On 7/17/2026 4:06 PM, Christian König wrote: > > On 7/17/26 04:25, Zhu Lingshan wrote: >> amdgpu_userq_input_va_validate() converts userq >> expected_size to page count by right shift. >> >> This undercounts va buffers that less than a page. >> For example, in the AMDGPU_HW_IP_COMPUTE userq >> creation case, the expected_size 2048, >> so size(page count) becomes zero page and the >> "va_map->last - user_addr + 1 >= size" is always true >> once the start addr locates in the va_map mapping. >> >> A similar case is AMDGPU_HW_IP_DMA, where expected_size is 32. >> >> This commit calculates a proper page count by subtracting >> the start_addr and end_addr in pages. >> >> Signed-off-by: Zhu Lingshan <[email protected]> >> --- >> drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 14 +++++++++++--- >> 1 file changed, 11 insertions(+), 3 deletions(-) >> >> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c >> b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c >> index 969f49592450..f9f11bdf2cef 100644 >> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c >> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c >> @@ -25,6 +25,7 @@ >> #include <drm/drm_auth.h> >> #include <drm/drm_exec.h> >> #include <linux/pm_runtime.h> >> +#include <linux/overflow.h> >> #include <drm/drm_drv.h> >> >> #include "amdgpu.h" >> @@ -238,14 +239,21 @@ int amdgpu_userq_input_va_validate(struct >> amdgpu_device *adev, >> { >> struct amdgpu_bo_va_mapping *va_map; >> struct amdgpu_vm *vm = queue->vm; >> - u64 user_addr; >> + u64 user_addr, end; >> u64 size; >> >> /* Caller must hold vm->root.bo reservation */ >> dma_resv_assert_held(queue->vm->root.bo->tbo.base.resv); >> >> - user_addr = (addr & AMDGPU_GMC_HOLE_MASK) >> AMDGPU_GPU_PAGE_SHIFT; >> - size = expected_size >> AMDGPU_GPU_PAGE_SHIFT; > Good catch, but I would just use ALIGN(expected_size, AMDGPU_GPU_PAGE_SIZE) > here.
Hello Christian ALIGN is more concise, however it is only correct when start_addr is PAGE aligned. It undercounts one page when start_addr is not page aligned and "start_addr + expected_size" crosses page boundary. An example is, if start_addr is 0xC00 (1024 X 3), and expected_size is 2048, so the size should be two pages, but the result of ALIGN() is one page, which is wrong. I think this "start - end" is a more general solution. Thanks Lingshan > > Regards, > Christian. > >> + if (!expected_size) >> + return -EINVAL; >> + >> + user_addr = addr & AMDGPU_GMC_HOLE_MASK; >> + if (check_add_overflow(user_addr, expected_size - 1, &end)) >> + return -EINVAL; >> + >> + user_addr >>= AMDGPU_GPU_PAGE_SHIFT; >> + size = (end >> AMDGPU_GPU_PAGE_SHIFT) - user_addr + 1; >> >> va_map = amdgpu_vm_bo_lookup_mapping(vm, user_addr); >> if (!va_map)
