From: Sanjay Yadav <sanjay.kumar.yadav@intel.com>
To: dri-devel@lists.freedesktop.org
Cc: intel-xe@lists.freedesktop.org,
"Christian König" <christian.koenig@amd.com>,
"Arunpravin Paneer Selvam" <Arunpravin.PaneerSelvam@amd.com>,
"Matthew Auld" <matthew.auld@intel.com>
Subject: [PATCH v2 0/2] drm/buddy: Fix BUG_ON from oversized rounded allocations
Date: Thu, 8 Jan 2026 17:02:28 +0530 [thread overview]
Message-ID: <20260108113227.2101872-4-sanjay.kumar.yadav@intel.com> (raw)
This series addresses a crash in drm_buddy allocator when allocation
requests exceed mm->max_order after rounding operations. This can occur
with non-power-of-two VRAM sizes (e.g., 10G = 8G + 2G roots) where
mm->max_order represents the largest block (8G).
The issue manifests in two scenarios:
1. CONTIGUOUS allocations: roundup_pow_of_two(9G) = 16G > 10G
2. Large min_block_size: round_up(9G, 8G) = 16G > 10G
Both cases trigger BUG_ON(order > mm->max_order) deep in the allocation
path, crashing the system on invalid user input.
The fix validates the rounded size early and handles it appropriately:
- For CONTIGUOUS-only allocations, use the existing try_harder fallback
- For other cases (non-contiguous, or contiguous+range), return -EINVAL
v2: (Matt A)
- Add Fixes, Cc stable, and Closes tags for context
Cc: Christian König <christian.koenig@amd.com>
Cc: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Suggested-by: Matthew Auld <matthew.auld@intel.com>
Sanjay Yadav (2):
drm/buddy: Prevent BUG_ON by validating rounded allocation
drm/tests/drm_buddy: Add tests for allocations exceeding max_order
drivers/gpu/drm/drm_buddy.c | 9 +++++++
drivers/gpu/drm/tests/drm_buddy_test.c | 35 ++++++++++++++++++++++++++
2 files changed, 44 insertions(+)
--
2.52.0
next reply other threads:[~2026-01-08 11:34 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-08 11:32 Sanjay Yadav [this message]
2026-01-08 11:32 ` [PATCH v2 1/2] drm/buddy: Prevent BUG_ON by validating rounded allocation Sanjay Yadav
2026-01-20 10:41 ` Matthew Auld
2026-01-21 6:36 ` Arunpravin Paneer Selvam
2026-01-21 10:00 ` Matthew Auld
2026-01-08 11:32 ` [PATCH v2 2/2] drm/tests/drm_buddy: Add tests for allocations exceeding max_order Sanjay Yadav
2026-01-08 11:46 ` ✓ CI.KUnit: success for drm/buddy: Fix BUG_ON from oversized rounded allocations (rev2) Patchwork
2026-01-08 12:01 ` ✗ CI.checksparse: warning " Patchwork
2026-01-08 12:24 ` ✓ Xe.CI.BAT: success " Patchwork
2026-01-08 15:36 ` ✗ Xe.CI.Full: failure " Patchwork
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260108113227.2101872-4-sanjay.kumar.yadav@intel.com \
--to=sanjay.kumar.yadav@intel.com \
--cc=Arunpravin.PaneerSelvam@amd.com \
--cc=christian.koenig@amd.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=intel-xe@lists.freedesktop.org \
--cc=matthew.auld@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox