<div dir="ltr"><div>USHRT_MAX seems too low. Traces for workstation apps create 20-30k BOs, which is not very far from the limit. RADV doesn't suballocate BOs. Neither GL nor VK has a ilmit on the number of BOs that can be created. The hypothetical maximum number of BOs that can be allocated on a GPU with 32GB of addressable memory is 8 million.</div><div> </div><div>Marek</div></div> <div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Mon, Apr 28, 2025 at 10:53 AM Christian König <<a href="mailto:christian.koenig@amd.com">christian.koenig@amd.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 4/24/25 15:40, Alex Deucher wrote: > On Wed, Apr 23, 2025 at 10:29 AM Christian König > <<a href="mailto:christian.koenig@amd.com" target="_blank">christian.koenig@amd.com</a>> wrote: >> >> On 4/22/25 18:26, Deucher, Alexander wrote: >>> [Public] >>> >>>> -----Original Message----- >>>> From: Alex Deucher <<a href="mailto:alexdeucher@gmail.com" target="_blank">alexdeucher@gmail.com</a>> >>>> Sent: Tuesday, April 22, 2025 9:46 AM >>>> To: Koenig, Christian <<a href="mailto:Christian.Koenig@amd.com" target="_blank">Christian.Koenig@amd.com</a>> >>>> Cc: Denis Arefev <<a href="mailto:arefev@swemel.ru" target="_blank">arefev@swemel.ru</a>>; Deucher, Alexander >>>> <<a href="mailto:Alexander.Deucher@amd.com" target="_blank">Alexander.Deucher@amd.com</a>>; David Airlie <<a href="mailto:airlied@gmail.com" target="_blank">airlied@gmail.com</a>>; Simona Vetter >>>> <<a href="mailto:simona@ffwll.ch" target="_blank">simona@ffwll.ch</a>>; Andrey Grodzovsky <<a href="mailto:andrey.grodzovsky@amd.com" target="_blank">andrey.grodzovsky@amd.com</a>>; >>>> Chunming Zhou <<a href="mailto:david1.zhou@amd.com" target="_blank">david1.zhou@amd.com</a>>; <a href="mailto:amd-gfx@lists.freedesktop.org" target="_blank">amd-gfx@lists.freedesktop.org</a>; dri- >>>> <a href="mailto:devel@lists.freedesktop.org" target="_blank">devel@lists.freedesktop.org</a>; <a href="mailto:linux-kernel@vger.kernel.org" target="_blank">linux-kernel@vger.kernel.org</a>; lvc- >>>> <a href="mailto:project@linuxtesting.org" target="_blank">project@linuxtesting.org</a>; <a href="mailto:stable@vger.kernel.org" target="_blank">stable@vger.kernel.org</a> >>>> Subject: Re: [PATCH v2] drm/amdgpu: check a user-provided number of BOs in list >>>> >>>> Applied. Thanks! >>> >>> This change beaks the following IGT tests: >>> >>> igt@amdgpu/amd_vcn@vcn-decoder-create-decode-destroy@vcn-decoder-create >>> igt@amdgpu/amd_vcn@vcn-decoder-create-decode-destroy@vcn-decoder-decode >>> igt@amdgpu/amd_vcn@vcn-decoder-create-decode-destroy@vcn-decoder-destroy >>> igt@amdgpu/amd_jpeg_dec@amdgpu_cs_jpeg_decode >>> igt@amdgpu/amd_cs_nop@cs-nops-with-nop-compute0@cs-nop-with-nop-compute0 >>> igt@amdgpu/amd_cs_nop@cs-nops-with-sync-compute0@cs-nop-with-sync-compute0 >>> igt@amdgpu/amd_cs_nop@cs-nops-with-fork-compute0@cs-nop-with-fork-compute0 >>> igt@amdgpu/amd_cs_nop@cs-nops-with-sync-fork-compute0@cs-nop-with-sync-fork-compute0 >>> igt@amdgpu/amd_basic@userptr-with-ip-dma@userptr >>> igt@amdgpu/amd_basic@cs-compute-with-ip-compute@cs-compute >>> igt@amdgpu/amd_basic@cs-sdma-with-ip-dma@cs-sdma >>> igt@amdgpu/amd_basic@eviction-test-with-ip-dma@eviction_test >>> igt@amdgpu/amd_cp_dma_misc@gtt_to_vram-amdgpu_hw_ip_compute0 >>> igt@amdgpu/amd_cp_dma_misc@vram_to_gtt-amdgpu_hw_ip_compute0 >>> igt@amdgpu/amd_cp_dma_misc@vram_to_vram-amdgpu_hw_ip_compute0 >> >> >> Could it be that we used BO list with zero entries for those? > > Yes. Dropping the 0 check fixed them. E.g., > > + if (in->bo_number > USHRT_MAX) > + return -EINVAL; Feel free to keep my rb on that version as well. Christian. > > Alex > >> >> Christian. >> >>> >>> Alex >>> >>>> >>>> On Tue, Apr 22, 2025 at 5:13 AM Koenig, Christian <<a href="mailto:Christian.Koenig@amd.com" target="_blank">Christian.Koenig@amd.com</a>> >>>> wrote: >>>>> >>>>> [AMD Official Use Only - AMD Internal Distribution Only] >>>>> >>>>> Reviewed-by: Christian König <<a href="mailto:christian.koenig@amd.com" target="_blank">christian.koenig@amd.com</a>> >>>>> >>>>> ________________________________________ >>>>> Von: Denis Arefev <<a href="mailto:arefev@swemel.ru" target="_blank">arefev@swemel.ru</a>> >>>>> Gesendet: Freitag, 18. April 2025 10:31 >>>>> An: Deucher, Alexander >>>>> Cc: Koenig, Christian; David Airlie; Simona Vetter; Andrey Grodzovsky; >>>>> Chunming Zhou; <a href="mailto:amd-gfx@lists.freedesktop.org" target="_blank">amd-gfx@lists.freedesktop.org</a>; >>>>> <a href="mailto:dri-devel@lists.freedesktop.org" target="_blank">dri-devel@lists.freedesktop.org</a>; <a href="mailto:linux-kernel@vger.kernel.org" target="_blank">linux-kernel@vger.kernel.org</a>; >>>>> <a href="mailto:lvc-project@linuxtesting.org" target="_blank">lvc-project@linuxtesting.org</a>; <a href="mailto:stable@vger.kernel.org" target="_blank">stable@vger.kernel.org</a> >>>>> Betreff: [PATCH v2] drm/amdgpu: check a user-provided number of BOs in >>>>> list >>>>> >>>>> The user can set any value to the variable ‘bo_number’, via the ioctl >>>>> command DRM_IOCTL_AMDGPU_BO_LIST. This will affect the arithmetic >>>>> expression ‘in->bo_number * in->bo_info_size’, which is prone to >>>>> overflow. Add a valid value check. >>>>> >>>>> Found by Linux Verification Center (<a href="http://linuxtesting.org" rel="noreferrer" target="_blank">linuxtesting.org</a>) with SVACE. >>>>> >>>>> Fixes: 964d0fbf6301 ("drm/amdgpu: Allow to create BO lists in CS ioctl >>>>> v3") >>>>> Cc: <a href="mailto:stable@vger.kernel.org" target="_blank">stable@vger.kernel.org</a> >>>>> Signed-off-by: Denis Arefev <<a href="mailto:arefev@swemel.ru" target="_blank">arefev@swemel.ru</a>> >>>>> --- >>>>> V1 -> V2: >>>>> Set a reasonable limit 'USHRT_MAX' for 'bo_number' it as Christian >>>>> König <<a href="mailto:christian.koenig@amd.com" target="_blank">christian.koenig@amd.com</a>> suggested >>>>> >>>>> drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 3 +++ >>>>> 1 file changed, 3 insertions(+) >>>>> >>>>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c >>>>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c >>>>> index 702f6610d024..85f7ee1e085d 100644 >>>>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c >>>>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c >>>>> @@ -189,6 +189,9 @@ int amdgpu_bo_create_list_entry_array(struct >>>> drm_amdgpu_bo_list_in *in, >>>>> struct drm_amdgpu_bo_list_entry *info; >>>>> int r; >>>>> >>>>> + if (!in->bo_number || in->bo_number > USHRT_MAX) >>>>> + return -EINVAL; >>>>> + >>>>> info = kvmalloc_array(in->bo_number, info_size, GFP_KERNEL); >>>>> if (!info) >>>>> return -ENOMEM; >>>>> -- >>>>> 2.43.0 >>>>> >> </blockquote></div>