drm/sched: Fix bounds limiting when given a malformed entity

If we're given a malformed entity in drm_sched_entity_init()--shouldn't
happen, but we verify--with out-of-bounds priority value, we set it to an
allowed value. Fix the expression which sets this limit.

Signed-off-by: Luben Tuikov <ltuikov89@gmail.com>
Fixes: 56e449603f0ac5 ("drm/sched: Convert the GPU scheduler to variable number of run-queues")
Link: https://patchwork.freedesktop.org/patch/msgid/20231123122422.167832-2-ltuikov89@gmail.com
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/dbb91dbe-ef77-4d79-aaf9-2adb171c1d7a@amd.com

diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
index 4d42b1e4daa67fcacb382094a7c04af1dab69384..ee645d38e98d94f30563c2421dcfd4f8979215ce 100644 (file)
--- a/drivers/gpu/drm/scheduler/sched_entity.c
+++ b/drivers/gpu/drm/scheduler/sched_entity.c
@@ -81,12 +81,15 @@ int drm_sched_entity_init(struct drm_sched_entity *entity,
                 */
                pr_warn("%s: called with uninitialized scheduler\n", __func__);
        } else if (num_sched_list) {
-               /* The "priority" of an entity cannot exceed the number
-                * of run-queues of a scheduler.
+               /* The "priority" of an entity cannot exceed the number of run-queues of a
+                * scheduler. Protect against num_rqs being 0, by converting to signed.
                 */
-               if (entity->priority >= sched_list[0]->num_rqs)
-                       entity->priority = max_t(u32, sched_list[0]->num_rqs,
-                                                DRM_SCHED_PRIORITY_MIN);
+               if (entity->priority >= sched_list[0]->num_rqs) {
+                       drm_err(sched_list[0], "entity with out-of-bounds priority:%u num_rqs:%u\n",
+                               entity->priority, sched_list[0]->num_rqs);
+                       entity->priority = max_t(s32, (s32) sched_list[0]->num_rqs - 1,
+                                                (s32) DRM_SCHED_PRIORITY_MIN);
+               }
                entity->rq = sched_list[0]->sched_rq[entity->priority];
        }