On 9/29/26 10:53, Jesse Zhang wrote: > PRT mappings have a bo_va but no backing BO. Reject them when validating > queue buffers and when looking up the WPTR for MES or USERQ_SIGNAL, before > passing the BO to the reservation or CPU mapping helpers. > > Repeat the check at the WPTR lookups because the VM reservation is dropped > between initial validation and use. > > Without this, pointing a user queue's WPTR at a PRT (sparse) VA mapping > makes mes_userq_create_wptr_mapping() dereference a NULL bo (base.bo) and > oops in the reservation helper: > > BUG: kernel NULL pointer dereference, address: 0000000000000158 > Oops: 0000 [#1] SMP NOPTI > CPU: 0 UID: 0 PID: 4558 Comm: amd_fuzzing Tainted: G E > 7.1.0+ > RIP: 0010:drm_exec_lock_obj+0x2b/0x140 [drm_exec] > CR2: 0000000000000158 > Call Trace: > drm_exec_prepare_obj+0x25/0x60 [drm_exec] > mes_userq_create_wptr_mapping+0xc4/0x1c0 [amdgpu] > mes_userq_mqd_create+0x351/0x870 [amdgpu] > amdgpu_userq_ioctl+0x7ef/0xf80 [amdgpu] > drm_ioctl_kernel+0xac/0x110 [drm] > drm_ioctl+0x2c6/0x5b0 [drm] > amdgpu_drm_ioctl+0x4f/0x90 [amdgpu] > __x64_sys_ioctl+0xa0/0xf0 > do_syscall_64+0xa3/0x4d0 > > Signed-off-by: Jesse Zhang <[email protected]>
Reviewed-by: Christian König <[email protected]> > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 2 +- > drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 2 +- > drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 2 +- > 3 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c > index 75d5ceaa53c6..63875761dfac 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c > @@ -253,7 +253,7 @@ int amdgpu_userq_input_va_validate(struct amdgpu_device > *adev, > return -EINVAL; > > va_map = amdgpu_vm_bo_lookup_mapping(vm, start_addr); > - if (!va_map) > + if (!va_map || !va_map->bo_va->base.bo) > return -EINVAL; > > /* Lookup guarantees start_addr is mapped; ensure full span is covered. > */ > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c > index b885e90ec5f5..118db0306559 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c > @@ -386,7 +386,7 @@ static int amdgpu_userq_fence_read_wptr(struct > amdgpu_device *adev, > goto lock_error; > > mapping = amdgpu_vm_bo_lookup_mapping(queue->vm, addr); > - if (!mapping) { > + if (!mapping || !mapping->bo_va->base.bo) { > ret = -EINVAL; > goto lock_error; > } > diff --git a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c > b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c > index 1b06a4618125..e6c167a39d44 100644 > --- a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c > +++ b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c > @@ -54,7 +54,7 @@ mes_userq_create_wptr_mapping(struct amdgpu_device *adev, > goto fail_lock; > > wptr_mapping = amdgpu_vm_bo_lookup_mapping(vm, wptr); > - if (!wptr_mapping) { > + if (!wptr_mapping || !wptr_mapping->bo_va->base.bo) { > ret = -EINVAL; > goto fail_lock; > }
