[PATCH v2 0/2] drm/amdgpu: reject misaligned IB addresses in CS parser

["John B. Moore" <jbmoore61@gmail.com>]

Userspace can submit command streams with IB addresses whose low two
bits are set.  On all hardware that amdgpu supports, those bits are
reserved (they encoded byte-swap mode on pre-amdgpu legacy HW).
Today these addresses pass through the CS parser unchecked and hit
BUG_ON(addr & 0x3) assertions in ring emission callbacks across
gfx_v9 through gfx_v12 and sdma_v4 through sdma_v7 (35 call sites),
crashing the kernel.

Patch 1 adds an early -EINVAL rejection in the CS parser before the
IB is allocated, plus a defense-in-depth WARN_ON_ONCE in
amdgpu_ib_schedule() to catch any that slip through from other code
paths.

Patch 2 is a trivial cleanup: removing a dead BUG_ON(!bo_va) in
amdgpu_cs_vm_handling() that is unreachable due to the NULL check on
the line above.

A follow-up series could convert the 35 downstream BUG_ON(addr & 0x3)
assertions in the ring emit_ib callbacks to WARN_ON_ONCE, but that is
a larger change and is not included here.

v2:
 - Rebased onto amd-staging-drm-next (was incorrectly based on a
   local branch in v1 — thanks Christian for catching this)
 - Split the dead-code BUG_ON removal into a separate patch
 - Moved the check before amdgpu_ib_get() to avoid unnecessary
   IB allocation on bad input
 - Added Fixes: tag and Cc: stable

John B. Moore (2):
  drm/amdgpu: reject IB addresses with reserved byte-swap bits
  drm/amdgpu: remove superfluous BUG_ON in amdgpu_cs_vm_handling

 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c |  9 ++++++++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 10 ++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

-- 
2.43.0