drm/amdgpu/vcn4: avoid rereading IB param length

Reuse the parameter length returned by
vcn_v4_0_enc_find_ib_param() instead of rereading it from
the IB.

This avoids a potential TOCTOU issue if the IB contents
change between reads.

Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
Reviewed-by: David Rosca <david.rosca@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit dbb02b4755f8c1f3773263f2d779872c1c0c073a)
Cc: stable@vger.kernel.org

diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
index ff7269bafae8ef7062e640425c9ee3009fe70949..894780669f9cf64cd84a7ac24e2429c66a60d19a 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
@@ -1927,14 +1927,17 @@ out:
 #define RENCODE_IB_PARAM_SESSION_INIT                  0x00000003
 
 /* return the offset in ib if id is found, -1 otherwise */
-static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int start)
+static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int start, uint32_t *length)
 {
        int i;
        uint32_t len;
 
        for (i = start; (len = amdgpu_ib_get_value(ib, i)) >= 8; i += len / 4) {
-               if (amdgpu_ib_get_value(ib, i + 1) == id)
+               if (amdgpu_ib_get_value(ib, i + 1) == id) {
+                       if (length)
+                               *length = len;
                        return i;
+               }
        }
        return -1;
 }
@@ -1944,14 +1947,14 @@ static int vcn_v4_0_ring_patch_cs_in_place(struct amdgpu_cs_parser *p,
                                           struct amdgpu_ib *ib)
 {
        struct amdgpu_ring *ring = amdgpu_job_ring(job);
-       uint32_t val;
+       uint32_t val, len;
        int idx = 0, sidx;
 
        /* The first instance can decode anything */
        if (!ring->me)
                return 0;
 
-       while ((idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO, idx)) >= 0) {
+       while ((idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO, idx, &len)) >= 0) {
                val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */
                if (val == RADEON_VCN_ENGINE_TYPE_DECODE) {
                        uint32_t valid_buf_flag = amdgpu_ib_get_value(ib, idx + 6);
@@ -1964,12 +1967,12 @@ static int vcn_v4_0_ring_patch_cs_in_place(struct amdgpu_cs_parser *p,
                                amdgpu_ib_get_value(ib, idx + 8);
                        return vcn_v4_0_dec_msg(p, job, msg_buffer_addr);
                } else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) {
-                       sidx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT, idx);
+                       sidx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT, idx, NULL);
                        if (sidx >= 0 &&
                            amdgpu_ib_get_value(ib, sidx + 2) == RENCODE_ENCODE_STANDARD_AV1)
                                return vcn_v4_0_limit_sched(p, job);
                }
-               idx += amdgpu_ib_get_value(ib, idx) / 4;
+               idx += len / 4;
        }
        return 0;
 }