drm/i915: check for multiple write domains in pin_and_relocate

The assumption that an object has only ever one write domain is deeply
threaded into gem (it's even encoded the the singular of the variable
name). Don't let userspace screw us over.

Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Eric Anholt <eric@anholt.net>

1 files changed, 10 insertions, 0 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 6fe54db8f33c..fba37e9f775d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3367,6 +3367,16 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                 }
 
                 /* Validate that the target is in a valid r/w GPU domain */
+                if (reloc->write_domain & (reloc->write_domain - 1)) {
+                        DRM_ERROR("reloc with multiple write domains: "
+                                  "obj %p target %d offset %d "
+                                  "read %08x write %08x",
+                                  obj, reloc->target_handle,
+                                  (int) reloc->offset,
+                                  reloc->read_domains,
+                                  reloc->write_domain);
+                        return -EINVAL;
+                }
                 if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||
                     reloc->read_domains & I915_GEM_DOMAIN_CPU) {
                         DRM_ERROR("reloc with read/write CPU domains: "