drm/v3d: Don't allow two multisync extensions in the same job

Currently, two multisync extensions can be added to the same job and
only the last multisync extension will be used. To avoid this
vulnerability, don't allow two multisync extensions in the same job.

Signed-off-by: Maíra Canal <mcanal@igalia.com>
Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231130164420.932823-7-mcanal@igalia.com

diff --git a/drivers/gpu/drm/v3d/v3d_submit.c b/drivers/gpu/drm/v3d/v3d_submit.c
index a0caf9c499bbb336fb56471dc13a180c2ffc39b0..10141dc2820afc1060a7be55b99ba4da3b74df80 100644 (file)
--- a/drivers/gpu/drm/v3d/v3d_submit.c
+++ b/drivers/gpu/drm/v3d/v3d_submit.c
@@ -329,6 +329,11 @@ v3d_get_multisync_submit_deps(struct drm_file *file_priv,
        struct v3d_submit_ext *se = data;
        int ret;
 
+       if (se->in_sync_count || se->out_sync_count) {
+               DRM_DEBUG("Two multisync extensions were added to the same job.");
+               return -EINVAL;
+       }
+
        if (copy_from_user(&multisync, ext, sizeof(multisync)))
                return -EFAULT;