mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 03:35:32 -04:00
Code Issues Packages Projects Releases Wiki Activity

drm/amdgpu: fix userq VA validation for sub-page buffers

Browse Source 
amdgpu_userq_input_va_validate() converts expected_size to page count
with a plain right shift. For expected_size smaller than one GPU page,
the computed size becomes 0 and the range check is effectively bypassed.

This allows sub-page userq buffers (e.g. EOP/CSA) to pass validation
as long as the start VA is mapped, without verifying the full span.

Fix it by rejecting zero expected_size, checking overflow when
computing end address, and deriving page span from [start_addr,
end_addr] inclusive.

Signed-off-by: Candice Li <candice.li@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Candice Li
2026-07-30 17:55:07 +08:00
committed by Alex Deucher
parent 6c9e0328d1
commit c0122bf2cc
1 changed files with 16 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
View File

@@ -25,6 +25,7 @@
#include <drm/drm_auth.h>
#include <drm/drm_exec.h>
#include <linux/pm_runtime.h>
#include <linux/overflow.h>
#include <drm/drm_drv.h>
#include "amdgpu.h"
@@ -238,24 +239,30 @@ int amdgpu_userq_input_va_validate(struct amdgpu_device *adev,
{
struct amdgpu_bo_va_mapping *va_map;
struct amdgpu_vm *vm = queue->vm;
u64 user_addr;
u64 size;
u64 start_addr;
u64 end_addr;
u64 start_page;
/* Caller must hold vm->root.bo reservation */
dma_resv_assert_held(queue->vm->root.bo->tbo.base.resv);
user_addr = (addr & AMDGPU_GMC_HOLE_MASK) >> AMDGPU_GPU_PAGE_SHIFT;
size = expected_size >> AMDGPU_GPU_PAGE_SHIFT;
if (!expected_size)
return -EINVAL;
va_map = amdgpu_vm_bo_lookup_mapping(vm, user_addr);
start_addr = addr & AMDGPU_GMC_HOLE_MASK;
if (check_add_overflow(start_addr, expected_size - 1, &end_addr))
return -EINVAL;
start_page = start_addr >> AMDGPU_GPU_PAGE_SHIFT;
va_map = amdgpu_vm_bo_lookup_mapping(vm, start_page);
if (!va_map)
return -EINVAL;
/* Only validate the userq whether resident in the VM mapping range */
if (user_addr >= va_map->start &&
va_map->last - user_addr + 1 >= size) {
/* Lookup guarantees start_page is mapped; ensure full span is covered. */
if ((end_addr >> AMDGPU_GPU_PAGE_SHIFT) <= va_map->last) {
va_map->bo_va->userq_va_mapped = true;
*va_out = user_addr;
*va_out = start_page;
return 0;
}