Re: [PATCH v8 05/10] drm/xe/ggtt: Avoid integer overflow when validating VF GGTT range

[Michal Wajdeczko <michal.wajdeczko@intel.com>]

On 9/15/2026 9:12 AM, Satyanarayana K V P wrote:
> Use check_add_overflow() for the VF range check, and rearrange the
> subsequent clamping into the subtraction form so the expression
> does not overflow.
> 

Reported-by?

> Fixes: e904c56ba6e0 ("drm/xe: Rewrite GGTT VF initialization")
> Signed-off-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com>
> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com>
> Cc: Matthew Brost <matthew.brost@intel.com>
> Cc: Maarten Lankhorst <dev@lankhorst.se>
> ---
>  drivers/gpu/drm/xe/xe_ggtt.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_ggtt.c b/drivers/gpu/drm/xe/xe_ggtt.c
> index 7cac01cef1ee..d65929720704 100644
> --- a/drivers/gpu/drm/xe/xe_ggtt.c
> +++ b/drivers/gpu/drm/xe/xe_ggtt.c
> @@ -8,6 +8,7 @@
>  #include <kunit/visibility.h>
>  #include <linux/fault-inject.h>
>  #include <linux/io-64-nonatomic-lo-hi.h>
> +#include <linux/overflow.h>
>  #include <linux/sizes.h>
>  
>  #include <drm/drm_drv.h>
> @@ -394,7 +395,7 @@ int xe_ggtt_init_early(struct xe_ggtt *ggtt)
>  	struct xe_device *xe = tile_to_xe(ggtt->tile);
>  	struct pci_dev *pdev = to_pci_dev(xe->drm.dev);
>  	unsigned int gsm_size;
> -	u64 ggtt_start, wopcm = xe_wopcm_size(xe), ggtt_size;
> +	u64 ggtt_start, wopcm = xe_wopcm_size(xe), ggtt_size, ggtt_end;

as you're touching this line, can we put wopcm in a separate one?

	u64 ggtt_start, ggtt_size, ggtt_end;
	u64 wopcm = xe_wopcm_size(xe);

>  	int err;
>  
>  	if (!IS_SRIOV_VF(xe)) {
> @@ -413,9 +414,11 @@ int xe_ggtt_init_early(struct xe_ggtt *ggtt)
>  		ggtt_size = xe_tile_sriov_vf_ggtt(ggtt->tile);
>  
>  		if (ggtt_start < wopcm ||
> -		    ggtt_start + ggtt_size > GUC_GGTT_TOP) {
> -			xe_tile_err(ggtt->tile, "Invalid GGTT configuration: %#llx-%#llx\n",
> -				    ggtt_start, ggtt_start + ggtt_size - 1);
> +		    check_add_overflow(ggtt_start, ggtt_size, &ggtt_end) ||
> +		    ggtt_end > GUC_GGTT_TOP) {
> +			xe_tile_err(ggtt->tile,
> +				    "Invalid GGTT configuration: base %#llx, size %#llx\n",
> +				    ggtt_start, ggtt_size);
>  			return -ERANGE;
>  		}
>  	}
> @@ -424,7 +427,7 @@ int xe_ggtt_init_early(struct xe_ggtt *ggtt)
>  	if (xe_vram_needs_64k(xe))
>  		ggtt->flags |= XE_GGTT_FLAGS_64K;
>  
> -	if (ggtt_size + ggtt_start > GUC_GGTT_TOP)
> +	if (ggtt_size > GUC_GGTT_TOP - ggtt_start)

shouldn't this be moved to !IS_VF case above ?
and maybe it also requires check_add_overflow ?

>  		ggtt_size = GUC_GGTT_TOP - ggtt_start;
>  
>  	if (GRAPHICS_VERx100(xe) >= 1270)