github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 20:54:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/amdgpu: validate rptr and wptr of a userq

Browse Source 
rptr and wptr of a userq are 8 bytes aligned, and may
not placed on a page boundary.

This commit checks whether rptr and wptr are 8 bytes
aligned, and expectes 8 bytes when validates rptr/wptr VA.

With above changes, this commit fixes an regression
in amdgpu_userq_input_va_validate, where
end_addr is caculated by:
check_add_overflow(start_addr, expected_size - 1, &end_addr).
Wptr and rptr are very likely not to be page aligned,
when validating rptr and wptr, if they are located in the last
mapped page(or only one page is mapped)
and expected_size is PAGE_SIZE, end_addr will exceed the last
mapped page, means (end_addr >> AMDGPU_GPU_PAGE_SHIFT) > va_map->last,
and causing an -EINVAL, even it is a valid VA.

Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Fixes: c0122bf2cc ("drm/amdgpu: fix userq VA validation for sub-page buffers")
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Zhu Lingshan 2026-08-13 17:36:53 +08:00 committed by Alex Deucher
parent 48dc279c30
commit 556488b086
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
View File

@ -702,10 +702,10 @@ amdgpu_userq_create(struct drm_file *filp, union drm_amdgpu_userq *args)
args->in.queue_size,
&queue->userq_vas.va.queue_rb) ||
amdgpu_userq_input_va_validate(adev, queue, args->in.rptr_va,
AMDGPU_GPU_PAGE_SIZE,
sizeof(u64),
&queue->userq_vas.va.rptr) ||
amdgpu_userq_input_va_validate(adev, queue, args->in.wptr_va,
AMDGPU_GPU_PAGE_SIZE,
sizeof(u64),
&queue->userq_vas.va.wptr)) {
r = -EINVAL;
amdgpu_bo_unreserve(fpriv->vm.root.bo);
@ -850,6 +850,12 @@ static int amdgpu_userq_input_args_validate(struct drm_device *dev,
drm_file_err(filp, "invalidate userq queue rptr or wptr\n");
return -EINVAL;
}
if (!IS_ALIGNED(args->in.wptr_va, sizeof(u64)) ||
!IS_ALIGNED(args->in.rptr_va, sizeof(u64))) {
drm_file_err(filp, "user queue rptr or wptr is not 8-byte aligned\n");
return -EINVAL;
}
break;
case AMDGPU_USERQ_OP_FREE:
if (args->in.ip_type ||