tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission

sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions
that verify fence writeback addresses are dword-aligned. These
assertions can be reached from unprivileged userspace via crafted
DRM_IOCTL_AMDGPU_CS submissions, causing a fatal kernel panic in a
scheduler worker thread.

Replace both BUG_ON() calls with WARN_ON() to log the condition without
crashing the kernel. A misaligned fence address at this point indicates
a driver bug, but crashing the kernel is never the correct response when
the assertion is reachable from userspace.

The CS IOCTL path is the correct place to filter invalid submissions;
the ring emission callback is too late to do anything about it.

Fixes: 2130f89ced2c ("drm/amdgpu: add SDMA v4.0 implementation (v2)")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: John B. Moore <jbmoore61@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b90250bd933afd1ba94d86d6b13821997b22b18e)
Cc: stable@vger.kernel.org

authored by

John B. Moore and committed by
Alex Deucher 78d2e624 17223816

+2 -2
+2 -2
drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
··· 889 889 /* write the fence */ 890 890 amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE)); 891 891 /* zero in first two bits */ 892 - BUG_ON(addr & 0x3); 892 + WARN_ON(addr & 0x3); 893 893 amdgpu_ring_write(ring, lower_32_bits(addr)); 894 894 amdgpu_ring_write(ring, upper_32_bits(addr)); 895 895 amdgpu_ring_write(ring, lower_32_bits(seq)); ··· 899 899 addr += 4; 900 900 amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE)); 901 901 /* zero in first two bits */ 902 - BUG_ON(addr & 0x3); 902 + WARN_ON(addr & 0x3); 903 903 amdgpu_ring_write(ring, lower_32_bits(addr)); 904 904 amdgpu_ring_write(ring, upper_32_bits(addr)); 905 905 amdgpu_ring_write(ring, upper_32_bits(seq));