From: Vitaly Prosyak <vitaly.prosyak@amd.com>

This series adds IGT tests for the proposed DRM_IOCTL_GEM_CHANGE_HANDLE
ioctl, which allows renaming a GEM buffer object handle within a DRM
file descriptor without closing and reopening it.

The ioctl is needed to close a TOCTOU race window in userspace GPU
command submission: an application reads a handle, the handle is
renamed before the kernel validates it, causing the kernel to operate
on a different object than the application intended.

Test structure (2 patches):

  Patch 1 - 7 race condition subtests validating that the kernel's
  locking prevents concurrent-access bugs:
    - race-change-vs-close
    - race-change-vs-change
    - race-change-vs-prime
    - race-aggressive-change-vs-close
    - race-exploit-single-thread
    - race-exploit-random-handles
    - race-close-before-lock

  Patch 2 - 5 edge-case and functional subtests validating correct
  error handling and basic operation:
    - noop-same-handle
    - invalid-new-handle-exceeds-int-max
    - invalid-handle-nonexistent
    - edge-new-handle-zero
    - functional-rename-verification

The tests are GPU-agnostic and work with both Intel i915 and AMD amdgpu
drivers via DRM core. They are placed in tests/intel/ following the IGT
convention for all gem_* tests.

Detection method: KASAN reports in dmesg (requires CONFIG_KASAN=y on
the test kernel) for concurrent-access races; errno validation for
error-handling tests.

Cc: Kamil Konieczny <kamil.konieczny@linux.intel.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Simona Vetter <simona@ffwll.ch>
Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>

Vitaly Prosyak (2):
  tests/intel: Add gem_change_handle_race test suite
  tests/intel/gem_change_handle_race: Add edge-case and functional
    subtests

 tests/intel/gem_change_handle_race.c | 1971 ++++++++++++++++++++++++++
 tests/meson.build                    |    1 +
 2 files changed, 1972 insertions(+)
 create mode 100644 tests/intel/gem_change_handle_race.c