On 7/17/2026 4:06 PM, Christian König wrote:
On 7/17/26 04:25, Zhu Lingshan wrote:
amdgpu_userq_input_va_validate() converts userq
expected_size to page count by right shift.
This undercounts va buffers that less than a page.
For example, in the AMDGPU_HW_IP_COMPUTE userq
creation case, the expected_size 2048,
so size(page count) becomes zero page and the
"va_map->last - user_addr + 1 >= size" is always true
once the start addr locates in the va_map mapping.
A similar case is AMDGPU_HW_IP_DMA, where expected_size is 32.
This commit calculates a proper page count by subtracting
the start_addr and end_addr in pages.
Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
index 969f49592450..f9f11bdf2cef 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
@@ -25,6 +25,7 @@
#include <drm/drm_auth.h>
#include <drm/drm_exec.h>
#include <linux/pm_runtime.h>
+#include <linux/overflow.h>
#include <drm/drm_drv.h>
#include "amdgpu.h"
@@ -238,14 +239,21 @@ int amdgpu_userq_input_va_validate(struct amdgpu_device *adev,
{
struct amdgpu_bo_va_mapping *va_map;
struct amdgpu_vm *vm = queue->vm;
- u64 user_addr;
+ u64 user_addr, end;
u64 size;
/* Caller must hold vm->root.bo reservation */
dma_resv_assert_held(queue->vm->root.bo->tbo.base.resv);
- user_addr = (addr & AMDGPU_GMC_HOLE_MASK) >> AMDGPU_GPU_PAGE_SHIFT;
- size = expected_size >> AMDGPU_GPU_PAGE_SHIFT;
Good catch, but I would just use ALIGN(expected_size, AMDGPU_GPU_PAGE_SIZE) here.
Hello Christian
ALIGN is more concise, however it is only correct when start_addr is PAGE aligned.
It undercounts one page when start_addr is not page aligned and "start_addr + expected_size" crosses page boundary.
An example is, if start_addr is 0xC00 (1024 X 3), and expected_size is 2048, so the size should be two pages,
but the result of ALIGN() is one page, which is wrong.
I think this "start - end" is a more general solution.
Thanks
Lingshan
Regards,
Christian.
+ if (!expected_size)
+ return -EINVAL;
+
+ user_addr = addr & AMDGPU_GMC_HOLE_MASK;
+ if (check_add_overflow(user_addr, expected_size - 1, &end))
+ return -EINVAL;
+
+ user_addr >>= AMDGPU_GPU_PAGE_SHIFT;
+ size = (end >> AMDGPU_GPU_PAGE_SHIFT) - user_addr + 1;
va_map = amdgpu_vm_bo_lookup_mapping(vm, user_addr);
if (!va_map)