linux-kernel - Re: [PATCH V1] accel/amdxdna: Remove buffer size check when creating command BO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f07f8ed2-aa0d-401b-a6e6-dd55cdcc075e@amd.com>
Date: Fri, 6 Feb 2026 09:20:31 -0600
From: Mario Limonciello <mario.limonciello@....com>
To: Lizhi Hou <lizhi.hou@....com>, ogabbay@...nel.org,
 quic_jhugo@...cinc.com, dri-devel@...ts.freedesktop.org,
 maciej.falkowski@...ux.intel.com
Cc: linux-kernel@...r.kernel.org, max.zhen@....com, sonal.santan@....com
Subject: Re: [PATCH V1] accel/amdxdna: Remove buffer size check when creating
 command BO



On 2/6/2026 12:02 AM, Lizhi Hou wrote:
> Large command buffers may be used, and they do not always need to be
> mapped or accessed by the driver. Performing a size check at command BO
> creation time unnecessarily rejects valid use cases.
> 
> Remove the buffer size check from command BO creation, and defer vmap
> and size validation to the paths where the driver actually needs to map
> and access the command buffer.
> 
> Fixes: ac49797c1815 ("accel/amdxdna: Add GEM buffer object management")
> Signed-off-by: Lizhi Hou <lizhi.hou@....com>
Reviewed-by: Mario Limonciello (AMD) <superm1@...nel.org>
> ---
>   drivers/accel/amdxdna/amdxdna_gem.c | 38 ++++++++++++++---------------
>   1 file changed, 19 insertions(+), 19 deletions(-)
> 
> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
> index dfa916eeb2d9..56341b7668b1 100644
> --- a/drivers/accel/amdxdna/amdxdna_gem.c
> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
> @@ -21,8 +21,6 @@
>   #include "amdxdna_pci_drv.h"
>   #include "amdxdna_ubuf.h"
>   
> -#define XDNA_MAX_CMD_BO_SIZE	SZ_32K
> -
>   MODULE_IMPORT_NS("DMA_BUF");
>   
>   static int
> @@ -746,12 +744,6 @@ amdxdna_drm_create_cmd_bo(struct drm_device *dev,
>   {
>   	struct amdxdna_dev *xdna = to_xdna_dev(dev);
>   	struct amdxdna_gem_obj *abo;
> -	int ret;
> -
> -	if (args->size > XDNA_MAX_CMD_BO_SIZE) {
> -		XDNA_ERR(xdna, "Command bo size 0x%llx too large", args->size);
> -		return ERR_PTR(-EINVAL);
> -	}
>   
>   	if (args->size < sizeof(struct amdxdna_cmd)) {
>   		XDNA_DBG(xdna, "Command BO size 0x%llx too small", args->size);
> @@ -765,17 +757,7 @@ amdxdna_drm_create_cmd_bo(struct drm_device *dev,
>   	abo->type = AMDXDNA_BO_CMD;
>   	abo->client = filp->driver_priv;
>   
> -	ret = amdxdna_gem_obj_vmap(abo, &abo->mem.kva);
> -	if (ret) {
> -		XDNA_ERR(xdna, "Vmap cmd bo failed, ret %d", ret);
> -		goto release_obj;
> -	}
> -
>   	return abo;
> -
> -release_obj:
> -	drm_gem_object_put(to_gobj(abo));
> -	return ERR_PTR(ret);
>   }
>   
>   int amdxdna_drm_create_bo_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
> @@ -872,6 +854,7 @@ struct amdxdna_gem_obj *amdxdna_gem_get_obj(struct amdxdna_client *client,
>   	struct amdxdna_dev *xdna = client->xdna;
>   	struct amdxdna_gem_obj *abo;
>   	struct drm_gem_object *gobj;
> +	int ret;
>   
>   	gobj = drm_gem_object_lookup(client->filp, bo_hdl);
>   	if (!gobj) {
> @@ -880,9 +863,26 @@ struct amdxdna_gem_obj *amdxdna_gem_get_obj(struct amdxdna_client *client,
>   	}
>   
>   	abo = to_xdna_obj(gobj);
> -	if (bo_type == AMDXDNA_BO_INVALID || abo->type == bo_type)
> +	if (bo_type != AMDXDNA_BO_INVALID && abo->type != bo_type)
> +		goto put_obj;
> +
> +	if (bo_type != AMDXDNA_BO_CMD || abo->mem.kva)
>   		return abo;
>   
> +	if (abo->mem.size > SZ_32K) {
> +		XDNA_ERR(xdna, "Cmd bo is too big %ld", abo->mem.size);
> +		goto put_obj;
> +	}
> +
> +	ret = amdxdna_gem_obj_vmap(abo, &abo->mem.kva);
> +	if (ret) {
> +		XDNA_ERR(xdna, "Vmap cmd bo failed, ret %d", ret);
> +		goto put_obj;
> +	}
> +
> +	return abo;
> +
> +put_obj:
>   	drm_gem_object_put(gobj);
>   	return NULL;
>   }