From: Jesse.Zhang Date: Fri, 13 Mar 2026 05:12:33 +0000 (+0800) Subject: drm/amdgpu: validate fence_count in wait_fences ioctl X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2cef848812a071991c20090cbe051a0a96c50a0c;p=thirdparty%2Flinux.git drm/amdgpu: validate fence_count in wait_fences ioctl Add an early parameter check in amdgpu_cs_wait_fences_ioctl() to reject a zero fence_count with -EINVAL. dma_fence_wait_any_timeout() requires count > 0. When userspace passes fence_count == 0, the call propagates down to dma_fence core which does not expect a zero-length array and triggers a WARN_ON. Return -EINVAL immediately so the caller gets a clear error instead of hitting an unexpected warning in the DMA fence subsystem. No functional change for well-formed userspace callers. v2: - Reworked commit message to clarify the parameter validation rationale - Removed verbose crash log from commit description - Simplified inline code comment Reviewed-by: Vitaly Prosyak Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher --- diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index 70ea9b0831a0e..c048217615c1f 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -1740,6 +1740,13 @@ int amdgpu_cs_wait_fences_ioctl(struct drm_device *dev, void *data, struct drm_amdgpu_fence *fences; int r; + /* + * fence_count must be non-zero; dma_fence_wait_any_timeout() + * does not accept an empty fence array. + */ + if (!wait->in.fence_count) + return -EINVAL; + /* Get the fences from userspace */ fences = memdup_array_user(u64_to_user_ptr(wait->in.fences), wait->in.fence_count,