Commit 78d2e624 authored by John B. Moore's avatar John B. Moore Committed by Alex Deucher
Browse files

drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission 



sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions
that verify fence writeback addresses are dword-aligned.  These
assertions can be reached from unprivileged userspace via crafted
DRM_IOCTL_AMDGPU_CS submissions, causing a fatal kernel panic in a
scheduler worker thread.

Replace both BUG_ON() calls with WARN_ON() to log the condition without
crashing the kernel.  A misaligned fence address at this point indicates
a driver bug, but crashing the kernel is never the correct response when
the assertion is reachable from userspace.

The CS IOCTL path is the correct place to filter invalid submissions;
the ring emission callback is too late to do anything about it.

Fixes: 2130f89c ("drm/amdgpu: add SDMA v4.0 implementation (v2)")
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarJohn B. Moore <jbmoore61@gmail.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b90250bd933afd1ba94d86d6b13821997b22b18e)
Cc: stable@vger.kernel.org
parent 17223816

drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c

+2 −2
Original line number Diff line number Diff line
@@ -889,7 +889,7 @@ static void sdma_v4_0_ring_emit_fence(struct amdgpu_ring *ring, u64 addr, u64 se 
	/* write the fence */

	amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE));

	/* zero in first two bits */

	BUG_ON(addr & 0x3);

	WARN_ON(addr & 0x3);

	amdgpu_ring_write(ring, lower_32_bits(addr));

	amdgpu_ring_write(ring, upper_32_bits(addr));

	amdgpu_ring_write(ring, lower_32_bits(seq));
@@ -899,7 +899,7 @@ static void sdma_v4_0_ring_emit_fence(struct amdgpu_ring *ring, u64 addr, u64 se 
		addr += 4;

		amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE));

		/* zero in first two bits */

		BUG_ON(addr & 0x3);

		WARN_ON(addr & 0x3);

		amdgpu_ring_write(ring, lower_32_bits(addr));

		amdgpu_ring_write(ring, upper_32_bits(addr));

		amdgpu_ring_write(ring, upper_32_bits(seq));