drm/amdgpu/userq: reject mappings without a backing BO

Browse source

PRT mappings have a bo_va but no backing BO. Reject them when validating
queue buffers and when looking up the WPTR for MES or USERQ_SIGNAL, before
passing the BO to the reservation or CPU mapping helpers.

Repeat the check at the WPTR lookups because the VM reservation is dropped
between initial validation and use.

Without this, pointing a user queue's WPTR at a PRT (sparse) VA mapping
makes mes_userq_create_wptr_mapping() dereference a NULL bo (base.bo) and
oops in the reservation helper:

  BUG: kernel NULL pointer dereference, address: 0000000000000158
  Oops: 0000 [#1] SMP NOPTI
  CPU: 0 UID: 0 PID: 4558 Comm: amd_fuzzing Tainted: G            E       7.1.0+
  RIP: 0010:drm_exec_lock_obj+0x2b/0x140 [drm_exec]
  CR2: 0000000000000158
  Call Trace:
   drm_exec_prepare_obj+0x25/0x60 [drm_exec]
   mes_userq_create_wptr_mapping+0xc4/0x1c0 [amdgpu]
   mes_userq_mqd_create+0x351/0x870 [amdgpu]
   amdgpu_userq_ioctl+0x7ef/0xf80 [amdgpu]
   drm_ioctl_kernel+0xac/0x110 [drm]
   drm_ioctl+0x2c6/0x5b0 [drm]
   amdgpu_drm_ioctl+0x4f/0x90 [amdgpu]
   __x64_sys_ioctl+0xa0/0xf0
   do_syscall_64+0xa3/0x4d0

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

...

This commit is contained in:

Jesse Zhang 2026-09-29 10:03:31 +08:00 • committed by Alex Deucher

parent d3859b81fd

commit 24c946017b

3 changed files with 3 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c

View file

2

drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c

View file

2

drivers/gpu/drm/amd/amdgpu/mes_userqueue.c

View file