[PATCH v5 0/3] accel/rocket: Fix job submit error handling

[Haoming Gao]

Several independent error paths in the Rocket job submission ioctl can be
triggered by unprivileged userspace. This series validates userspace BO
counts before passing them to helpers with signed count parameters, collects
implicit dependencies before the scheduler job is armed, and propagates the
first per-job submission error to userspace.

The series was tested on RK3588 with zero task counts, invalid task pointers,
invalid BO handles, and oversized BO counts. The requests returned the
expected error codes without warnings or errors in the kernel log.

Changes in v5:
- Replaced the nickname in the author identity and Signed-off-by tags with my
  real name, as requested by Greg Kroah-Hartman.

Changes in v4:
- Added Sidong Yang's Reviewed-by tags, using the corrected email address.
- Dropped Cc: stable from patch 3 because propagating submission errors
  changes userspace-visible ioctl behavior.
- Rebased onto the current drm-misc-next branch.

Changes in v3:
- Kept the individual count checks before GEM lookup, but changed bo_count to
  int so check_add_overflow() rejects combined counts above INT_MAX, as
  suggested by Sidong Yang.

Changes in v2:
- Split the three independent fixes into separate patches as suggested by
  Sidong Yang.
- Rebased onto the then-current drm-misc-next branch.
- Dropped incidental blank-line-only changes from the original patch.
- Added Sidong Yang's Tested-by tag.

v4: https://lore.kernel.org/r/20260828061916.20405-1-Naixumogu@xxxxxxxxxxx
v3: https://lore.kernel.org/r/20260828050805.38548-1-Naixumogu@xxxxxxxxxxx
v2: https://lore.kernel.org/r/20260827170608.39511-1-Naixumogu@xxxxxxxxxxx
v1: https://lore.kernel.org/r/20260813142059.151644-1-Naixumogu@xxxxxxxxxxx

Haoming Gao (3):
  accel/rocket: Validate BO handle counts on job submission
  accel/rocket: Collect job dependencies before arming
  accel/rocket: Propagate job submission errors

 drivers/accel/rocket/rocket_job.c | 32 ++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)


base-commit: f9c2f70ee41544717b3c209083073db1e21f919b
-- 
2.43.0