[PATCH v3 0/3] accel/amdxdna: SYNC_BO correctness fixes

Three independent fixes in and around amdxdna_drm_sync_bo_ioctl(). None of
them depend on each other.

Patch 1 refuses an I/O memory mapping of an imported BO, which the driver
currently stores as if it were an ordinary kernel address. Patches 2 and 3
fix two ways the ioctl mishandles its own range: a zero length reaching
drm_clflush_virt_range(), and an offset and size added to the BO address
without an overflow check, one level above a function that checks the same
arithmetic.

Changes in v3:
  - dropped the range patch ("flush only the requested range") and the
    quiet-vmap patch that existed only to serve it. Christian NAKed
    flushing an imported dma-buf, and the numbers in that patch came from
    exactly that case; I also have not tested its premise on a matching
    tree.
  - patch 1: corrected a wrong sentence in the commit message about which
    errno drm_gem_vmap_locked() returns.
  - patch 2: also says what changes for an imported BO, where a zero-length
    request currently flushes the whole scatterlist.

Refusing a sync on a genuinely foreign import is still being discussed on
the v2 thread and is not part of this series.

v2: https://lore.kernel.org/all/[email protected]/

Compile-tested on drm-misc-next only: x86_64 defconfig with
DRM_ACCEL_AMDXDNA=m, gcc 16.2.1, no W=1 warnings. Not booted, and not run
on hardware.

Taimuraz Kaitmazov (3):
  accel/amdxdna: refuse an I/O memory mapping of an imported BO
  accel/amdxdna: return early from a zero-length flush
  accel/amdxdna: check the sync range for overflow on a device BO

 drivers/accel/amdxdna/amdxdna_gem.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

-- 
2.55.0