On 7/17/26 04:25, Zhu Lingshan wrote:
> amdgpu_userq_input_va_validate() converts userq
> expected_size to page count by right shift.
>
> This undercounts va buffers that less than a page.
> For example, in the AMDGPU_HW_IP_COMPUTE userq
> creation case, the expected_size 2048,
> so size(page count) becomes zero page and the
> "va_map->last - user_addr + 1 >= size" is always true
> once the start addr locates in the va_map mapping.
>
> A similar case is AMDGPU_HW_IP_DMA, where expected_size is 32.
>
> This commit calculates a proper page count by subtracting
> the start_addr and end_addr in pages.
>
> Signed-off-by: Zhu Lingshan <[email protected]>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 14 +++++++++++---
> 1 file changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> index 969f49592450..f9f11bdf2cef 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> @@ -25,6 +25,7 @@
> #include <drm/drm_auth.h>
> #include <drm/drm_exec.h>
> #include <linux/pm_runtime.h>
> +#include <linux/overflow.h>
> #include <drm/drm_drv.h>
>
> #include "amdgpu.h"
> @@ -238,14 +239,21 @@ int amdgpu_userq_input_va_validate(struct amdgpu_device
> *adev,
> {
> struct amdgpu_bo_va_mapping *va_map;
> struct amdgpu_vm *vm = queue->vm;
> - u64 user_addr;
> + u64 user_addr, end;
> u64 size;
>
> /* Caller must hold vm->root.bo reservation */
> dma_resv_assert_held(queue->vm->root.bo->tbo.base.resv);
>
> - user_addr = (addr & AMDGPU_GMC_HOLE_MASK) >> AMDGPU_GPU_PAGE_SHIFT;
> - size = expected_size >> AMDGPU_GPU_PAGE_SHIFT;
Good catch, but I would just use ALIGN(expected_size, AMDGPU_GPU_PAGE_SIZE)
here.
Regards,
Christian.
> + if (!expected_size)
> + return -EINVAL;
> +
> + user_addr = addr & AMDGPU_GMC_HOLE_MASK;
> + if (check_add_overflow(user_addr, expected_size - 1, &end))
> + return -EINVAL;
> +
> + user_addr >>= AMDGPU_GPU_PAGE_SHIFT;
> + size = (end >> AMDGPU_GPU_PAGE_SHIFT) - user_addr + 1;
>
> va_map = amdgpu_vm_bo_lookup_mapping(vm, user_addr);
> if (!va_map)
