drm/amdgpu: fix user fence handling once more

Same problem as with the VM page tables. The user fence address must be
determined before the job is scheduled, not when the IB is executed.

This fixes a security problem where user fences could be used to overwrite
any part of VRAM.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Chunming Zhou <david1.zhou@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

1 files changed, 6 insertions, 6 deletions

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 95b248159947..475c95f670f8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -216,11 +216,8 @@ int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
         if (ret)
                 goto free_all_kdata;
 
-        if (p->uf_entry.robj) {
-                p->job->uf_bo = amdgpu_bo_ref(p->uf_entry.robj);
-                p->job->uf_offset = uf_offset;
-        }
-
+        if (p->uf_entry.robj)
+                p->job->uf_addr = uf_offset;
         kfree(chunk_array);
         return 0;
 
@@ -502,6 +499,9 @@ static int amdgpu_cs_parser_bos(struct amdgpu_cs_parser *p,
                 }
         }
 
+        if (p->uf_entry.robj)
+                p->job->uf_addr += amdgpu_bo_gpu_offset(p->uf_entry.robj);
+
 error_validate:
         if (r) {
                 amdgpu_vm_move_pt_bos_in_lru(p->adev, &fpriv->vm);
@@ -767,7 +767,7 @@ static int amdgpu_cs_ib_fill(struct amdgpu_device *adev,
         }
 
         /* UVD & VCE fw doesn't support user fences */
-        if (parser->job->uf_bo && (
+        if (parser->job->uf_addr && (
             parser->job->ring->type == AMDGPU_RING_TYPE_UVD ||
             parser->job->ring->type == AMDGPU_RING_TYPE_VCE))
                 return -EINVAL;