Re: [PATCH] drm/amdgpu: fix userq VA validation for sub-page buffers

On Thu, Jul 30, 2026 at 8:58 AM Candice Li <[email protected]> wrote:
>
> amdgpu_userq_input_va_validate() converts expected_size to page count
> with a plain right shift. For expected_size smaller than one GPU page,
> the computed size becomes 0 and the range check is effectively bypassed.
>
> This allows sub-page userq buffers (e.g. EOP/CSA) to pass validation
> as long as the start VA is mapped, without verifying the full span.
>
> Fix it by rejecting zero expected_size, checking overflow when
> computing end address, and deriving page span from [start_addr,
> end_addr] inclusive.
>
> Signed-off-by: Candice Li <[email protected]>

Reviewed-by: Alex Deucher <[email protected]>

> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 25 +++++++++++++++--------
>  1 file changed, 16 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> index 3fe10d6af7575d..652599f0899024 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> @@ -25,6 +25,7 @@
>  #include <drm/drm_auth.h>
>  #include <drm/drm_exec.h>
>  #include <linux/pm_runtime.h>
> +#include <linux/overflow.h>
>  #include <drm/drm_drv.h>
>
>  #include "amdgpu.h"
> @@ -238,24 +239,30 @@ int amdgpu_userq_input_va_validate(struct amdgpu_device *adev,
>  {
>         struct amdgpu_bo_va_mapping *va_map;
>         struct amdgpu_vm *vm = queue->vm;
> -       u64 user_addr;
> -       u64 size;
> +       u64 start_addr;
> +       u64 end_addr;
> +       u64 start_page;
>
>         /* Caller must hold vm->root.bo reservation */
>         dma_resv_assert_held(queue->vm->root.bo->tbo.base.resv);
>
> -       user_addr = (addr & AMDGPU_GMC_HOLE_MASK) >> AMDGPU_GPU_PAGE_SHIFT;
> -       size = expected_size >> AMDGPU_GPU_PAGE_SHIFT;
> +       if (!expected_size)
> +               return -EINVAL;
> +
> +       start_addr = addr & AMDGPU_GMC_HOLE_MASK;
> +       if (check_add_overflow(start_addr, expected_size - 1, &end_addr))
> +               return -EINVAL;
> +
> +       start_page = start_addr >> AMDGPU_GPU_PAGE_SHIFT;
>
> -       va_map = amdgpu_vm_bo_lookup_mapping(vm, user_addr);
> +       va_map = amdgpu_vm_bo_lookup_mapping(vm, start_page);
>         if (!va_map)
>                 return -EINVAL;
>
> -       /* Only validate the userq whether resident in the VM mapping range */
> -       if (user_addr >= va_map->start  &&
> -           va_map->last - user_addr + 1 >= size) {
> +       /* Lookup guarantees start_page is mapped; ensure full span is covered. */
> +       if ((end_addr >> AMDGPU_GPU_PAGE_SHIFT) <= va_map->last) {
>                 va_map->bo_va->userq_va_mapped = true;
> -               *va_out = user_addr;
> +               *va_out = start_page;
>                 return 0;
>         }
>
> --
> 2.25.1
>