Re: [PATCH v2 1/2] drm/buddy: Prevent BUG_ON by validating rounded allocation

[Matthew Auld <matthew.auld@intel.com>]

On 21/01/2026 06:36, Arunpravin Paneer Selvam wrote:
> 
> On 20/01/26 16:11, Matthew Auld wrote:
>> On 08/01/2026 11:32, Sanjay Yadav wrote:
>>> When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is
>>> rounded up to the next power-of-two via roundup_pow_of_two().
>>> Similarly, for non-contiguous allocations with large min_block_size,
>>> the size is aligned up via round_up(). Both operations can produce a
>>> rounded size that exceeds mm->size, which later triggers
>>> BUG_ON(order > mm->max_order).
>>>
>>> Example scenarios:
>>> - 9G CONTIGUOUS allocation on 10G VRAM memory:
>>>    roundup_pow_of_two(9G) = 16G > 10G
>>> - 9G allocation with 8G min_block_size on 10G VRAM memory:
>>>    round_up(9G, 8G) = 16G > 10G
>>>
>>> Fix this by checking the rounded size against mm->size. For
>>> non-contiguous or range allocations where size > mm->size is invalid,
>>> return -EINVAL immediately. For contiguous allocations without range
>>> restrictions, allow the request to fall through to the existing
>>> __alloc_contig_try_harder() fallback.
>>>
>>> This ensures invalid user input returns an error or uses the fallback
>>> path instead of hitting BUG_ON.
>>>
>>> v2: (Matt A)
>>> - Add Fixes, Cc stable, and Closes tags for context
>>>
>>> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6712
>>> Fixes: 0a1844bf0b53 ("drm/buddy: Improve contiguous memory allocation")
>>> Cc: <stable@vger.kernel.org> # v6.7+
>>> Cc: Christian König <christian.koenig@amd.com>
>>> Cc: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
>>> Suggested-by: Matthew Auld <matthew.auld@intel.com>
>>> Signed-off-by: Sanjay Yadav <sanjay.kumar.yadav@intel.com>
>>> Reviewed-by: Matthew Auld <matthew.auld@intel.com>
>>> Reviewed-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
>>
>> Arun/Christian, when you get a chance could you also merge these two 
>> please?
> 
> I have merged these 2 patches as well.

Thanks.

> 
> Regards,
> 
> Arun.
> 
>>
>>> ---
>>>   drivers/gpu/drm/drm_buddy.c | 9 +++++++++
>>>   1 file changed, 9 insertions(+)
>>>
>>> diff --git a/drivers/gpu/drm/drm_buddy.c b/drivers/gpu/drm/drm_buddy.c
>>> index 2f279b46bd2c..5141348fc6c9 100644
>>> --- a/drivers/gpu/drm/drm_buddy.c
>>> +++ b/drivers/gpu/drm/drm_buddy.c
>>> @@ -1155,6 +1155,15 @@ int drm_buddy_alloc_blocks(struct drm_buddy *mm,
>>>       order = fls(pages) - 1;
>>>       min_order = ilog2(min_block_size) - ilog2(mm->chunk_size);
>>>   +    if (order > mm->max_order || size > mm->size) {
>>> +        if ((flags & DRM_BUDDY_CONTIGUOUS_ALLOCATION) &&
>>> +            !(flags & DRM_BUDDY_RANGE_ALLOCATION))
>>> +            return __alloc_contig_try_harder(mm, original_size,
>>> +                             original_min_size, blocks);
>>> +
>>> +        return -EINVAL;
>>> +    }
>>> +
>>>       do {
>>>           order = min(order, (unsigned int)fls(pages) - 1);
>>>           BUG_ON(order > mm->max_order);
>>