From af263f4e7dbf9b1e2253fbbaca6c0775127d491a Mon Sep 17 00:00:00 2001 From: jsg Date: Mon, 25 Sep 2023 03:19:38 +0000 Subject: [PATCH] drm/amdgpu: fix amdgpu_cs_p1_user_fence From Christian Koenig 4c6bb91581796d34466d85bc06c9393d27f83101 in linux-6.1.y/6.1.55 35588314e963938dfdcdb792c9170108399377d6 in mainline linux --- sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c index 0508926871a..3fb90768002 100644 --- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c +++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c @@ -120,7 +120,6 @@ static int amdgpu_cs_p1_user_fence(struct amdgpu_cs_parser *p, struct drm_gem_object *gobj; struct amdgpu_bo *bo; unsigned long size; - int r; gobj = drm_gem_object_lookup(p->filp, data->handle); if (gobj == NULL) @@ -132,23 +131,14 @@ static int amdgpu_cs_p1_user_fence(struct amdgpu_cs_parser *p, drm_gem_object_put(gobj); size = amdgpu_bo_size(bo); - if (size != PAGE_SIZE || (data->offset + 8) > size) { - r = -EINVAL; - goto error_unref; - } + if (size != PAGE_SIZE || data->offset > (size - 8)) + return -EINVAL; - if (amdgpu_ttm_tt_get_usermm(bo->tbo.ttm)) { - r = -EINVAL; - goto error_unref; - } + if (amdgpu_ttm_tt_get_usermm(bo->tbo.ttm)) + return -EINVAL; *offset = data->offset; - return 0; - -error_unref: - amdgpu_bo_unref(&bo); - return r; } static int amdgpu_cs_p1_bo_handles(struct amdgpu_cs_parser *p, -- 2.20.1