From 24c946017bbd4ed40853072ab4ca16aa1bc4f5ab Mon Sep 17 00:00:00 2001 From: Jesse Zhang Date: Tue, 29 Sep 2026 10:03:31 +0800 Subject: [PATCH] drm/amdgpu/userq: reject mappings without a backing BO MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PRT mappings have a bo_va but no backing BO. Reject them when validating queue buffers and when looking up the WPTR for MES or USERQ_SIGNAL, before passing the BO to the reservation or CPU mapping helpers. Repeat the check at the WPTR lookups because the VM reservation is dropped between initial validation and use. Without this, pointing a user queue's WPTR at a PRT (sparse) VA mapping makes mes_userq_create_wptr_mapping() dereference a NULL bo (base.bo) and oops in the reservation helper: BUG: kernel NULL pointer dereference, address: 0000000000000158 Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 4558 Comm: amd_fuzzing Tainted: G E 7.1.0+ RIP: 0010:drm_exec_lock_obj+0x2b/0x140 [drm_exec] CR2: 0000000000000158 Call Trace: drm_exec_prepare_obj+0x25/0x60 [drm_exec] mes_userq_create_wptr_mapping+0xc4/0x1c0 [amdgpu] mes_userq_mqd_create+0x351/0x870 [amdgpu] amdgpu_userq_ioctl+0x7ef/0xf80 [amdgpu] drm_ioctl_kernel+0xac/0x110 [drm] drm_ioctl+0x2c6/0x5b0 [drm] amdgpu_drm_ioctl+0x4f/0x90 [amdgpu] __x64_sys_ioctl+0xa0/0xf0 do_syscall_64+0xa3/0x4d0 Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 2 +- drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c index 75d5ceaa53c6..63875761dfac 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c @@ -253,7 +253,7 @@ int amdgpu_userq_input_va_validate(struct amdgpu_device *adev, return -EINVAL; va_map = amdgpu_vm_bo_lookup_mapping(vm, start_addr); - if (!va_map) + if (!va_map || !va_map->bo_va->base.bo) return -EINVAL; /* Lookup guarantees start_addr is mapped; ensure full span is covered. */ diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c index d90ac726f38c..c1257f530e9a 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c @@ -384,7 +384,7 @@ static int amdgpu_userq_fence_read_wptr(struct amdgpu_device *adev, goto lock_error; mapping = amdgpu_vm_bo_lookup_mapping(queue->vm, addr); - if (!mapping) { + if (!mapping || !mapping->bo_va->base.bo) { ret = -EINVAL; goto lock_error; } diff --git a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c index 1b06a4618125..e6c167a39d44 100644 --- a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c +++ b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c @@ -54,7 +54,7 @@ mes_userq_create_wptr_mapping(struct amdgpu_device *adev, goto fail_lock; wptr_mapping = amdgpu_vm_bo_lookup_mapping(vm, wptr); - if (!wptr_mapping) { + if (!wptr_mapping || !wptr_mapping->bo_va->base.bo) { ret = -EINVAL; goto fail_lock; }