Re: [PATCH] drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

[Philip Yang <yangp@amd.com>]

[-- Attachment #1: Type: text/plain, Size: 3901 bytes --]



On 2026-07-06 15:18, Yongqiang Sun wrote:
> total_cwsr_size was computed in 32-bit before being used as a BO/SVM
> allocation size.
> With large ctx_save_restore_area_size and debug_memory_size
> multiplied by the XCC count, the product can wrap,
> yielding an undersized CWSR save area that firmware later overruns.
>
> Promote total_cwsr_size to u64 and use check_add_overflow()/
> check_mul_overflow() in both kfd_queue_acquire_buffers() and
> kfd_queue_release_buffers().
>
> Signed-off-by: Yongqiang Sun<Yongqiang.Sun@amd.com>
> ---
>   drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 25 +++++++++++++++++++------
>   1 file changed, 19 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
> index 9d4838461168..4b1c1e379244 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
> @@ -23,6 +23,7 @@
>    */
>   
>   #include <linux/slab.h>
> +#include <linux/overflow.h>
>   #include "kfd_priv.h"
>   #include "kfd_topology.h"
>   #include "kfd_svm.h"
> @@ -235,7 +236,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
>   	struct kfd_topology_device *topo_dev;
>   	u64 expected_queue_size;
>   	struct amdgpu_vm *vm;
> -	u32 total_cwsr_size;
> +	u64 total_cwsr_size;
>   	int err;
>   
>   	topo_dev = kfd_topology_device_by_id(pdd->dev->id);
> @@ -308,8 +309,15 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
>   		goto out_err_unreserve;
>   	}
>   
> -	total_cwsr_size = (properties->ctx_save_restore_area_size +
> -			   topo_dev->node_props.debug_memory_size) * NUM_XCC(pdd->dev->xcc_mask);
> +	if (check_add_overflow(properties->ctx_save_restore_area_size,
> +			       topo_dev->node_props.debug_memory_size,
> +			       &total_cwsr_size) ||
Because properties->ctx_save_restore_area_size and 
topo_dev->node_props.debug_memory_size are u32, total_cwsr_size is u64 
now, check_add_overflow will never overflow to return true, use typecast 
u64 add instead

total_cwsr_size = (u64)properties->ctx_save_restore_area_size + topo_dev->node_props.debug_memory_size;

> +	    check_mul_overflow(total_cwsr_size,
> +			       (u64)NUM_XCC(pdd->dev->xcc_mask),
Since total_cwsr_size is u64, NUM_XCC(pdd->dev->xcc_mask) will promote 
to u64 as well, this u64 typecast is not needed.
> +			       &total_cwsr_size)) {
> +		err = -EINVAL;
> +		goto out_err_unreserve;
> +	}
>   	total_cwsr_size = ALIGN(total_cwsr_size, PAGE_SIZE);
>   
>   	err = kfd_queue_buffer_get(vm, (void *)properties->ctx_save_restore_area_address,
> @@ -344,7 +352,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
>   int kfd_queue_release_buffers(struct kfd_process_device *pdd, struct queue_properties *properties)
>   {
>   	struct kfd_topology_device *topo_dev;
> -	u32 total_cwsr_size;
> +	u64 total_cwsr_size;
>   
>   	kfd_queue_buffer_put(&properties->wptr_bo);
>   	kfd_queue_buffer_put(&properties->rptr_bo);
> @@ -355,8 +363,13 @@ int kfd_queue_release_buffers(struct kfd_process_device *pdd, struct queue_prope
>   	topo_dev = kfd_topology_device_by_id(pdd->dev->id);
>   	if (!topo_dev)
>   		return -EINVAL;
> -	total_cwsr_size = (properties->ctx_save_restore_area_size +
> -			   topo_dev->node_props.debug_memory_size) * NUM_XCC(pdd->dev->xcc_mask);
> +	if (check_add_overflow(properties->ctx_save_restore_area_size,
> +			       topo_dev->node_props.debug_memory_size,
> +			       &total_cwsr_size) ||
> +	    check_mul_overflow(total_cwsr_size,
> +			       (u64)NUM_XCC(pdd->dev->xcc_mask),
> +			       &total_cwsr_size))
Do the same change as above kfd_queue_acquire_buffers. Regards, Philip
> +		return -EINVAL;
>   	total_cwsr_size = ALIGN(total_cwsr_size, PAGE_SIZE);
>   
>   	kfd_queue_buffer_svm_put(pdd, properties->ctx_save_restore_area_address, total_cwsr_size);

[-- Attachment #2: Type: text/html, Size: 5198 bytes --]