From nobody Sat Sep 26 23:53:36 2026 Received: from mail-m155101.qiye.163.com (mail-m155101.qiye.163.com [101.71.155.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 14E353CC9F2; Fri, 28 Aug 2026 06:42:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=101.71.155.101 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899331; cv=none; b=cFV22eMKVfqpDxf+gAhoDGlO7R91noM3jg5xEzEuKX5yDR0RBw2bn0M38dTytGlftSXQmjOk9wNjNR/QYIoDw8fp7y0AQKyv8Bb9t92ePW5dkUQ/8SxmCOwwiE4djGzjBPozKN6Kdy4EVudFr9OlFaftYpLGBmZ6s2tRUkuOctM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899331; c=relaxed/simple; bh=Ma0n0LLajuwqcX2u4vBvkkqmcwmsAHbP8K0mAAiq4m8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oL6e6PxpvO7YWAsQkEnEoB7Dhy75zTnZxNdOYSHr71BBlZs9U1kBlFj1fRyB7R0o6CwzTy+1lxpqRl5QOB6PFCvg40yzXihXu2PwCzQqvzTfARvu0SMgFSB3FXRbR33tCHLQbUiqcOZtWrkW3ahju3/G9S0XBkF24X0dXVLYy9w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=whut.edu.cn; spf=pass smtp.mailfrom=whut.edu.cn; arc=none smtp.client-ip=101.71.155.101 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=whut.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=whut.edu.cn Received: from Mogu.localdomain (unknown [223.73.65.69]) by smtp.qiye.163.com (Hmail) with ESMTP id 4baa740d7; Fri, 28 Aug 2026 14:42:05 +0800 (GMT+08:00) From: Haoming Gao To: Tomeu Vizoso Cc: Oded Gabbay , Jeff Hugo , Sidong Yang , Greg KH , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v5 1/3] accel/rocket: Validate BO handle counts on job submission Date: Fri, 28 Aug 2026 14:41:50 +0800 Message-ID: <20260828064152.37822-2-Naixumogu@whut.edu.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260828064152.37822-1-Naixumogu@whut.edu.cn> References: <20260828064152.37822-1-Naixumogu@whut.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0aa0471aabdd03a1kunmd9ea7a958c2ac X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUtXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVlCSkMZVkxITB8aSRkZQxgZQ1YeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlJSUhVTEhVTU5VTUJZV1kWGg8SFR0UWUFZS1VLVUtVS1kG Content-Type: text/plain; charset="utf-8" The input and output BO handle counts are __u32, while GEM lookup and reservation helpers take int counts. A count above INT_MAX cannot be represented safely by the GEM lookup helper. Reject each count above INT_MAX before looking up the BOs. rocket_job_push() already uses check_add_overflow() for the combined count, but stores the result in u32, so it only detects unsigned wraparound. Store the result in int so sums above INT_MAX are rejected before the count is passed to the reservation helpers. Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL") Cc: stable@vger.kernel.org Tested-by: Sidong Yang Reviewed-by: Sidong Yang Signed-off-by: Haoming Gao --- drivers/accel/rocket/rocket_job.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocke= t_job.c index bb77b6bf0f231..e6052d1973afa 100644 --- a/drivers/accel/rocket/rocket_job.c +++ b/drivers/accel/rocket/rocket_job.c @@ -190,7 +190,7 @@ static int rocket_job_push(struct rocket_job *job) struct rocket_device *rdev =3D job->rdev; struct drm_gem_object **bos; struct ww_acquire_ctx acquire_ctx; - u32 bo_count; + int bo_count; int ret =3D 0; =20 if (check_add_overflow(job->in_bo_count, job->out_bo_count, &bo_count)) @@ -556,6 +556,11 @@ static int rocket_ioctl_submit_job(struct drm_device *= dev, struct drm_file *file if (job->task_count =3D=3D 0) return -EINVAL; =20 + /* GEM lookup takes a signed object count. */ + if (job->in_bo_handle_count > INT_MAX || + job->out_bo_handle_count > INT_MAX) + return -EINVAL; + rjob =3D kzalloc_obj(*rjob); if (!rjob) return -ENOMEM; --=20 2.43.0 From nobody Sat Sep 26 23:53:36 2026 Received: from mail-m155101.qiye.163.com (mail-m155101.qiye.163.com [101.71.155.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 14F493CD8CC; Fri, 28 Aug 2026 06:42:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=101.71.155.101 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899332; cv=none; b=VJNxAe9bBMwexjbxGICqTLzfXiBThdEzDt3MlKLefUJnNRxy/FSK/uFtsOynG4rJQTyqBNiJKsto4vGUPcke9op2oyKP40UEpUndH2EM7CMAUcyt46HbAKZ0JjNYidTalA2RHSmIRivrGNTj4hAEXLS3bpoc1A91pBVZSu3kBPc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899332; c=relaxed/simple; bh=bcpa63J0o25IM6NFvk4XKQTyi0xgLbuzf4zdAkKoglQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=W8gpZo5K075/nccRzR47nzxUONMVEENoqR/lP33GQgS3iYaJnQnHOJIoK0KY+amxdy6AhKRlkmVCqROuBfndGRnDbbXMSffd3TOUTdE7XeQXyqJxUYvy97JTu6QgFYRvg39jGPmbEJtWkp/DOYqshPvHlToowzrDhvE80b1yOCE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=whut.edu.cn; spf=pass smtp.mailfrom=whut.edu.cn; arc=none smtp.client-ip=101.71.155.101 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=whut.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=whut.edu.cn Received: from Mogu.localdomain (unknown [223.73.65.69]) by smtp.qiye.163.com (Hmail) with ESMTP id 4baa740d9; Fri, 28 Aug 2026 14:42:06 +0800 (GMT+08:00) From: Haoming Gao To: Tomeu Vizoso Cc: Oded Gabbay , Jeff Hugo , Sidong Yang , Greg KH , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v5 2/3] accel/rocket: Collect job dependencies before arming Date: Fri, 28 Aug 2026 14:41:51 +0800 Message-ID: <20260828064152.37822-3-Naixumogu@whut.edu.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260828064152.37822-1-Naixumogu@whut.edu.cn> References: <20260828064152.37822-1-Naixumogu@whut.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0aa0471aaec303a1kunmd9ea7a958c2ae X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUtXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVkaSU9JVklMHUJOGkpIGUsaSlYeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlJSUhVTEhVTU5VTUJZV1kWGg8SFR0UWUFZS1VLVUtVS1kG Content-Type: text/plain; charset="utf-8" rocket_job_push() arms the scheduler job before collecting its implicit dependencies. Dependency collection can fail with -ENOMEM, but an armed job must be pushed and must not be aborted with drm_sched_job_cleanup(). Collect dependencies before taking the scheduler lock and arming the job. Only operations that cannot fail remain after drm_sched_job_arm(). Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL") Cc: stable@vger.kernel.org Tested-by: Sidong Yang Reviewed-by: Sidong Yang Signed-off-by: Haoming Gao --- drivers/accel/rocket/rocket_job.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocke= t_job.c index e6052d1973afa..b55e12aecfe64 100644 --- a/drivers/accel/rocket/rocket_job.c +++ b/drivers/accel/rocket/rocket_job.c @@ -206,19 +206,21 @@ static int rocket_job_push(struct rocket_job *job) if (ret) goto err; =20 + ret =3D rocket_acquire_object_fences(job->in_bos, job->in_bo_count, + &job->base, false); + if (ret) + goto err_unlock; + + ret =3D rocket_acquire_object_fences(job->out_bos, job->out_bo_count, + &job->base, true); + if (ret) + goto err_unlock; + scoped_guard(mutex, &rdev->sched_lock) { drm_sched_job_arm(&job->base); =20 job->inference_done_fence =3D dma_fence_get(&job->base.s_fence->finished= ); =20 - ret =3D rocket_acquire_object_fences(job->in_bos, job->in_bo_count, &job= ->base, false); - if (ret) - goto err_unlock; - - ret =3D rocket_acquire_object_fences(job->out_bos, job->out_bo_count, &j= ob->base, true); - if (ret) - goto err_unlock; - kref_get(&job->refcount); /* put by scheduler job completion */ =20 drm_sched_entity_push_job(&job->base); --=20 2.43.0 From nobody Sat Sep 26 23:53:36 2026 Received: from mail-m49198.qiye.163.com (mail-m49198.qiye.163.com [45.254.49.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78FAC3CF022 for ; Fri, 28 Aug 2026 06:42:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899333; cv=none; b=eiCxsWxIUwiK7sOvxmKi8b7TKUeDlMUNV4s5goEaPCN2ZxRqXP6O5ZsXKPLrZGlwnVujIrq9jO9Vz+ycG+sNw1BgaHDhmL7ZBanx8tRzzwv9ip6JtJzjE+xdh44W6Wzz04jbP0Z0ws/lM9V452tBkwXtd5ErTOrjNLBBSYk6xNQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899333; c=relaxed/simple; bh=vGIRh1kqf7llqeCq0N9hLd8WSu9nf8rErsZuKeopqQI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iPphBJiF2XOG4jz0P+aFSy+Wz0m+G4GpLqRaka7/GDUK1i3PlRgdTjypdobD29nWYRRu2NSk6+teJZgoSeIruMgqBKQIRGiSBhvyZqoifuE/KyJqsadKuwSTj/tUWzRISD+dKc9dVI/pSO1poBNvLxGhVzL7B4K5zEjlxcWs54U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=whut.edu.cn; spf=pass smtp.mailfrom=whut.edu.cn; arc=none smtp.client-ip=45.254.49.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=whut.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=whut.edu.cn Received: from Mogu.localdomain (unknown [223.73.65.69]) by smtp.qiye.163.com (Hmail) with ESMTP id 4baa740db; Fri, 28 Aug 2026 14:42:06 +0800 (GMT+08:00) From: Haoming Gao To: Tomeu Vizoso Cc: Oded Gabbay , Jeff Hugo , Sidong Yang , Greg KH , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [PATCH v5 3/3] accel/rocket: Propagate job submission errors Date: Fri, 28 Aug 2026 14:41:52 +0800 Message-ID: <20260828064152.37822-4-Naixumogu@whut.edu.cn> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260828064152.37822-1-Naixumogu@whut.edu.cn> References: <20260828064152.37822-1-Naixumogu@whut.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0aa0471ab19303a1kunmd9ea7a958c2b3 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUtXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVkZGEkeVh1KTkwYHUNJTktMQ1YeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlJSUhVTEhVTU5VTUJZV1kWGg8SFR0UWUFZS1VLVUtVS1kG Content-Type: text/plain; charset="utf-8" rocket_ioctl_submit() discards each job's return value and reports success even when every job fails. Return the first error and stop submitting the remaining jobs. Jobs queued before an error remain queued, giving the ioctl ordered partial-submit semantics. Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL") Tested-by: Sidong Yang Reviewed-by: Sidong Yang Signed-off-by: Haoming Gao --- drivers/accel/rocket/rocket_job.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocke= t_job.c index b55e12aecfe64..8f1bdf4a57f20 100644 --- a/drivers/accel/rocket/rocket_job.c +++ b/drivers/accel/rocket/rocket_job.c @@ -646,8 +646,11 @@ int rocket_ioctl_submit(struct drm_device *dev, void *= data, struct drm_file *fil } =20 =20 - for (i =3D 0; i < args->job_count; i++) - rocket_ioctl_submit_job(dev, file, &jobs[i]); + for (i =3D 0; i < args->job_count; i++) { + ret =3D rocket_ioctl_submit_job(dev, file, &jobs[i]); + if (ret) + goto exit; + } =20 exit: kvfree(jobs); --=20 2.43.0