[PATCH 3/4] drm/amdgpu/gfx9: replace BUG_ON with WARN_ON_ONCE for KIQ 64-bit fence flag

[jbmoore <jbmoore61@gmail.com>]

From: "John B. Moore" <jbmoore61@gmail.com>

gfx_v9_0_ring_emit_fence_kiq() contains a BUG_ON() that fires when
the AMDGPU_FENCE_FLAG_64BIT flag is passed.  The KIQ (Kernel
Interface Queue) ring only allocates 32-bit writeback buffer
addresses for fence sequence numbers.  A 64-bit fence write would
overflow the allocated writeback slot, potentially corrupting
adjacent kernel memory.

Replace BUG_ON() with WARN_ON_ONCE() and mask off the unsupported
flag.  This prevents the kernel panic while still logging the
unexpected condition and falling back to a safe 32-bit fence write.

This is separated from the main gfx9 BUG_ON conversion patch
because it addresses a different security concern (potential buffer
overflow in kernel-managed writeback memory) rather than the address
alignment assertions in the ring emission paths.

Found by a custom amdgpu DRM ioctl fuzzer.

Fixes: b1023571479020e9 ("drm/amdgpu: implement GFX 9.0 support (v2)")
Signed-off-by: John B. Moore <jbmoore61@gmail.com>
Cc: stable@vger.kernel.org
---
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 47e81c33d..fb2a0f1af 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -5679,7 +5679,8 @@ static void gfx_v9_0_ring_emit_fence_kiq(struct amdgpu_ring *ring, u64 addr,
 	struct amdgpu_device *adev = ring->adev;
 
 	/* we only allocate 32bit for each seq wb address */
-	BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
+	if (WARN_ON_ONCE(flags & AMDGPU_FENCE_FLAG_64BIT))
+		flags &= ~AMDGPU_FENCE_FLAG_64BIT;
 
 	/* write fence seq to the "addr" */
 	amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
-- 
2.43.0