[PATCH] drm: sanitize ttm_device_funcs.evict_flags/move casting

Our analysis revealed that most handlers in ttm_device_funcs perform
type checks before invoking container_of on ttm_buffer_object.

For instance, commit d03d858970a1 ("drm/radeon/kms: Check if bo we got
from ttm are radeon object or not") introduced an object type check (
based on the comparison with destroy function).

This commit adds the missing type checks in the nouveau_bo_evict_flags
and bo_driver_move handlers.

Signed-off-by: Lin Ma <redacted>
---
 drivers/gpu/drm/drm_gem_vram_helper.c | 3 +++
 drivers/gpu/drm/nouveau/nouveau_bo.c  | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c b/drivers/gpu/drm/drm_gem_vram_helper.c
index 22b1fe9c03b8..40d1b584327e 100644
--- a/drivers/gpu/drm/drm_gem_vram_helper.c
+++ b/drivers/gpu/drm/drm_gem_vram_helper.c

@@ -855,6 +855,9 @@ static int bo_driver_move(struct ttm_buffer_object *bo,
 		return 0;
 	}
 
+	if (!drm_is_gem_vram(bo))
+		return -EINVAL;
+
 	gbo = drm_gem_vram_of_bo(bo);
 
 	return drm_gem_vram_bo_driver_move(gbo, evict, ctx, new_mem);

diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index b96f0555ca14..81a66246d547 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c

@@ -887,6 +887,9 @@ nouveau_bo_evict_flags(struct ttm_buffer_object *bo, struct ttm_placement *pl)
 {
 	struct nouveau_bo *nvbo = nouveau_bo(bo);
 
+	if (bo->destroy != nouveau_bo_del_ttm)
+		return;
+
 	switch (bo->resource->mem_type) {
 	case TTM_PL_VRAM:
 		nouveau_bo_placement_set(nvbo, NOUVEAU_GEM_DOMAIN_GART,

-- 
2.17.1