[Public]
Regards,
Prike
> -----Original Message-----
> From: Koenig, Christian <christian.koe...@amd.com>
> Sent: Friday, July 11, 2025 8:08 PM
> To: Liang, Prike <prike.li...@amd.com>; amd-gfx@lists.freedesktop.org
> Cc: Deucher, Alexander <alexander.deuc...@amd.com>
> Subject: Re: [PATCH v6 04/11] drm/amdgpu: validate userq buffer virtual
> address
> and size
>
>
>
> On 11.07.25 11:39, Prike Liang wrote:
> > It needs to validate the userq object virtual address to determin
> > whether it is residented in a valid vm mapping.
> >
> > Signed-off-by: Prike Liang <prike.li...@amd.com>
> > Reviewed-by: Alex Deucher <alexander.deuc...@amd.com>
> > ---
> > drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 38
> > ++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h |
> > 2 ++ drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 25 ++++++++++++++
> > 3 files changed, 65 insertions(+)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> > b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> > index 15e833b1b3e3..a41dd38b0adb 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> > @@ -44,6 +44,36 @@ u32 amdgpu_userq_get_supported_ip_mask(struct
> amdgpu_device *adev)
> > return userq_ip_mask;
> > }
> >
> > +int amdgpu_userq_input_va_validate(struct amdgpu_vm *vm, u64 addr,
> > + u64 expected_size)
> > +{
> > + struct amdgpu_bo_va_mapping *va_map;
> > + u64 user_addr;
> > + u64 size;
> > + int r;
> > +
> > + user_addr = (addr & AMDGPU_GMC_HOLE_MASK) >>
> AMDGPU_GPU_PAGE_SHIFT;
> > + size = expected_size >> AMDGPU_GPU_PAGE_SHIFT;
> > +
> > + r = amdgpu_bo_reserve(vm->root.bo, false);
> > + if (r)
> > + return r;
> > +
> > + va_map = amdgpu_vm_bo_lookup_mapping(vm, user_addr);
> > + if (!va_map)
> > + goto out_err;
> > + /* Only validate the userq whether resident in the VM mapping range */
> > + if (user_addr >= va_map->start &&
>
> This check is unecessary.
>
> > + (size != 0 && user_addr + size - 1 <= va_map->last)) {
>
> The size != 0 check is unecessary as well and you need to be careful with wrap
> arounds.
>
> Better write this like that (va_map->last - user_addr + 1 >= size)
Thank you for the suggestion, will update this in later version.
>
> > + amdgpu_bo_unreserve(vm->root.bo);
> > + return 0;
> > + }
> > +
> > +out_err:
> > + amdgpu_bo_unreserve(vm->root.bo);
> > + return -EINVAL;
> > +}
> > +
> > static int
> > amdgpu_userq_unmap_helper(struct amdgpu_userq_mgr *uq_mgr,
> > struct amdgpu_usermode_queue *queue) @@ -386,6
> +416,14 @@
> > amdgpu_userq_create(struct drm_file *filp, union drm_amdgpu_userq *args)
> > r = -EINVAL;
> > goto unlock;
> > }
> > + /* Validate the userq virtual address.*/
> > + if (amdgpu_userq_input_va_validate(&fpriv->vm, args->in.queue_va, args-
> >in.queue_size) ||
> > + amdgpu_userq_input_va_validate(&fpriv->vm, args->in.rptr_va,
> PAGE_SIZE) ||
> > + amdgpu_userq_input_va_validate(&fpriv->vm, args->in.wptr_va,
> PAGE_SIZE)) {
> > + drm_file_err(uq_mgr->file, "Usermode queue input virt address is
> > +invalid\n");
>
> No error message on invalid userspace parameters please.
OK, why can't give the alert log for the invalid user case?
It's useful for catching the userq invalid VA/size case, how about change the
error message to a debug level?
> Apart from those comments looks like the right thing to do to me.
>
> Regards,
> Christian.
>
> > + r = -EINVAL;
> > + goto unlock;
> > + }
> >
> > queue = kzalloc(sizeof(struct amdgpu_usermode_queue), GFP_KERNEL);
> > if (!queue) {
> > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
> > b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
> > index ec040c2fd6c9..704935ca0c36 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
> > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
> > @@ -132,4 +132,6 @@ int
> > amdgpu_userq_stop_sched_for_enforce_isolation(struct amdgpu_device *adev,
> int amdgpu_userq_start_sched_for_enforce_isolation(struct amdgpu_device *adev,
> > u32 idx);
> >
> > +int amdgpu_userq_input_va_validate(struct amdgpu_vm *vm, u64 addr,
> > + u64 expected_size);
> > #endif
> > diff --git a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
> > b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
> > index 15aa1ca67a11..75b9a6294b53 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
> > @@ -206,6 +206,7 @@ static int mes_userq_mqd_create(struct
> amdgpu_userq_mgr *uq_mgr,
> > struct amdgpu_mqd *mqd_hw_default = &adev->mqds[queue->queue_type];
> > struct drm_amdgpu_userq_in *mqd_user = args_in;
> > struct amdgpu_mqd_prop *userq_props;
> > + struct amdgpu_gfx_shadow_info shadow_info;
> > int r;
> >
> > /* Structure to initialize MQD for userqueue using generic MQD init
> > function */ @@ -231,6 +232,8 @@ static int mes_userq_mqd_create(struct
> amdgpu_userq_mgr *uq_mgr,
> > userq_props->doorbell_index = queue->doorbell_index;
> > userq_props->fence_address = queue->fence_drv->gpu_addr;
> >
> > + if (adev->gfx.funcs->get_gfx_shadow_info)
> > + adev->gfx.funcs->get_gfx_shadow_info(adev, &shadow_info, true);
> > if (queue->queue_type == AMDGPU_HW_IP_COMPUTE) {
> > struct drm_amdgpu_userq_mqd_compute_gfx11 *compute_mqd;
> >
> > @@ -247,6 +250,13 @@ static int mes_userq_mqd_create(struct
> amdgpu_userq_mgr *uq_mgr,
> > goto free_mqd;
> > }
> >
> > + if (amdgpu_userq_input_va_validate(queue->vm, compute_mqd-
> >eop_va,
> > + max_t(u32, PAGE_SIZE,
> AMDGPU_GPU_PAGE_SIZE))) {
> > + drm_file_err(uq_mgr->file, "EOP VA is invalid\n");
> > + r = -EINVAL;
> > + goto free_mqd;
> > + }
> > +
> > userq_props->eop_gpu_addr = compute_mqd->eop_va;
> > userq_props->hqd_pipe_priority =
> AMDGPU_GFX_PIPE_PRIO_NORMAL;
> > userq_props->hqd_queue_priority =
> > AMDGPU_GFX_QUEUE_PRIORITY_MINIMUM;
> > @@ -274,6 +284,14 @@ static int mes_userq_mqd_create(struct
> amdgpu_userq_mgr *uq_mgr,
> > userq_props->csa_addr = mqd_gfx_v11->csa_va;
> > userq_props->tmz_queue =
> > mqd_user->flags &
> AMDGPU_USERQ_CREATE_FLAGS_QUEUE_SECURE;
> > +
> > + if (amdgpu_userq_input_va_validate(queue->vm, mqd_gfx_v11-
> >shadow_va,
> > + shadow_info.shadow_size)) {
> > + drm_file_err(uq_mgr->file, "shadow VA is invalid\n");
> > + r = -EINVAL;
> > + goto free_mqd;
> > + }
> > +
> > kfree(mqd_gfx_v11);
> > } else if (queue->queue_type == AMDGPU_HW_IP_DMA) {
> > struct drm_amdgpu_userq_mqd_sdma_gfx11 *mqd_sdma_v11; @@
> -291,6
> > +309,13 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr
> *uq_mgr,
> > goto free_mqd;
> > }
> >
> > + if (amdgpu_userq_input_va_validate(queue->vm, mqd_sdma_v11-
> >csa_va,
> > + shadow_info.csa_size)) {
> > + drm_file_err(uq_mgr->file, "CSA VA is invalid\n");
> > + r = -EINVAL;
> > + goto free_mqd;
> > + }
> > +
> > userq_props->csa_addr = mqd_sdma_v11->csa_va;
> > kfree(mqd_sdma_v11);
> > }
