On Thu, Jul 16, 2026 at 10:44 PM Zhu Lingshan <[email protected]> wrote: > > amdgpu_userq_input_va_validate() converts userq > expected_size to page count by right shift. > > This undercounts va buffers that less than a page. > For example, in the AMDGPU_HW_IP_COMPUTE userq > creation case, the expected_size 2048, > so size(page count) becomes zero page and the > "va_map->last - user_addr + 1 >= size" is always true > once the start addr locates in the va_map mapping. > > A similar case is AMDGPU_HW_IP_DMA, where expected_size is 32. > > This commit calculates a proper page count by subtracting > the start_addr and end_addr in pages. > > Signed-off-by: Zhu Lingshan <[email protected]>
Reviewed-by: Alex Deucher <[email protected]> > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 14 +++++++++++--- > 1 file changed, 11 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c > index 969f49592450..f9f11bdf2cef 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c > @@ -25,6 +25,7 @@ > #include <drm/drm_auth.h> > #include <drm/drm_exec.h> > #include <linux/pm_runtime.h> > +#include <linux/overflow.h> > #include <drm/drm_drv.h> > > #include "amdgpu.h" > @@ -238,14 +239,21 @@ int amdgpu_userq_input_va_validate(struct amdgpu_device > *adev, > { > struct amdgpu_bo_va_mapping *va_map; > struct amdgpu_vm *vm = queue->vm; > - u64 user_addr; > + u64 user_addr, end; > u64 size; > > /* Caller must hold vm->root.bo reservation */ > dma_resv_assert_held(queue->vm->root.bo->tbo.base.resv); > > - user_addr = (addr & AMDGPU_GMC_HOLE_MASK) >> AMDGPU_GPU_PAGE_SHIFT; > - size = expected_size >> AMDGPU_GPU_PAGE_SHIFT; > + if (!expected_size) > + return -EINVAL; > + > + user_addr = addr & AMDGPU_GMC_HOLE_MASK; > + if (check_add_overflow(user_addr, expected_size - 1, &end)) > + return -EINVAL; > + > + user_addr >>= AMDGPU_GPU_PAGE_SHIFT; > + size = (end >> AMDGPU_GPU_PAGE_SHIFT) - user_addr + 1; > > va_map = amdgpu_vm_bo_lookup_mapping(vm, user_addr); > if (!va_map) > -- > 2.53.0 >
