drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit

From Pierre-Eric Pelloux-Prayer
44e4aeaef96b2624b341597b1a8e595c89925892 in linux-6.6.y/6.6.55
fec5f8e8c6bcf83ed7a392801d7b44c5ecfc1e82 in mainline linux

diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
index dca5c07..784e66c 100644 (file)
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
@@ -263,6 +263,10 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
                        if (size < sizeof(struct drm_amdgpu_bo_list_in))
                                goto free_partial_kdata;
 
+                       /* Only a single BO list is allowed to simplify handling. */
+                       if (p->bo_list)
+                               ret = -EINVAL;
+
                        ret = amdgpu_cs_p1_bo_handles(p, p->chunks[i].kdata);
                        if (ret)
                                goto free_partial_kdata;