Re: [PATCH v3] drm_buddy: fix power-of-2 rounding errs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] The `is_power_of_2()` macro truncates 64-bit sizes on 32-bit platforms, undermining the patch's fix.
- [High] `__alloc_contig_try_harder()` breaks list contracts, leaking local allocations and freeing caller-owned blocks.
--

commit 2e4e9330a58d876de4c3883a4c7315a7270524e2
Author: David Gow <david@davidgow.net>

drm_buddy: fix power-of-2 rounding errs

This commit replaces roundup_pow_of_two and rounddown_pow_of_two macros
with 64-bit safe ilog2 equivalents in the buddy allocator to fix
truncation of 64-bit values on 32-bit architectures.

> diff --git a/drivers/gpu/buddy.c b/drivers/gpu/buddy.c
> index 26e7a48b55f33..964a5ae78f1be 100644
> --- a/drivers/gpu/buddy.c
> +++ b/drivers/gpu/buddy.c

[ ... ]

> @@ -1435,7 +1435,7 @@ int gpu_buddy_alloc_blocks(struct gpu_buddy *mm,
>  
>  	/* Roundup the size to power of 2 */
>  	if (flags & GPU_BUDDY_CONTIGUOUS_ALLOCATION) {
> -		size = roundup_pow_of_two(size);
> +		size = 1ULL << (ilog2(size - 1) + 1);
>  		min_block_size = size;
>  		/*
>  		 * Normalize the requested size to min_block_size for regular allocations.

[Severity: High]
This is a pre-existing issue, but does the is_power_of_2() macro still
silently truncate 64-bit sizes on 32-bit platforms, undermining this fix?

Earlier in gpu_buddy_alloc_blocks() there is a validation check:

    if (!is_power_of_2(min_block_size))
        return -EINVAL;

If min_block_size is a 64-bit value > 4GB, the unsigned long argument
silently truncates the upper 32 bits on 32-bit architectures. For example,
0x100000000 (4GB) truncates to 0 (failing the check), and 0x100001000
(4GB + 4KB) truncates to 4KB (falsely passing the check).

Similarly, gpu_buddy_can_offset_align() does this:

    return size < min_block_size && is_power_of_2(size);

Can this lead to allocation failures or memory corruption because buddy
alignment constraints are bypassed?

[Severity: High]
This is a pre-existing issue, but does __alloc_contig_try_harder() break list
contracts and cause a memory leak when used as a fallback here?

Later in gpu_buddy_alloc_blocks() during a fragmented allocation loop:

    if (flags & GPU_BUDDY_CONTIGUOUS_ALLOCATION &&
        !(flags & GPU_BUDDY_RANGE_ALLOCATION))
            return __alloc_contig_try_harder(mm,
                                             original_size,
                                             original_min_size,
                                             blocks);

If the loop partially succeeded before falling back, the blocks in the local
allocated list are never freed or spliced, causing a permanent memory leak.

Additionally, the fallback function is passed the caller's blocks list
directly instead of the local list. If it fails internally, it calls:

    gpu_buddy_free_list_internal(mm, blocks);

Doesn't this unconditionally empty the caller's entire list, destroying
any pre-existing blocks the caller might have had before calling
gpu_buddy_alloc_blocks()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260913084907.520877-2-david@davidgow.net?part=1