Re: [PATCH] drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

[Philip Yang]

On 2026-07-06 15:18, Yongqiang Sun wrote:
total_cwsr_size was computed in 32-bit before being used as a BO/SVM
allocation size.
With large ctx_save_restore_area_size and debug_memory_size
multiplied by the XCC count, the product can wrap,
yielding an undersized CWSR save area that firmware later overruns.

Promote total_cwsr_size to u64 and use check_add_overflow()/
check_mul_overflow() in both kfd_queue_acquire_buffers() and
kfd_queue_release_buffers().

Signed-off-by: Yongqiang Sun<yongqiang....@amd.com>
---
  drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 25 +++++++++++++++++++------
  1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
index 9d4838461168..4b1c1e379244 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
@@ -23,6 +23,7 @@
   */
  
  #include <linux/slab.h>
+#include <linux/overflow.h>
  #include "kfd_priv.h"
  #include "kfd_topology.h"
  #include "kfd_svm.h"
@@ -235,7 +236,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device 
*pdd, struct queue_prope
        struct kfd_topology_device *topo_dev;
        u64 expected_queue_size;
        struct amdgpu_vm *vm;
-       u32 total_cwsr_size;
+       u64 total_cwsr_size;
        int err;
  
  	topo_dev = kfd_topology_device_by_id(pdd->dev->id);
@@ -308,8 +309,15 @@ int kfd_queue_acquire_buffers(struct kfd_process_device 
*pdd, struct queue_prope
                goto out_err_unreserve;
        }
  
-	total_cwsr_size = (properties->ctx_save_restore_area_size +
-                          topo_dev->node_props.debug_memory_size) * 
NUM_XCC(pdd->dev->xcc_mask);
+       if (check_add_overflow(properties->ctx_save_restore_area_size,
+                              topo_dev->node_props.debug_memory_size,
+                              &total_cwsr_size) ||
Because properties->ctx_save_restore_area_size and 
topo_dev->node_props.debug_memory_size are u32, total_cwsr_size is u64 
now, check_add_overflow will never overflow to return true, use typecast 
u64 add instead

total_cwsr_size = (u64)properties->ctx_save_restore_area_size + 
topo_dev->node_props.debug_memory_size;

+           check_mul_overflow(total_cwsr_size,
+                              (u64)NUM_XCC(pdd->dev->xcc_mask),
Since total_cwsr_size is u64, NUM_XCC(pdd->dev->xcc_mask) will promote 
to u64 as well, this u64 typecast is not needed.
+                              &total_cwsr_size)) {
+               err = -EINVAL;
+               goto out_err_unreserve;
+       }
        total_cwsr_size = ALIGN(total_cwsr_size, PAGE_SIZE);
  
  	err = kfd_queue_buffer_get(vm, (void *)properties->ctx_save_restore_area_address,
@@ -344,7 +352,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device 
*pdd, struct queue_prope
  int kfd_queue_release_buffers(struct kfd_process_device *pdd, struct 
queue_properties *properties)
  {
        struct kfd_topology_device *topo_dev;
-       u32 total_cwsr_size;
+       u64 total_cwsr_size;
  
  	kfd_queue_buffer_put(&properties->wptr_bo);
        kfd_queue_buffer_put(&properties->rptr_bo);
@@ -355,8 +363,13 @@ int kfd_queue_release_buffers(struct kfd_process_device 
*pdd, struct queue_prope
        topo_dev = kfd_topology_device_by_id(pdd->dev->id);
        if (!topo_dev)
                return -EINVAL;
-       total_cwsr_size = (properties->ctx_save_restore_area_size +
-                          topo_dev->node_props.debug_memory_size) * 
NUM_XCC(pdd->dev->xcc_mask);
+       if (check_add_overflow(properties->ctx_save_restore_area_size,
+                              topo_dev->node_props.debug_memory_size,
+                              &total_cwsr_size) ||
+           check_mul_overflow(total_cwsr_size,
+                              (u64)NUM_XCC(pdd->dev->xcc_mask),
+                              &total_cwsr_size))
Do the same change as above kfd_queue_acquire_buffers. Regards, Philip
+               return -EINVAL;
        total_cwsr_size = ALIGN(total_cwsr_size, PAGE_SIZE);
  
  	kfd_queue_buffer_svm_put(pdd, properties->ctx_save_restore_area_address, total_cwsr_size);