From: Alex Deucher <alexander.deucher@amd.com>
Date: Wed, 26 Feb 2025 21:31:57 +0000 (-0500)
Subject: drm/amdgpu: validate user queue parameters
X-Git-Tag: v6.16-rc1~144^2~10^2~266
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=158bfbc72c5d7675039df540b120ccdd37bca5f0;p=thirdparty%2Fkernel%2Fstable.git

drm/amdgpu: validate user queue parameters

Make sure these are set properly to ensure compatibility if
we ever update the IOCTL interface.

Reviewed-by: Prike Liang <Prike.Liang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userqueue.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userqueue.c
index a78a3728f6b80..a02614cbda36e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userqueue.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userqueue.c
@@ -380,12 +380,26 @@ int amdgpu_userq_ioctl(struct drm_device *dev, void *data,
 
 	switch (args->in.op) {
 	case AMDGPU_USERQ_OP_CREATE:
+		if (args->in._pad)
+			return -EINVAL;
 		r = amdgpu_userqueue_create(filp, args);
 		if (r)
 			DRM_ERROR("Failed to create usermode queue\n");
 		break;
 
 	case AMDGPU_USERQ_OP_FREE:
+		if (args->in.ip_type ||
+		    args->in.doorbell_handle ||
+		    args->in.doorbell_offset ||
+		    args->in._pad ||
+		    args->in.queue_va ||
+		    args->in.queue_size ||
+		    args->in.rptr_va ||
+		    args->in.wptr_va ||
+		    args->in.wptr_va ||
+		    args->in.mqd ||
+		    args->in.mqd_size)
+			return -EINVAL;
 		r = amdgpu_userqueue_destroy(filp, args->in.queue_id);
 		if (r)
 			DRM_ERROR("Failed to destroy usermode queue\n");