On 10/07/2024 14:41, Tvrtko Ursulin wrote:

From: Tvrtko Ursulin tvrtko.ursulin@igalia.com

Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage where the ids will be copied into.

Signed-off-by: Tvrtko Ursulin tvrtko.ursulin@igalia.com Fixes: bae7cb5d6800 ("drm/v3d: Create a CPU job extension for the reset performance query job" Cc: Maíra Canal mcanal@igalia.com Cc: Iago Toral Quiroga itoral@igalia.com Cc: stable@vger.kernel.org # v6.8+

On this one I forgot to carry over from v1:

Reviewed-by: Iago Toral Quiroga itoral@igalia.com

Regards,

Tvrtko

---

drivers/gpu/drm/v3d/v3d_submit.c | 6 ++++++ 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/v3d/v3d_submit.c b/drivers/gpu/drm/v3d/v3d_submit.c index 88f63d526b22..263fefc1d04f 100644 --- a/drivers/gpu/drm/v3d/v3d_submit.c +++ b/drivers/gpu/drm/v3d/v3d_submit.c @@ -637,6 +637,9 @@ v3d_get_cpu_reset_performance_params(struct drm_file *file_priv, if (copy_from_user(&reset, ext, sizeof(reset))) return -EFAULT;

• if (reset.nperfmons > V3D_MAX_PERFMONS)

• return -EINVAL;
  

• job->job_type = V3D_CPU_JOB_TYPE_RESET_PERFORMANCE_QUERY;

job->performance_query.queries = kvmalloc_array(reset.count, @@ -708,6 +711,9 @@ v3d_get_cpu_copy_performance_query_params(struct drm_file *file_priv, if (copy.pad) return -EINVAL;

• if (copy.nperfmons > V3D_MAX_PERFMONS)

• return -EINVAL;
  

• job->job_type = V3D_CPU_JOB_TYPE_COPY_PERFORMANCE_QUERY;

job->performance_query.queries = kvmalloc_array(copy.count,