Re: [PATCH] drm/amdkfd: Reject zero-sized AQL queue allocations after size halving

On Thu, Aug 6, 2026 at 9:48 PM Sunday Clement <[email protected]> wrote:
>
> KFD_IOC_ALLOC_MEMORY_OF_GPU with flag
> KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM and size=1 triggers the AQL
> wraparound workaround (size >>= 1), reducing size to 0. The resulting
> zero passes through PAGE_ALIGN(0) = 0 without validation, bypassing the
> per-process VRAM quota check in reserve_mem_limit()
> (vram_used + 0 > vram_available is always false).
>
> The fix adds post-halving zero-size validation in the primary
> allocation path (amdgpu_amdkfd_gpuvm.c). The check happens after size
> halving but before reserve_mem_limit(), and uses err_alignment_size
> error path to properly clean up the allocated kgd_mem structure and
> mutex.
>
> Signed-off-by: Sunday Clement <[email protected]>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 ++++++
>  drivers/gpu/drm/amd/amdkfd/kfd_chardev.c         | 3 ++-
>  2 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> index 1e71829e0fc6..90a4a68478f8 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
> @@ -1795,6 +1795,11 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
>                 size >>= 1;
>         aligned_size = PAGE_ALIGN(size);
>
> +       if(!aligned_size) { // reject AQL queue with size < 2

Switch to C-style comments.  With that fixed:
Reviewed-by: Alex Deucher <[email protected]>

> +               ret = -EINVAL;
> +               goto err_alignment_size;
> +       }
> +
>         (*mem)->alloc_flags = flags;
>
>         amdgpu_sync_create(&(*mem)->sync);
> @@ -1886,6 +1891,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
>         amdgpu_amdkfd_unreserve_mem_limit(adev, aligned_size, flags, xcp_id);
>  err_reserve_limit:
>         amdgpu_sync_free(&(*mem)->sync);
> +err_alignment_size:
>         mutex_destroy(&(*mem)->lock);
>         if (gobj)
>                 drm_gem_object_put(gobj);
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> index 309510e23315..bb0a2c615326 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> @@ -1200,7 +1200,8 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep,
>
>                 if (flags & KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM)
>                         size >>= 1;
> -               atomic64_add(PAGE_ALIGN(size), &pdd->vram_usage);
> +               size = PAGE_ALIGN(size);
> +               atomic64_add(size, &pdd->vram_usage);
>         }
>
>         mutex_unlock(&p->mutex);
> --
> 2.43.0
>