Patch "drm/sched: Fix bounds limiting when given a malformed entity" has been added to the 6.7-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    drm/sched: Fix bounds limiting when given a malformed entity

to the 6.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-sched-fix-bounds-limiting-when-given-a-malformed.patch
and it can be found in the queue-6.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5aaefeb586de1c5c5ea57d728db17d758f78d096
Author: Luben Tuikov <ltuikov89@xxxxxxxxx>
Date:   Wed Nov 22 23:58:53 2023 -0500

    drm/sched: Fix bounds limiting when given a malformed entity
    
    [ Upstream commit 2bbe6ab2be53858507f11f99f856846d04765ae3 ]
    
    If we're given a malformed entity in drm_sched_entity_init()--shouldn't
    happen, but we verify--with out-of-bounds priority value, we set it to an
    allowed value. Fix the expression which sets this limit.
    
    Signed-off-by: Luben Tuikov <ltuikov89@xxxxxxxxx>
    Fixes: 56e449603f0ac5 ("drm/sched: Convert the GPU scheduler to variable number of run-queues")
    Link: https://patchwork.freedesktop.org/patch/msgid/20231123122422.167832-2-ltuikov89@xxxxxxxxx
    Reviewed-by: Christian König <christian.koenig@xxxxxxx>
    Link: https://lore.kernel.org/r/dbb91dbe-ef77-4d79-aaf9-2adb171c1d7a@xxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
index 409e4256f6e7..0a7a7e4ad8d1 100644
--- a/drivers/gpu/drm/scheduler/sched_entity.c
+++ b/drivers/gpu/drm/scheduler/sched_entity.c
@@ -81,12 +81,15 @@ int drm_sched_entity_init(struct drm_sched_entity *entity,
 		 */
 		pr_warn("%s: called with uninitialized scheduler\n", __func__);
 	} else if (num_sched_list) {
-		/* The "priority" of an entity cannot exceed the number
-		 * of run-queues of a scheduler.
+		/* The "priority" of an entity cannot exceed the number of run-queues of a
+		 * scheduler. Protect against num_rqs being 0, by converting to signed.
 		 */
-		if (entity->priority >= sched_list[0]->num_rqs)
-			entity->priority = max_t(u32, sched_list[0]->num_rqs,
-						 DRM_SCHED_PRIORITY_MIN);
+		if (entity->priority >= sched_list[0]->num_rqs) {
+			drm_err(sched_list[0], "entity with out-of-bounds priority:%u num_rqs:%u\n",
+				entity->priority, sched_list[0]->num_rqs);
+			entity->priority = max_t(s32, (s32) sched_list[0]->num_rqs - 1,
+						 (s32) DRM_SCHED_PRIORITY_MIN);
+		}
 		entity->rq = sched_list[0]->sched_rq[entity->priority];
 	}