On 9/30/26 10:30, Jesse Zhang wrote:
> amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_handle
> into the doorbell domain. For a regular BO, TTM moves it with
> ttm_bo_move_null() and its contents are lost. Since an importer on the
> same device gets the exporter's GEM object, a client can do this to a
> buffer another client shared with it.
>
> Reject BOs that were not created in the doorbell domain.
>
> Fixes: f09c1e6077ab ("drm/amdgpu: generate doorbell index for userqueue")
> Signed-off-by: Jesse Zhang <[email protected]>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> index 89e03d3a930c..a5733a18dc52 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> @@ -477,6 +477,16 @@ amdgpu_userq_get_doorbell_index(struct amdgpu_userq_mgr
> *uq_mgr,
> return -EINVAL;
> }
>
> + /*
> + * Pinning a regular BO into the doorbell domain would discard its
> + * contents, possibly those of a buffer shared by another client.
> + */
> + if (!(gem_to_amdgpu_bo(gobj)->preferred_domains &
> AMDGPU_GEM_DOMAIN_DOORBELL)) {
> + drm_file_err(uq_mgr->file, "Doorbell handle is not a doorbell
> BO\n");
Drop the error message, userspace could abuse that to internally spam the logs.
> + drm_gem_object_put(gobj);
> + return -EINVAL;
> + }
> +
> db_obj->obj = amdgpu_bo_ref(gem_to_amdgpu_bo(gobj));
Maybe have a local abo variable so that you don't have the cast twice.
Apart from that looks good to me,
Christian.
> drm_gem_object_put(gobj);
>
