Re: [PATCH 3/4] drm/amdgpu/gfx9: replace BUG_ON with WARN_ON_ONCE for KIQ 64-bit fence flag

["Christian König" <christian.koenig@amd.com>]

On 4/26/26 23:52, jbmoore wrote:
> From: "John B. Moore" <jbmoore61@gmail.com>
> 
> gfx_v9_0_ring_emit_fence_kiq() contains a BUG_ON() that fires when
> the AMDGPU_FENCE_FLAG_64BIT flag is passed.  The KIQ (Kernel
> Interface Queue) ring only allocates 32-bit writeback buffer
> addresses for fence sequence numbers.  A 64-bit fence write would
> overflow the allocated writeback slot, potentially corrupting
> adjacent kernel memory.
> 
> Replace BUG_ON() with WARN_ON_ONCE() and mask off the unsupported
> flag.  This prevents the kernel panic while still logging the
> unexpected condition and falling back to a safe 32-bit fence write.
> 
> This is separated from the main gfx9 BUG_ON conversion patch
> because it addresses a different security concern (potential buffer
> overflow in kernel-managed writeback memory) rather than the address
> alignment assertions in the ring emission paths.
> 
> Found by a custom amdgpu DRM ioctl fuzzer.
> 
> Fixes: b1023571479020e9 ("drm/amdgpu: implement GFX 9.0 support (v2)")
> Signed-off-by: John B. Moore <jbmoore61@gmail.com>
> Cc: stable@vger.kernel.org

And completely forgotten: Please drop the CC stable here. That is unjustified for this patch.

Regards,
Christian.

> ---
>  drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
> index 47e81c33d..fb2a0f1af 100644
> --- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
> +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
> @@ -5679,7 +5679,8 @@ static void gfx_v9_0_ring_emit_fence_kiq(struct amdgpu_ring *ring, u64 addr,
>  	struct amdgpu_device *adev = ring->adev;
>  
>  	/* we only allocate 32bit for each seq wb address */
> -	BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
> +	if (WARN_ON_ONCE(flags & AMDGPU_FENCE_FLAG_64BIT))
> +		flags &= ~AMDGPU_FENCE_FLAG_64BIT;
>  
>  	/* write fence seq to the "addr" */
>  	amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));