Re: [PATCH] drm/amdgpu: validate rptr and wptr of a userq

On Thu, Aug 13, 2026 at 7:45 AM Zhu Lingshan <[email protected]> wrote:
>
> rptr and wptr of a userq are 8 bytes aligned, and may
> not placed on a page boundary.
>
> This commit checks whether rptr and wptr are 8 bytes
> aligned, and expectes 8 bytes when validates rptr/wptr VA.
>
> With above changes, this commit fixes an regression
> in amdgpu_userq_input_va_validate, where
> end_addr is caculated by:
> check_add_overflow(start_addr, expected_size - 1, &end_addr).
> Wptr and rptr are very likely not to be page aligned,
> when validating rptr and wptr, if they are located in the last
> mapped page(or only one page is mapped)
> and expected_size is PAGE_SIZE, end_addr will exceed the last
> mapped page, means (end_addr >> AMDGPU_GPU_PAGE_SHIFT) > va_map->last,
> and causing an -EINVAL, even it is a valid VA.
>
> Signed-off-by: Zhu Lingshan <[email protected]>
> Fixes: e91d10a5aacd ("drm/amdgpu: fix userq VA validation for sub-page buffers")

Acked-by: Alex Deucher <[email protected]>

> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> index 04639f894903..17cc48d87c4d 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> @@ -702,10 +702,10 @@ amdgpu_userq_create(struct drm_file *filp, union drm_amdgpu_userq *args)
>                                            args->in.queue_size,
>                                            &queue->userq_vas.va.queue_rb) ||
>             amdgpu_userq_input_va_validate(adev, queue, args->in.rptr_va,
> -                                          AMDGPU_GPU_PAGE_SIZE,
> +                                          sizeof(u64),
>                                            &queue->userq_vas.va.rptr) ||
>             amdgpu_userq_input_va_validate(adev, queue, args->in.wptr_va,
> -                                          AMDGPU_GPU_PAGE_SIZE,
> +                                          sizeof(u64),
>                                            &queue->userq_vas.va.wptr)) {
>                 r = -EINVAL;
>                 amdgpu_bo_unreserve(fpriv->vm.root.bo);
> @@ -850,6 +850,12 @@ static int amdgpu_userq_input_args_validate(struct drm_device *dev,
>                         drm_file_err(filp, "invalidate userq queue rptr or wptr\n");
>                         return -EINVAL;
>                 }
> +
> +               if (!IS_ALIGNED(args->in.wptr_va, sizeof(u64)) ||
> +                   !IS_ALIGNED(args->in.rptr_va, sizeof(u64))) {
> +                       drm_file_err(filp, "user queue rptr or wptr is not 8-byte aligned\n");
> +                       return -EINVAL;
> +               }
>                 break;
>         case AMDGPU_USERQ_OP_FREE:
>                 if (args->in.ip_type ||
> --
> 2.53.0
>