[PATCH v3 0/4] drm/msm/gem: A couple VM_BIND fixes

[Rob Clark]

Fix possible overflow in range check, and disallow passing BOs table to
GEM_SUBMIT for VM_BIND contexts.

v3:
- Also disallow range==0
- Add patch to clear stale nr_ops in lookup_ops error path
- Link to v2: https://lore.kernel.org/all/20261102161002.497152-1-robin.clark@xxxxxxxxxxxxxxxx/

v2:
- Also check that range/obj_offset are not greater than SIZE_MAX.  It
  doesn't matter currently, but would if an armv7 system ever added
  support for per-process pgtables and VM_BIND.
- Add patch to fix handle-dereference in idr_find() error path
- Link to v1: https://lore.kernel.org/all/20261101174911.25184-1-robin.clark@xxxxxxxxxxxxxxxx/

Rob Clark (4):
  drm/msm/gem: Fix VM_BIND range check
  drm/msm/gem: Disallow nr_bos for VM_BIND contexts
  drm/msm/gem: Decrement loop idx if handle lookup fails
  drm/msm/gem: Clear nr_ops in lookup_ops() failure path

 drivers/gpu/drm/msm/msm_gem_submit.c |  5 ++++-
 drivers/gpu/drm/msm/msm_gem_vma.c    | 11 +++++++----
 2 files changed, 11 insertions(+), 5 deletions(-)

-- 
2.56.0