RE: [PATCH] drm/amdkfd: Reject zero-sized AQL queue allocations after size halving

AMD General

ping

> -----Original Message-----
> From: Clement, Sunday <[email protected]>
> Sent: Thursday, August 6, 2026 11:11 AM
> To: [email protected]
> Cc: Clement, Sunday <[email protected]>; Yang, Philip
> <[email protected]>; Deucher, Alexander <[email protected]>
> Subject: [PATCH] drm/amdkfd: Reject zero-sized AQL queue allocations after size
> halving
>
> KFD_IOC_ALLOC_MEMORY_OF_GPU with flag
> KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM and size=1 triggers the AQL
> wraparound workaround (size >>= 1), reducing size to 0. The resulting zero passes
> through PAGE_ALIGN(0) = 0 without validation, bypassing the per-process VRAM
> quota check in reserve_mem_limit() (vram_used + 0 > vram_available is always
> false).
>
> The fix adds post-halving zero-size validation in the primary allocation path
> (amdgpu_amdkfd_gpuvm.c). The check happens after size halving but before
> reserve_mem_limit(), and uses err_alignment_size error path to properly clean up
> the allocated kgd_mem structure and mutex.
>
> Signed-off-by: Sunday Clement <[email protected]>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 ++++++
>  drivers/gpu/drm/amd/amdkfd/kfd_chardev.c         | 3 ++-
>  2 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> index 1e71829e0fc6..90a4a68478f8 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> @@ -1795,6 +1795,11 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
>               size >>= 1;
>       aligned_size = PAGE_ALIGN(size);
>
> +     if(!aligned_size) { // reject AQL queue with size < 2
> +             ret = -EINVAL;
> +             goto err_alignment_size;
> +     }
> +
>       (*mem)->alloc_flags = flags;
>
>       amdgpu_sync_create(&(*mem)->sync);
> @@ -1886,6 +1891,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
>       amdgpu_amdkfd_unreserve_mem_limit(adev, aligned_size, flags,
> xcp_id);
>  err_reserve_limit:
>       amdgpu_sync_free(&(*mem)->sync);
> +err_alignment_size:
>       mutex_destroy(&(*mem)->lock);
>       if (gobj)
>               drm_gem_object_put(gobj);
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> index 309510e23315..bb0a2c615326 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> @@ -1200,7 +1200,8 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file
> *filep,
>
>               if (flags & KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM)
>                       size >>= 1;
> -             atomic64_add(PAGE_ALIGN(size), &pdd->vram_usage);
> +             size = PAGE_ALIGN(size);
> +             atomic64_add(size, &pdd->vram_usage);
>       }
>
>       mutex_unlock(&p->mutex);
> --
> 2.43.0