Skip to contentSkip to conversation

drm/panthor: validate group queue count

PATCH Superseded Chia-I Wu 3 participants 3 messages Sep 2, 2025 – Sep 3, 2025

Subsystems (3)
DRM drivers DRM misc Arm Mali panthor DRM driver

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Chia-I Wu

author
#0 lore raw

PATCH 1/1 drm/panthor: validate group queue count

A panthor group can have at most MAX_CS_PER_CSG panthor queues.

Signed-off-by Chia-I Wu <[email protected]>
---
 drivers/gpu/drm/panthor/panthor_sched.c | 3 +++
 1 file changed, 3 insertions(+)
drivers/gpu/drm/panthor/panthor_sched.c +3 -0
index ba5dc3e443d9c..249ab889ca91f 100644
@@ -3473,6 +3473,9 @@ int panthor_group_create(struct panthor_file *pfile,
 	    hweight64(group_args->tiler_core_mask) < group_args->max_tiler_cores)
 		return -EINVAL;
 
+	if (group_args->queues.count > MAX_CS_PER_CSG)
+		return -EINVAL;
+
 	group = kzalloc(sizeof(*group), GFP_KERNEL);
 	if (!group)
 		return -ENOMEM;
Signature · 1 line
2.51.0.338.gd7d06c2dae-goog
maintainer Reviewed-by on v1 1/1
#1 lore raw
Quoted 3 lines · On Tue, 2 Sep 2025 12:20:01 -0700 Chia-I Wu <[email protected]> wrote:

A panthor group can have at most MAX_CS_PER_CSG panthor queues.

Signed-off-by Chia-I Wu <[email protected]>

With a proper Fixes tag, this is

Reviewed-by Boris Brezillon <[email protected]>
Quoted 18 lines
---
 drivers/gpu/drm/panthor/panthor_sched.c | 3 +++
 1 file changed, 3 insertions(+)
drivers/gpu/drm/panthor/panthor_sched.c +3 -0
index ba5dc3e443d9c..249ab889ca91f 100644
@@ -3473,6 +3473,9 @@ int panthor_group_create(struct panthor_file *pfile,
 	    hweight64(group_args->tiler_core_mask) < group_args->max_tiler_cores)
 		return -EINVAL;
 
+	if (group_args->queues.count > MAX_CS_PER_CSG)
+		return -EINVAL;
+
 	group = kzalloc(sizeof(*group), GFP_KERNEL);
 	if (!group)
 		return -ENOMEM;
maintainer Reviewed-by on v1 1/1
#2 lore raw
In reply to Chia-I Wu
Quoted 3 lines · Chia-I Wu

A panthor group can have at most MAX_CS_PER_CSG panthor queues.

Signed-off-by Chia-I Wu <[email protected]>

Good catch - that's a nasty bug.

I think this should have:

Fixes de8548813824 ("drm/panthor: Add the scheduler logical block")
Quoted 9 lines
---
 drivers/gpu/drm/panthor/panthor_sched.c | 3 +++
 1 file changed, 3 insertions(+)
drivers/gpu/drm/panthor/panthor_sched.c +0 -0
index ba5dc3e443d9c..249ab889ca91f 100644

drivers/gpu/drm/panthor/panthor_sched.c int panthor_group_create(struct panthor_file *pfile, · line 3478

Quoted 6 lines
drivers/gpu/drm/panthor/panthor_sched.c +3 -0
@@ -3473,6 +3473,9 @@ int panthor_group_create(struct panthor_file *pfile,
 	    hweight64(group_args->tiler_core_mask) < group_args->max_tiler_cores)
 		return -EINVAL;
 
+	if (group_args->queues.count > MAX_CS_PER_CSG)
+		return -EINVAL;
+

I think this check would be better moved up to panthor_ioctl_group_create() (where we already have a zero check). But either way:

Reviewed-by Steven Price <[email protected]>

Thanks,
Steve

Quoted 3 lines
drivers/gpu/drm/panthor/panthor_sched.c +0 -0
 	group = kzalloc(sizeof(*group), GFP_KERNEL);
 	if (!group)
 		return -ENOMEM;