linux-kernel - Re: [PATCH next] drm/amdgpu/userq: Fix error codes in mes_userq_mqd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <111d7bd7-57bb-4873-a62f-876128281572@amd.com>
Date: Thu, 18 Sep 2025 11:57:20 +0200
From: Christian König <christian.koenig@....com>
To: Dan Carpenter <dan.carpenter@...aro.org>,
 Prike Liang <Prike.Liang@....com>
Cc: Alex Deucher <alexander.deucher@....com>, David Airlie
 <airlied@...il.com>, Simona Vetter <simona@...ll.ch>,
 Shashank Sharma <shashank.sharma@....com>,
 Arvind Yadav <Arvind.Yadav@....com>, Sunil Khatri <sunil.khatri@....com>,
 "Jesse.Zhang" <Jesse.Zhang@....com>,
 Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@....com>,
 amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
 linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: Re: [PATCH next] drm/amdgpu/userq: Fix error codes in
 mes_userq_mqd_create()



On 18.09.25 11:46, Dan Carpenter wrote:
> Return the error code if amdgpu_userq_input_va_validate() fails.  Don't
> return success.
> 
> Fixes: 9e46b8bb0539 ("drm/amdgpu: validate userq buffer virtual address and size")
> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
> ---
>  drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 15 +++++++++------
>  1 file changed, 9 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
> index 2db9b2c63693..775b0bd5d6c4 100644
> --- a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
> +++ b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
> @@ -298,8 +298,9 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
>  			goto free_mqd;
>  		}
>  
> -		if (amdgpu_userq_input_va_validate(queue->vm, compute_mqd->eop_va,
> -		    max_t(u32, PAGE_SIZE, AMDGPU_GPU_PAGE_SIZE)))
> +		r = amdgpu_userq_input_va_validate(queue->vm, compute_mqd->eop_va,
> +		    max_t(u32, PAGE_SIZE, AMDGPU_GPU_PAGE_SIZE));

That code is nonsense to begin with, AMDGPU_GPU_PAGE_SIZE is always <= PAGE_SIZE or otherwise the whole driver stack doesn't work.

We should probably drop the max_t() as well.

Regards,
Christian.

> +		if (r)
>  			goto free_mqd;
>  
>  		userq_props->eop_gpu_addr = compute_mqd->eop_va;
> @@ -330,8 +331,9 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
>  		userq_props->tmz_queue =
>  			mqd_user->flags & AMDGPU_USERQ_CREATE_FLAGS_QUEUE_SECURE;
>  
> -		if (amdgpu_userq_input_va_validate(queue->vm, mqd_gfx_v11->shadow_va,
> -		    shadow_info.shadow_size))
> +		r = amdgpu_userq_input_va_validate(queue->vm, mqd_gfx_v11->shadow_va,
> +		    shadow_info.shadow_size);
> +		if (r)
>  			goto free_mqd;
>  
>  		kfree(mqd_gfx_v11);
> @@ -351,8 +353,9 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
>  			goto free_mqd;
>  		}
>  
> -		if (amdgpu_userq_input_va_validate(queue->vm, mqd_sdma_v11->csa_va,
> -		    shadow_info.csa_size))
> +		r = amdgpu_userq_input_va_validate(queue->vm, mqd_sdma_v11->csa_va,
> +		    shadow_info.csa_size);
> +		if (r)
>  			goto free_mqd;
>  
>  		userq_props->csa_addr = mqd_sdma_v11->csa_va;