From nobody Sun Feb 8 19:56:01 2026 Received: from mail.nppct.ru (mail.nppct.ru [195.133.245.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B6FA1C5F18 for ; Mon, 21 Apr 2025 15:09:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=195.133.245.4 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745248188; cv=none; b=RhrSgo59fqV72e/Nm/TdcLk1ndahzl8NttKQy5q6TJxW7glqIsc5V9qVKC2ME2/DAneW05Y5MiJ4G0eOKmOxgSu3lTsd9DqHd/6I5pFHvgBC+hEotJ+K7q49dN7Fsiom9p2dBWMnrCc9LGnA2DH2NXH0sG7jqXn/1UWgs/VkoSk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745248188; c=relaxed/simple; bh=Mxlmt4OMFp+4CmM5qiqrCkALSFahEOttbOImrEbkWRQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fyOsU2+SwwirS12WXMUsUXnPx4VYK/ui62hcWpFbanWVQ6rHd3VU6xvvn3Bp/ZTkTQ9dyBjnpkaXlqKBKpfAYWjj9pH1f7LiEkywOC4vAhdSKSfmFIQDaDeZ9tfEY3pAYVJjGGlJPG6+ts+Bpw5qnG7Yd6s1WP07FkfrRsUkRd4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=nppct.ru; spf=pass smtp.mailfrom=nppct.ru; dkim=pass (1024-bit key) header.d=nppct.ru header.i=@nppct.ru header.b=DmeK9EXY; arc=none smtp.client-ip=195.133.245.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=nppct.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=nppct.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=nppct.ru header.i=@nppct.ru header.b="DmeK9EXY" Received: from mail.nppct.ru (localhost [127.0.0.1]) by mail.nppct.ru (Postfix) with ESMTP id 6BDB21C0E84 for ; Mon, 21 Apr 2025 18:09:30 +0300 (MSK) Authentication-Results: mail.nppct.ru (amavisd-new); dkim=pass (1024-bit key) reason="pass (just generated, assumed good)" header.d=nppct.ru DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nppct.ru; h= content-transfer-encoding:mime-version:x-mailer:message-id:date :date:subject:subject:to:from:from; s=dkim; t=1745248168; x= 1746112169; bh=Mxlmt4OMFp+4CmM5qiqrCkALSFahEOttbOImrEbkWRQ=; b=D meK9EXYwgAKV+hvjPDhcYWxudss57RKzX/nPlCTbnakedfLhWH56KdgxD+mqvLeQ mnFFx5gMIfViaE3I1WukP6S1jqQVO9yYVU03cDd+2UUehlk1zph0DrnsOM8Qx1In Ed5ZSCiixhNYzr1CKg+TFbGi/MI6boC9z1glBndOkY= X-Virus-Scanned: Debian amavisd-new at mail.nppct.ru Received: from mail.nppct.ru ([127.0.0.1]) by mail.nppct.ru (mail.nppct.ru [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 9wXA_r2g7JoZ for ; Mon, 21 Apr 2025 18:09:28 +0300 (MSK) Received: from localhost.localdomain (unknown [87.249.24.51]) by mail.nppct.ru (Postfix) with ESMTPSA id D4DA01C08C3; Mon, 21 Apr 2025 18:09:11 +0300 (MSK) From: Alexey Nepomnyashih To: Alex Deucher Cc: Alexey Nepomnyashih , =?UTF-8?q?Christian=20K=C3=B6nig?= , "Pan, Xinhui" , David Airlie , Daniel Vetter , Sasha Levin , Lijo Lazar , Greg Kroah-Hartman , Srinivasan Shanmugam , Friedrich Vock , Victor Zhao , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, stable@vger.kernel.org Subject: [PATCH] drm/amdgpu: restrict the hw sched jobs upper bound Date: Mon, 21 Apr 2025 15:09:03 +0000 Message-ID: <20250421150905.732842-1-sdl@nppct.ru> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The amdgpu_sched_hw_submission parameter controls the number of hardware jobs that can be scheduled concurrently per ring. This value is later multiplied by ring->max_dw to compute buffer offsets or command patch regions. If amdgpu_sched_hw_submission is set too high (by user input via module parameter), the multiplication can overflow, resulting in corrupted memory offsets or ring buffer overflows. Clamp amdgpu_sched_hw_submission to a practical upper bound (e.g. 2^16) to prevent arithmetic overflow when computing ring buffer offsets during initialization, especially in jpeg_v1_0_start(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Cc: stable@vger.kernel.org # v5.9+ Fixes: 5d5bd5e32e6e ("drm/amdgpu: restrict the hw sched jobs number to powe= r of two") Signed-off-by: Alexey Nepomnyashih --- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/a= md/amdgpu/amdgpu_device.c index 018dfccd771b..69217a021b0e 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c @@ -2056,6 +2056,10 @@ static int amdgpu_device_check_arguments(struct amdg= pu_device *adev) dev_warn(adev->dev, "sched hw submission jobs (%d) must be at least 2\n", amdgpu_sched_hw_submission); amdgpu_sched_hw_submission =3D 2; + } else if (amdgpu_sched_hw_submission > 65536) { + dev_warn(adev->dev, "sched hw submission jobs (%d) is too large\n", + amdgpu_sched_hw_submission); + amdgpu_sched_hw_submission =3D 65536; } else if (!is_power_of_2(amdgpu_sched_hw_submission)) { dev_warn(adev->dev, "sched hw submission jobs (%d) must be a power of 2\= n", amdgpu_sched_hw_submission); --=20 2.43.0