Re: [PATCH 3/4] drm/amdgpu/gfx9: replace BUG_ON with WARN_ON_ONCE for KIQ 64-bit fence flag

Christian König
2026-04-27T07:28:26Z

> gfx_v9_0_ring_emit_fence_kiq() contains a BUG_ON() that fires when
> the AMDGPU_FENCE_FLAG_64BIT flag is passed. The KIQ (Kernel
> Interface Queue) ring only allocates 32-bit writeback buffer
> addresses for fence sequence numbers. A 64-bit fence write would
> overflow the allocated writeback slot, potentially corrupting
> adjacent kernel memory.
>
> Replace BUG_ON() with WARN_ON_ONCE() and mask off the unsupported
> flag. This prevents the kernel panic while still logging the
> unexpected condition and falling back to a safe 32-bit fence write.
>
> This is separated from the main gfx9 BUG_ON conversion patch
> because it addresses a different security concern (potential buffer
> overflow in kernel-managed writeback memory) rather than the address
> alignment assertions in the ring emission paths.
>
> Found by a custom amdgpu DRM ioctl fuzzer.
>
> Fixes: b1023571479020e9 ("drm/amdgpu: implement GFX 9.0 support (v2)")
> Signed-off-by: John B. Moore <jbmoore61@gmail.com>
> Cc: stable@vger.kernel.org

And completely forgotten: Please drop the CC stable here. That is unjustified for this patch.

Regards,
Christian.

> ---
> drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
> index 47e81c33d..fb2a0f1af 100644
> --- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
> +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
> @@ -5679,7 +5679,8 @@ static void gfx_v9_0_ring_emit_fence_kiq(struct amdgpu_ring *ring, u64 addr,
> struct amdgpu_device *adev = ring->adev;
>
> /* we only allocate 32bit for each seq wb address */
> - BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
> + if (WARN_ON_ONCE(flags & AMDGPU_FENCE_FLAG_64BIT))
> + flags &= ~AMDGPU_FENCE_FLAG_64BIT;
>
> /* write fence seq to the "addr" */
> amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));