Re: [PATCH 1/2] drm/buddy: Prevent BUG_ON by validating rounded allocation

[Matthew Auld <matthew.auld@intel.com>]

On 22/12/2025 06:52, Sanjay Yadav wrote:
> When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is
> rounded up to the next power-of-two via roundup_pow_of_two().
> Similarly, for non-contiguous allocations with large min_block_size,
> the size is aligned up via round_up(). Both operations can produce a
> rounded size that exceeds mm->size, which later triggers
> BUG_ON(order > mm->max_order).
> 
> Example scenarios:
> - 9G CONTIGUOUS allocation on 10G VRAM memory:
>    roundup_pow_of_two(9G) = 16G > 10G
> - 9G allocation with 8G min_block_size on 10G VRAM memory:
>    round_up(9G, 8G) = 16G > 10G
> 
> Fix this by checking the rounded size against mm->size. For
> non-contiguous or range allocations where size > mm->size is invalid,
> return -EINVAL immediately. For contiguous allocations without range
> restrictions, allow the request to fall through to the existing
> __alloc_contig_try_harder() fallback.
> 
> This ensures invalid user input returns an error or uses the fallback
> path instead of hitting BUG_ON.
> 
> Cc: Christian König <christian.koenig@amd.com>
> Cc: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
> Suggested-by: Matthew Auld <matthew.auld@intel.com>
> Signed-off-by: Sanjay Yadav <sanjay.kumar.yadav@intel.com>

I think we should maybe add a fixes tag:

Fixes: 0a1844bf0b53 ("drm/buddy: Improve contiguous memory allocation")
Cc: <stable@vger.kernel.org> # v6.7+

?

I don't think current xe can actually trigger this yet, but not sure if 
amdgpu or something can somehow trigger this in some obscure case.

We could maybe also add:

Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6712

So it auto-closes plus gives some more context that this fix was 
motivated from code inspection and not some user report. Otherwise I 
think the change looks reasonable,
Reviewed-by: Matthew Auld <matthew.auld@intel.com>

> ---
>   drivers/gpu/drm/drm_buddy.c | 9 +++++++++
>   1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/gpu/drm/drm_buddy.c b/drivers/gpu/drm/drm_buddy.c
> index 2f279b46bd2c..5141348fc6c9 100644
> --- a/drivers/gpu/drm/drm_buddy.c
> +++ b/drivers/gpu/drm/drm_buddy.c
> @@ -1155,6 +1155,15 @@ int drm_buddy_alloc_blocks(struct drm_buddy *mm,
>   	order = fls(pages) - 1;
>   	min_order = ilog2(min_block_size) - ilog2(mm->chunk_size);
>   
> +	if (order > mm->max_order || size > mm->size) {
> +		if ((flags & DRM_BUDDY_CONTIGUOUS_ALLOCATION) &&
> +		    !(flags & DRM_BUDDY_RANGE_ALLOCATION))
> +			return __alloc_contig_try_harder(mm, original_size,
> +							 original_min_size, blocks);
> +
> +		return -EINVAL;
> +	}
> +
>   	do {
>   		order = min(order, (unsigned int)fls(pages) - 1);
>   		BUG_ON(order > mm->max_order);