048c4b8cd3cb98ecf9f9e3 -- 2.53.0
