Re: [PATCH] drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

[Philip Yang <yangp@amd.com>]

[-- Attachment #1: Type: text/plain, Size: 3409 bytes --]



On 2026-07-08 12:43, Yongqiang Sun wrote:
> total_cwsr_size was computed in 32-bit before being used as a BO/SVM
> allocation size.
> With large ctx_save_restore_area_size and debug_memory_size
> multiplied by the XCC count, the product can wrap,
> yielding an undersized CWSR save area that firmware later overruns.
>
> Promote total_cwsr_size to u64 and use check_add_overflow()/

Remove check_add_overflow(), with this fixed, this patch is

Reviewed-by: Philip Yang<philip.yang@amd.com>

> check_mul_overflow() in both kfd_queue_acquire_buffers() and
> kfd_queue_release_buffers().
>
> Signed-off-by: Yongqiang Sun<Yongqiang.Sun@amd.com>
> ---
>   drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 23 +++++++++++++++++------
>   1 file changed, 17 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
> index 9d4838461168..01e228fc1860 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
> @@ -23,6 +23,7 @@
>    */
>   
>   #include <linux/slab.h>
> +#include <linux/overflow.h>
>   #include "kfd_priv.h"
>   #include "kfd_topology.h"
>   #include "kfd_svm.h"
> @@ -235,7 +236,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
>   	struct kfd_topology_device *topo_dev;
>   	u64 expected_queue_size;
>   	struct amdgpu_vm *vm;
> -	u32 total_cwsr_size;
> +	u64 total_cwsr_size;
>   	int err;
>   
>   	topo_dev = kfd_topology_device_by_id(pdd->dev->id);
> @@ -308,8 +309,14 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
>   		goto out_err_unreserve;
>   	}
>   
> -	total_cwsr_size = (properties->ctx_save_restore_area_size +
> -			   topo_dev->node_props.debug_memory_size) * NUM_XCC(pdd->dev->xcc_mask);
> +	total_cwsr_size = (u64)properties->ctx_save_restore_area_size +
> +			  topo_dev->node_props.debug_memory_size;
> +	if (check_mul_overflow(total_cwsr_size,
> +			       NUM_XCC(pdd->dev->xcc_mask),
> +			       &total_cwsr_size)) {
> +		err = -EINVAL;
> +		goto out_err_unreserve;
> +	}
>   	total_cwsr_size = ALIGN(total_cwsr_size, PAGE_SIZE);
>   
>   	err = kfd_queue_buffer_get(vm, (void *)properties->ctx_save_restore_area_address,
> @@ -344,7 +351,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
>   int kfd_queue_release_buffers(struct kfd_process_device *pdd, struct queue_properties *properties)
>   {
>   	struct kfd_topology_device *topo_dev;
> -	u32 total_cwsr_size;
> +	u64 total_cwsr_size;
>   
>   	kfd_queue_buffer_put(&properties->wptr_bo);
>   	kfd_queue_buffer_put(&properties->rptr_bo);
> @@ -355,8 +362,12 @@ int kfd_queue_release_buffers(struct kfd_process_device *pdd, struct queue_prope
>   	topo_dev = kfd_topology_device_by_id(pdd->dev->id);
>   	if (!topo_dev)
>   		return -EINVAL;
> -	total_cwsr_size = (properties->ctx_save_restore_area_size +
> -			   topo_dev->node_props.debug_memory_size) * NUM_XCC(pdd->dev->xcc_mask);
> +	total_cwsr_size = (u64)properties->ctx_save_restore_area_size +
> +			  topo_dev->node_props.debug_memory_size;
> +	if (check_mul_overflow(total_cwsr_size,
> +			       NUM_XCC(pdd->dev->xcc_mask),
> +			       &total_cwsr_size))
> +		return -EINVAL;
>   	total_cwsr_size = ALIGN(total_cwsr_size, PAGE_SIZE);
>   
>   	kfd_queue_buffer_svm_put(pdd, properties->ctx_save_restore_area_address, total_cwsr_size);

[-- Attachment #2: Type: text/html, Size: 4261 bytes --]