[src/trunk]: src/sys/external/bsd/drm2/linux drm: Paranoia: handle fencep=nul...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/dfec33202335
branches:  trunk
changeset: 1028949:dfec33202335
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Sun Dec 19 12:33:42 2021 +0000

description:
drm: Paranoia: handle fencep=null, fence!=null, and 0 shared.

Not sure this is possible but I don't know the API well enough to
prove it can't happen.

diffstat:

 sys/external/bsd/drm2/linux/linux_dma_resv.c |  18 +++++++++++++-----
 1 files changed, 13 insertions(+), 5 deletions(-)

diffs (49 lines):

diff -r c09751cef8f4 -r dfec33202335 sys/external/bsd/drm2/linux/linux_dma_resv.c
--- a/sys/external/bsd/drm2/linux/linux_dma_resv.c      Sun Dec 19 12:33:34 2021 +0000
+++ b/sys/external/bsd/drm2/linux/linux_dma_resv.c      Sun Dec 19 12:33:42 2021 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: linux_dma_resv.c,v 1.19 2021/12/19 12:33:34 riastradh Exp $    */
+/*     $NetBSD: linux_dma_resv.c,v 1.20 2021/12/19 12:33:42 riastradh Exp $    */
 
 /*-
  * Copyright (c) 2018 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: linux_dma_resv.c,v 1.19 2021/12/19 12:33:34 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux_dma_resv.c,v 1.20 2021/12/19 12:33:42 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/poll.h>
@@ -758,7 +758,7 @@
        const struct dma_resv_list *list = NULL;
        struct dma_fence *fence = NULL;
        struct dma_fence **shared = NULL;
-       unsigned shared_alloc, shared_count, i;
+       unsigned shared_alloc = 0, shared_count, i;
        struct dma_resv_read_ticket ticket;
 
 top:   KASSERT(fence == NULL);
@@ -851,11 +851,19 @@
 
        /* Success!  */
        rcu_read_unlock();
+       KASSERT(shared_count <= shared_alloc);
+       KASSERT(shared_alloc == 0 || shared_count < shared_alloc);
+       KASSERT(shared_alloc <= UINT_MAX);
        if (fencep) {
                *fencep = fence;
        } else if (fence) {
-               KASSERT(shared_count < UINT_MAX);
-               shared[shared_count++] = fence;
+               if (shared_count) {
+                       shared[shared_count++] = fence;
+               } else {
+                       shared = kmalloc(sizeof(shared[0]), GFP_KERNEL);
+                       shared[0] = fence;
+                       shared_count = 1;
+               }
        }
        *nsharedp = shared_count;
        *sharedp = shared;