drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
Return the error code if amdgpu_userq_input_va_validate() fails. Don't
return success.
Fixes: 9e46b8bb0539 ("drm/amdgpu: validate userq buffer virtual address and size")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
index 2db9b2c63693..775b0bd5d6c4 100644
--- a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
+++ b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
@@ -298,8 +298,9 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
goto free_mqd;
}
- if (amdgpu_userq_input_va_validate(queue->vm, compute_mqd->eop_va,
- max_t(u32, PAGE_SIZE, AMDGPU_GPU_PAGE_SIZE)))
+ r = amdgpu_userq_input_va_validate(queue->vm, compute_mqd->eop_va,
+ max_t(u32, PAGE_SIZE, AMDGPU_GPU_PAGE_SIZE));
+ if (r)
goto free_mqd;
userq_props->eop_gpu_addr = compute_mqd->eop_va;
@@ -330,8 +331,9 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
userq_props->tmz_queue =
mqd_user->flags & AMDGPU_USERQ_CREATE_FLAGS_QUEUE_SECURE;
- if (amdgpu_userq_input_va_validate(queue->vm, mqd_gfx_v11->shadow_va,
- shadow_info.shadow_size))
+ r = amdgpu_userq_input_va_validate(queue->vm, mqd_gfx_v11->shadow_va,
+ shadow_info.shadow_size);
+ if (r)
goto free_mqd;
kfree(mqd_gfx_v11);
@@ -351,8 +353,9 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
goto free_mqd;
}
- if (amdgpu_userq_input_va_validate(queue->vm, mqd_sdma_v11->csa_va,
- shadow_info.csa_size))
+ r = amdgpu_userq_input_va_validate(queue->vm, mqd_sdma_v11->csa_va,
+ shadow_info.csa_size);
+ if (r)
goto free_mqd;
userq_props->csa_addr = mqd_sdma_v11->csa_va;
--
2.51.0
On 18.09.25 11:46, Dan Carpenter wrote: > Return the error code if amdgpu_userq_input_va_validate() fails. Don't > return success. > > Fixes: 9e46b8bb0539 ("drm/amdgpu: validate userq buffer virtual address and size") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 15 +++++++++------ > 1 file changed, 9 insertions(+), 6 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c > index 2db9b2c63693..775b0bd5d6c4 100644 > --- a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c > +++ b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c > @@ -298,8 +298,9 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr, > goto free_mqd; > } > > - if (amdgpu_userq_input_va_validate(queue->vm, compute_mqd->eop_va, > - max_t(u32, PAGE_SIZE, AMDGPU_GPU_PAGE_SIZE))) > + r = amdgpu_userq_input_va_validate(queue->vm, compute_mqd->eop_va, > + max_t(u32, PAGE_SIZE, AMDGPU_GPU_PAGE_SIZE)); That code is nonsense to begin with, AMDGPU_GPU_PAGE_SIZE is always <= PAGE_SIZE or otherwise the whole driver stack doesn't work. We should probably drop the max_t() as well. Regards, Christian. > + if (r) > goto free_mqd; > > userq_props->eop_gpu_addr = compute_mqd->eop_va; > @@ -330,8 +331,9 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr, > userq_props->tmz_queue = > mqd_user->flags & AMDGPU_USERQ_CREATE_FLAGS_QUEUE_SECURE; > > - if (amdgpu_userq_input_va_validate(queue->vm, mqd_gfx_v11->shadow_va, > - shadow_info.shadow_size)) > + r = amdgpu_userq_input_va_validate(queue->vm, mqd_gfx_v11->shadow_va, > + shadow_info.shadow_size); > + if (r) > goto free_mqd; > > kfree(mqd_gfx_v11); > @@ -351,8 +353,9 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr, > goto free_mqd; > } > > - if (amdgpu_userq_input_va_validate(queue->vm, mqd_sdma_v11->csa_va, > - shadow_info.csa_size)) > + r = amdgpu_userq_input_va_validate(queue->vm, mqd_sdma_v11->csa_va, > + shadow_info.csa_size); > + if (r) > goto free_mqd; > > userq_props->csa_addr = mqd_sdma_v11->csa_va;
© 2016 - 2025 Red Hat, Inc.