From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 235FAC44501 for ; Wed, 21 Jan 2026 10:00:18 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id DA2BB10E72F; Wed, 21 Jan 2026 10:00:17 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=intel.com header.i=@intel.com header.b="KEImx2ue"; dkim-atps=neutral Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.14]) by gabe.freedesktop.org (Postfix) with ESMTPS id 3C5B210E72F; Wed, 21 Jan 2026 10:00:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1768989615; x=1800525615; h=message-id:date:mime-version:subject:to:cc:references: from:in-reply-to:content-transfer-encoding; bh=wpVhcqegH84vgpSd/7Z8b3/XFcMb+4orma0aWUeifO0=; b=KEImx2ueMtWAoSyMgn+g16X2uUma4BUGs3eP0Xx/b0XuW5f+UEd6evNj WAV5Rq3xihYJOw5KwhuhKUtJqE3Wj+WglJ6DJei4qrpudLD1uCoV/zygL ez2oAyoKVJeHRKZ5SVOcX6aBi3w+GcTgTbjBl3+6WKeF8av0oCjdrF0Y+ 9f5TqOuSUBAyB1yC7HsGZEIgBi3k82gP5eE1wlaHr06XCV3oeKVI3FDZR pDK1G9EmP60DpDrs4SE7P9Fa0duEhlp1MMGPH0YFUBHnp/gB3A6HmGsSl p7l+uzTkRyjBsbCht3IJsm4qV7vcL8rv5UHlTf/BcpX58xV389DeY+XGm g==; X-CSE-ConnectionGUID: lbq3TDAsQgiMWvQ5XBlcNA== X-CSE-MsgGUID: Ixto/28LQ5iEN5KhxwQ3UA== X-IronPort-AV: E=McAfee;i="6800,10657,11677"; a="74065617" X-IronPort-AV: E=Sophos;i="6.21,242,1763452800"; d="scan'208";a="74065617" Received: from orviesa008.jf.intel.com ([10.64.159.148]) by orvoesa106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Jan 2026 02:00:14 -0800 X-CSE-ConnectionGUID: +KLZcQ2GTdqI+x2MkaVhiw== X-CSE-MsgGUID: i0xCllZLQqeoIwGwqrl1fw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.21,242,1763452800"; d="scan'208";a="206466917" Received: from smoticic-mobl1.ger.corp.intel.com (HELO [10.245.245.122]) ([10.245.245.122]) by orviesa008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Jan 2026 02:00:13 -0800 Message-ID: <8673cd9b-7140-4209-9d44-bbf3508cc266@intel.com> Date: Wed, 21 Jan 2026 10:00:11 +0000 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 1/2] drm/buddy: Prevent BUG_ON by validating rounded allocation To: Arunpravin Paneer Selvam , Sanjay Yadav , dri-devel@lists.freedesktop.org Cc: intel-xe@lists.freedesktop.org, stable@vger.kernel.org, =?UTF-8?Q?Christian_K=C3=B6nig?= References: <20260108113227.2101872-4-sanjay.kumar.yadav@intel.com> <20260108113227.2101872-5-sanjay.kumar.yadav@intel.com> <654f40ab-8402-4bb1-88ff-742572a1b251@intel.com> <0b5fa253-1c2d-45ae-a6bd-0373e27af64c@amd.com> Content-Language: en-GB From: Matthew Auld In-Reply-To: <0b5fa253-1c2d-45ae-a6bd-0373e27af64c@amd.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-BeenThere: intel-xe@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel Xe graphics driver List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-xe-bounces@lists.freedesktop.org Sender: "Intel-xe" On 21/01/2026 06:36, Arunpravin Paneer Selvam wrote: > > On 20/01/26 16:11, Matthew Auld wrote: >> On 08/01/2026 11:32, Sanjay Yadav wrote: >>> When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is >>> rounded up to the next power-of-two via roundup_pow_of_two(). >>> Similarly, for non-contiguous allocations with large min_block_size, >>> the size is aligned up via round_up(). Both operations can produce a >>> rounded size that exceeds mm->size, which later triggers >>> BUG_ON(order > mm->max_order). >>> >>> Example scenarios: >>> - 9G CONTIGUOUS allocation on 10G VRAM memory: >>>    roundup_pow_of_two(9G) = 16G > 10G >>> - 9G allocation with 8G min_block_size on 10G VRAM memory: >>>    round_up(9G, 8G) = 16G > 10G >>> >>> Fix this by checking the rounded size against mm->size. For >>> non-contiguous or range allocations where size > mm->size is invalid, >>> return -EINVAL immediately. For contiguous allocations without range >>> restrictions, allow the request to fall through to the existing >>> __alloc_contig_try_harder() fallback. >>> >>> This ensures invalid user input returns an error or uses the fallback >>> path instead of hitting BUG_ON. >>> >>> v2: (Matt A) >>> - Add Fixes, Cc stable, and Closes tags for context >>> >>> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6712 >>> Fixes: 0a1844bf0b53 ("drm/buddy: Improve contiguous memory allocation") >>> Cc: # v6.7+ >>> Cc: Christian König >>> Cc: Arunpravin Paneer Selvam >>> Suggested-by: Matthew Auld >>> Signed-off-by: Sanjay Yadav >>> Reviewed-by: Matthew Auld >>> Reviewed-by: Arunpravin Paneer Selvam >> >> Arun/Christian, when you get a chance could you also merge these two >> please? > > I have merged these 2 patches as well. Thanks. > > Regards, > > Arun. > >> >>> --- >>>   drivers/gpu/drm/drm_buddy.c | 9 +++++++++ >>>   1 file changed, 9 insertions(+) >>> >>> diff --git a/drivers/gpu/drm/drm_buddy.c b/drivers/gpu/drm/drm_buddy.c >>> index 2f279b46bd2c..5141348fc6c9 100644 >>> --- a/drivers/gpu/drm/drm_buddy.c >>> +++ b/drivers/gpu/drm/drm_buddy.c >>> @@ -1155,6 +1155,15 @@ int drm_buddy_alloc_blocks(struct drm_buddy *mm, >>>       order = fls(pages) - 1; >>>       min_order = ilog2(min_block_size) - ilog2(mm->chunk_size); >>>   +    if (order > mm->max_order || size > mm->size) { >>> +        if ((flags & DRM_BUDDY_CONTIGUOUS_ALLOCATION) && >>> +            !(flags & DRM_BUDDY_RANGE_ALLOCATION)) >>> +            return __alloc_contig_try_harder(mm, original_size, >>> +                             original_min_size, blocks); >>> + >>> +        return -EINVAL; >>> +    } >>> + >>>       do { >>>           order = min(order, (unsigned int)fls(pages) - 1); >>>           BUG_ON(order > mm->max_order); >>