drm/amdgpu: validate fence_count in wait_fences ioctl

Add an early parameter check in amdgpu_cs_wait_fences_ioctl() to reject
a zero fence_count with -EINVAL.

dma_fence_wait_any_timeout() requires count > 0. When userspace passes
fence_count == 0, the call propagates down to dma_fence core which does
not expect a zero-length array and triggers a WARN_ON.

Return -EINVAL immediately so the caller gets a clear error instead of
hitting an unexpected warning in the DMA fence subsystem.

No functional change for well-formed userspace callers.

v2:
- Reworked commit message to clarify the parameter validation rationale
- Removed verbose crash log from commit description
- Simplified inline code comment

Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jesse Zhang <jesse.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 70ea9b0831a0e63e6eb82ae5d3661e0d300b3ced..c048217615c1f9fdd436ba69ea83f7a30d1f4f79 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -1740,6 +1740,13 @@ int amdgpu_cs_wait_fences_ioctl(struct drm_device *dev, void *data,
        struct drm_amdgpu_fence *fences;
        int r;
 
+       /*
+        * fence_count must be non-zero; dma_fence_wait_any_timeout()
+        * does not accept an empty fence array.
+        */
+       if (!wait->in.fence_count)
+               return -EINVAL;
+
        /* Get the fences from userspace */
        fences = memdup_array_user(u64_to_user_ptr(wait->in.fences),
                                   wait->in.fence_count,