drm/amdgpu: fix amdgpu_cs_p1_user_fence

From Christian Koenig
4c6bb91581796d34466d85bc06c9393d27f83101 in linux-6.1.y/6.1.55
35588314e963938dfdcdb792c9170108399377d6 in mainline linux

diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
index 0508926..3fb9076 100644 (file)
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
@@ -120,7 +120,6 @@ static int amdgpu_cs_p1_user_fence(struct amdgpu_cs_parser *p,
        struct drm_gem_object *gobj;
        struct amdgpu_bo *bo;
        unsigned long size;
-       int r;
 
        gobj = drm_gem_object_lookup(p->filp, data->handle);
        if (gobj == NULL)
@@ -132,23 +131,14 @@ static int amdgpu_cs_p1_user_fence(struct amdgpu_cs_parser *p,
        drm_gem_object_put(gobj);
 
        size = amdgpu_bo_size(bo);
-       if (size != PAGE_SIZE || (data->offset + 8) > size) {
-               r = -EINVAL;
-               goto error_unref;
-       }
+       if (size != PAGE_SIZE || data->offset > (size - 8))
+               return -EINVAL;
 
-       if (amdgpu_ttm_tt_get_usermm(bo->tbo.ttm)) {
-               r = -EINVAL;
-               goto error_unref;
-       }
+       if (amdgpu_ttm_tt_get_usermm(bo->tbo.ttm))
+               return -EINVAL;
 
        *offset = data->offset;
-
        return 0;
-
-error_unref:
-       amdgpu_bo_unref(&bo);
-       return r;
 }
 
 static int amdgpu_cs_p1_bo_handles(struct amdgpu_cs_parser *p,