amdgpu_userq_input_va_validate() converts expected_size to page count with a plain right shift. For expected_size smaller than one GPU page, the computed size becomes 0 and the range check is effectively bypassed.
This allows sub-page userq buffers (e.g. EOP/CSA) to pass validation as long as the start VA is mapped, without verifying the full span. Fix it by rejecting zero expected_size, checking overflow when computing end address, and deriving page span from [start_addr, end_addr] inclusive. Signed-off-by: Candice Li <[email protected]> --- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 25 +++++++++++++++-------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c index 3fe10d6af7575d..652599f0899024 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c @@ -25,6 +25,7 @@ #include <drm/drm_auth.h> #include <drm/drm_exec.h> #include <linux/pm_runtime.h> +#include <linux/overflow.h> #include <drm/drm_drv.h> #include "amdgpu.h" @@ -238,24 +239,30 @@ int amdgpu_userq_input_va_validate(struct amdgpu_device *adev, { struct amdgpu_bo_va_mapping *va_map; struct amdgpu_vm *vm = queue->vm; - u64 user_addr; - u64 size; + u64 start_addr; + u64 end_addr; + u64 start_page; /* Caller must hold vm->root.bo reservation */ dma_resv_assert_held(queue->vm->root.bo->tbo.base.resv); - user_addr = (addr & AMDGPU_GMC_HOLE_MASK) >> AMDGPU_GPU_PAGE_SHIFT; - size = expected_size >> AMDGPU_GPU_PAGE_SHIFT; + if (!expected_size) + return -EINVAL; + + start_addr = addr & AMDGPU_GMC_HOLE_MASK; + if (check_add_overflow(start_addr, expected_size - 1, &end_addr)) + return -EINVAL; + + start_page = start_addr >> AMDGPU_GPU_PAGE_SHIFT; - va_map = amdgpu_vm_bo_lookup_mapping(vm, user_addr); + va_map = amdgpu_vm_bo_lookup_mapping(vm, start_page); if (!va_map) return -EINVAL; - /* Only validate the userq whether resident in the VM mapping range */ - if (user_addr >= va_map->start && - va_map->last - user_addr + 1 >= size) { + /* Lookup guarantees start_page is mapped; ensure full span is covered. */ + if ((end_addr >> AMDGPU_GPU_PAGE_SHIFT) <= va_map->last) { va_map->bo_va->userq_va_mapped = true; - *va_out = user_addr; + *va_out = start_page; return 0; } -- 2.25.1
