drm/amdgpu: validate GEM_CREATE domain combinations

AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK,
but did not validate domain combinations. Userspace could combine
CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making
amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and
hit BUG_ON().

Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/
VRAM domains to be specified one at a time. Return -EINVAL for invalid
combinations in amdgpu_gem_create_ioctl().

v2: Rename helper from amdgpu_gem_domain_valid() to
    amdgpu_gem_are_domains_valid() (Christian)

Signed-off-by: Candice Li <candice.li@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit db39852d0c39843cb02048dfb47e4b8c703e9080)
Cc: stable@vger.kernel.org

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 6a0699746fbcd6f19936f4b2b99493a88291a703..f754a4a3a1c22dbb5f3bd13b91c179543db02269 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -397,6 +397,25 @@ const struct drm_gem_object_funcs amdgpu_gem_object_funcs = {
        .vm_ops = &amdgpu_gem_vm_ops,
 };
 
+static bool amdgpu_gem_are_domains_valid(u32 domains)
+{
+       u32 normal = AMDGPU_GEM_DOMAIN_CPU |
+                    AMDGPU_GEM_DOMAIN_GTT |
+                    AMDGPU_GEM_DOMAIN_VRAM;
+       /* Treat all non CPU/GTT/VRAM domains as special domains. */
+       u32 special = AMDGPU_GEM_DOMAIN_MASK & ~normal;
+       u32 normal_mask = domains & normal;
+       u32 special_mask = domains & special;
+
+       if (!special_mask)
+               return true;
+
+       if (normal_mask)
+               return false;
+
+       return !(special_mask & (special_mask - 1));
+}
+
 /*
  * GEM ioctls.
  */
@@ -421,6 +440,8 @@ int amdgpu_gem_create_ioctl(struct drm_device *dev, void *data,
        /* reject invalid gem domains */
        if (args->in.domains & ~AMDGPU_GEM_DOMAIN_MASK)
                return -EINVAL;
+       if (!amdgpu_gem_are_domains_valid(args->in.domains))
+               return -EINVAL;
 
        if (!amdgpu_is_tmz(adev) && (flags & AMDGPU_GEM_CREATE_ENCRYPTED)) {
                DRM_NOTE_ONCE("Cannot allocate secure buffer since TMZ is disabled\n");