From a2c2f33e0894c7f024c2b50356476966f99f8fb0 Mon Sep 17 00:00:00 2001 From: jsg Date: Sun, 12 Apr 2026 23:14:28 +0000 Subject: [PATCH] drm/amdgpu: validate doorbell_offset in user queue creation From Junrui Luo 3543005a42d7e8e12b21897ef6798541bf7cbcd3 in linux-6.18.y/6.18.22 a018d1819f158991b7308e4f74609c6c029b670c in mainline linux --- sys/dev/pci/drm/amd/amdgpu/amdgpu_userq.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_userq.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_userq.c index 835486f634e..38a21cab03c 100644 --- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_userq.c +++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_userq.c @@ -358,6 +358,13 @@ amdgpu_userq_get_doorbell_index(struct amdgpu_userq_mgr *uq_mgr, goto unpin_bo; } + /* Validate doorbell_offset is within the doorbell BO */ + if ((u64)db_info->doorbell_offset * db_size + db_size > + amdgpu_bo_size(db_obj->obj)) { + r = -EINVAL; + goto unpin_bo; + } + index = amdgpu_doorbell_index_on_bar(uq_mgr->adev, db_obj->obj, db_info->doorbell_offset, db_size); drm_dbg_driver(adev_to_drm(uq_mgr->adev),