RE: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
[AMD Official Use Only - General]
> -Original Message-
> From: amd-gfx On Behalf Of Felix
> Kuehling
> Sent: Wednesday, September 21, 2022 6:30 PM
> To: amd-gfx@lists.freedesktop.org
> Cc: Ellis Michael
> Subject: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
>
> Caution: This message originated from an External Source. Use proper
> caution when opening attachments, clicking links, or responding.
>
>
> This was fixed in initialize_cpsch before, but not in initialize_nocpsch.
> Factor sdma bitmap initialization into a helper function to apply the correct
> implementation in both cases without duplicating it.
>
> Reported-by: Ellis Michael
> Signed-off-by: Felix Kuehling
> ---
> .../drm/amd/amdkfd/kfd_device_queue_manager.c | 41 --
> -
> 1 file changed, 17 insertions(+), 24 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> index e83725a28106..f88ec6a11ad2 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> @@ -1240,6 +1240,20 @@ static void init_interrupts(struct
> device_queue_manager *dqm)
> dqm->dev->kfd2kgd->init_interrupts(dqm->dev->adev,
> i); }
>
> +static void init_sdma_bitmaps(struct device_queue_manager *dqm) {
> + uint64_t num_sdma_queues = get_num_sdma_queues(dqm);
> + uint64_t num_xgmi_sdma_queues =
> get_num_xgmi_sdma_queues(dqm);
> +
> + if (num_sdma_queues)
> + dqm->sdma_bitmap = GENMASK_ULL(num_sdma_queues-1, 0);
> + if (num_xgmi_sdma_queues)
> + dqm->xgmi_sdma_bitmap =
> + GENMASK_ULL(num_xgmi_sdma_queues-1, 0);
I think we still want a safeguard here in case we ever get into a situation
where num_sdma_queues is > 64. Otherwise we could hit an unsigned wraparound
(in __GENMASK_ULL: (~ULL(0) >> (BITS_PER_LONG_LONG - 1 - (h --> would cause
a wrap plus shift > width of type warning if h > 63).
Something along the lines of
dqm->sdma_bitmap = GENMASK_ULL(min(num_sdma_queues, BITS_PER_LONG_LONG) - 1, 0);
Could work as a safeguard. Same for xgmi_sdma_bitmap.
Best,
Graham
> +
> + dqm->sdma_bitmap &= ~get_reserved_sdma_queues_bitmap(dqm);
> + pr_info("sdma_bitmap: %llx\n", dqm->sdma_bitmap); }
> +
> static int initialize_nocpsch(struct device_queue_manager *dqm) {
> int pipe, queue;
> @@ -1268,11 +1282,7 @@ static int initialize_nocpsch(struct
> device_queue_manager *dqm)
>
> memset(dqm->vmid_pasid, 0, sizeof(dqm->vmid_pasid));
>
> - dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm));
> - dqm->sdma_bitmap &= ~(get_reserved_sdma_queues_bitmap(dqm));
> - pr_info("sdma_bitmap: %llx\n", dqm->sdma_bitmap);
> -
> - dqm->xgmi_sdma_bitmap = ~0ULL >> (64 -
> get_num_xgmi_sdma_queues(dqm));
> + init_sdma_bitmaps(dqm);
>
> return 0;
> }
> @@ -1450,9 +1460,6 @@ static int set_sched_resources(struct
> device_queue_manager *dqm)
>
> static int initialize_cpsch(struct device_queue_manager *dqm) {
> - uint64_t num_sdma_queues;
> - uint64_t num_xgmi_sdma_queues;
> -
> pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm));
>
> mutex_init(&dqm->lock_hidden);
> @@ -1461,24 +1468,10 @@ static int initialize_cpsch(struct
> device_queue_manager *dqm)
> dqm->active_cp_queue_count = 0;
> dqm->gws_queue_count = 0;
> dqm->active_runlist = false;
> -
> - num_sdma_queues = get_num_sdma_queues(dqm);
> - if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap))
> - dqm->sdma_bitmap = ULLONG_MAX;
> - else
> - dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1);
> -
> - dqm->sdma_bitmap &= ~(get_reserved_sdma_queues_bitmap(dqm));
> - pr_info("sdma_bitmap: %llx\n", dqm->sdma_bitmap);
> -
> - num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm);
> - if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm-
> >xgmi_sdma_bitmap))
> - dqm->xgmi_sdma_bitmap = ULLONG_MAX;
> - else
> - dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) -
> 1);
> -
> INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception);
>
> + init_sdma_bitmaps(dqm);
> +
> return 0;
> }
>
> --
> 2.32.0
[PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
This was fixed in initialize_cpsch before, but not in initialize_nocpsch.
Factor sdma bitmap initialization into a helper function to apply the
correct implementation in both cases without duplicating it.
Reported-by: Ellis Michael
Signed-off-by: Felix Kuehling
---
.../drm/amd/amdkfd/kfd_device_queue_manager.c | 41 ---
1 file changed, 17 insertions(+), 24 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index e83725a28106..f88ec6a11ad2 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -1240,6 +1240,20 @@ static void init_interrupts(struct device_queue_manager
*dqm)
dqm->dev->kfd2kgd->init_interrupts(dqm->dev->adev, i);
}
+static void init_sdma_bitmaps(struct device_queue_manager *dqm)
+{
+ uint64_t num_sdma_queues = get_num_sdma_queues(dqm);
+ uint64_t num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm);
+
+ if (num_sdma_queues)
+ dqm->sdma_bitmap = GENMASK_ULL(num_sdma_queues-1, 0);
+ if (num_xgmi_sdma_queues)
+ dqm->xgmi_sdma_bitmap = GENMASK_ULL(num_xgmi_sdma_queues-1, 0);
+
+ dqm->sdma_bitmap &= ~get_reserved_sdma_queues_bitmap(dqm);
+ pr_info("sdma_bitmap: %llx\n", dqm->sdma_bitmap);
+}
+
static int initialize_nocpsch(struct device_queue_manager *dqm)
{
int pipe, queue;
@@ -1268,11 +1282,7 @@ static int initialize_nocpsch(struct
device_queue_manager *dqm)
memset(dqm->vmid_pasid, 0, sizeof(dqm->vmid_pasid));
- dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm));
- dqm->sdma_bitmap &= ~(get_reserved_sdma_queues_bitmap(dqm));
- pr_info("sdma_bitmap: %llx\n", dqm->sdma_bitmap);
-
- dqm->xgmi_sdma_bitmap = ~0ULL >> (64 - get_num_xgmi_sdma_queues(dqm));
+ init_sdma_bitmaps(dqm);
return 0;
}
@@ -1450,9 +1460,6 @@ static int set_sched_resources(struct
device_queue_manager *dqm)
static int initialize_cpsch(struct device_queue_manager *dqm)
{
- uint64_t num_sdma_queues;
- uint64_t num_xgmi_sdma_queues;
-
pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm));
mutex_init(&dqm->lock_hidden);
@@ -1461,24 +1468,10 @@ static int initialize_cpsch(struct device_queue_manager
*dqm)
dqm->active_cp_queue_count = 0;
dqm->gws_queue_count = 0;
dqm->active_runlist = false;
-
- num_sdma_queues = get_num_sdma_queues(dqm);
- if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap))
- dqm->sdma_bitmap = ULLONG_MAX;
- else
- dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1);
-
- dqm->sdma_bitmap &= ~(get_reserved_sdma_queues_bitmap(dqm));
- pr_info("sdma_bitmap: %llx\n", dqm->sdma_bitmap);
-
- num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm);
- if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm->xgmi_sdma_bitmap))
- dqm->xgmi_sdma_bitmap = ULLONG_MAX;
- else
- dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) - 1);
-
INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception);
+ init_sdma_bitmaps(dqm);
+
return 0;
}
--
2.32.0
Re: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
On Sat, 2021-03-06 at 03:55 +, Jacob, Anson wrote:
> [AMD Public Use]
>
> Thanks Lyude for testing the patch.
>
> Are you referring to this issue [1] ?
>
> Is it reproducible after applying this patch as well ?
Yes I am - and yeah, if you're talking about the patch you originally asked me
to try then yes- I'm still able to reproduce it with that patch applied
>
> [1] https://gitlab.freedesktop.org/drm/amd/-/issues/1473
>
> -- Anson
> From: Lyude Paul
> Sent: Friday, March 5, 2021 6:08 PM
> To: Jacob, Anson ; amd-gfx@lists.freedesktop.org g...@lists.freedesktop.org>
> Cc: Deucher, Alexander ; Kuehling, Felix
>
> Subject: Re: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
> Tested-by: Lyude Paul
>
> That just leaves the KASAN error from read_indirect_azalia_reg, thanks for the
> fix!
>
> On Thu, 2021-03-04 at 15:08 -0500, Anson Jacob wrote:
> > If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up
> > doing a shift operation where the number of bits shifted equals
> > number of bits in the operand. This behaviour is undefined.
> >
> > Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the
> > count is >= number of bits in the operand.
> >
> > Bug:
> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgitlab.freedesktop.org%2Fdrm%2Famd%2F-%2Fissues%2F1472&data=04%7C01%7Canson.jacob%40amd.com%7Ce9ea7130bcd945a194aa08d8e02ba9f8%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637505826204096667%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=GEyObPt%2FnEeU9Y7K2I30RS1TBMGbbUneQ6hWkR7pJLM%3D&reserved=0
> > Reported-by: Lyude Paul
> > Signed-off-by: Anson Jacob
> > Reviewed-by: Alex Deucher
> > Reviewed-by: Felix Kuehling
> > ---
> > .../drm/amd/amdkfd/kfd_device_queue_manager.c | 17 +++--
> > 1 file changed, 15 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> > b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> > index c37e9c4b1fb4..e7a3c496237f 100644
> > --- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> > +++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> > @@ -1128,6 +1128,9 @@ static int set_sched_resources(struct
> > device_queue_manager *dqm)
> >
> > static int initialize_cpsch(struct device_queue_manager *dqm)
> > {
> > + uint64_t num_sdma_queues;
> > + uint64_t num_xgmi_sdma_queues;
> > +
> > pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm));
> >
> > mutex_init(&dqm->lock_hidden);
> > @@ -1136,8 +1139,18 @@ static int initialize_cpsch(struct
> device_queue_manager
> > *dqm)
> > dqm->active_cp_queue_count = 0;
> > dqm->gws_queue_count = 0;
> > dqm->active_runlist = false;
> > - dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm));
> > - dqm->xgmi_sdma_bitmap = ~0ULL >> (64 -
> get_num_xgmi_sdma_queues(dqm));
> > +
> > + num_sdma_queues = get_num_sdma_queues(dqm);
> > + if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap))
> > + dqm->sdma_bitmap = ULLONG_MAX;
> > + else
> > + dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1);
> > +
> > + num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm);
> > + if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm->xgmi_sdma_bitmap))
> > + dqm->xgmi_sdma_bitmap = ULLONG_MAX;
> > + else
> > + dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) - 1);
> >
> > INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception);
> >
>
--
Sincerely,
Lyude Paul (she/her)
Software Engineer at Red Hat
Note: I deal with a lot of emails and have a lot of bugs on my plate. If you've
asked me a question, are waiting for a review/merge on a patch, etc. and I
haven't responded in a while, please feel free to send me another email to check
on my status. I don't bite!
___
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx
Re: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
[AMD Public Use]
Thanks Lyude for testing the patch.
Are you referring to this issue [1] ?
Is it reproducible after applying this patch as well ?
[1] https://gitlab.freedesktop.org/drm/amd/-/issues/1473
-- Anson
From: Lyude Paul
Sent: Friday, March 5, 2021 6:08 PM
To: Jacob, Anson ; amd-gfx@lists.freedesktop.org
Cc: Deucher, Alexander ; Kuehling, Felix
Subject: Re: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
Tested-by: Lyude Paul
That just leaves the KASAN error from read_indirect_azalia_reg, thanks for the
fix!
On Thu, 2021-03-04 at 15:08 -0500, Anson Jacob wrote:
> If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up
> doing a shift operation where the number of bits shifted equals
> number of bits in the operand. This behaviour is undefined.
>
> Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the
> count is >= number of bits in the operand.
>
> Bug:
> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgitlab.freedesktop.org%2Fdrm%2Famd%2F-%2Fissues%2F1472&data=04%7C01%7Canson.jacob%40amd.com%7Ce9ea7130bcd945a194aa08d8e02ba9f8%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637505826204096667%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=GEyObPt%2FnEeU9Y7K2I30RS1TBMGbbUneQ6hWkR7pJLM%3D&reserved=0
> Reported-by: Lyude Paul
> Signed-off-by: Anson Jacob
> Reviewed-by: Alex Deucher
> Reviewed-by: Felix Kuehling
> ---
> .../drm/amd/amdkfd/kfd_device_queue_manager.c | 17 +++--
> 1 file changed, 15 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> index c37e9c4b1fb4..e7a3c496237f 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> @@ -1128,6 +1128,9 @@ static int set_sched_resources(struct
> device_queue_manager *dqm)
>
> static int initialize_cpsch(struct device_queue_manager *dqm)
> {
> + uint64_t num_sdma_queues;
> + uint64_t num_xgmi_sdma_queues;
> +
> pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm));
>
> mutex_init(&dqm->lock_hidden);
> @@ -1136,8 +1139,18 @@ static int initialize_cpsch(struct device_queue_manager
> *dqm)
> dqm->active_cp_queue_count = 0;
> dqm->gws_queue_count = 0;
> dqm->active_runlist = false;
> - dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm));
> - dqm->xgmi_sdma_bitmap = ~0ULL >> (64 - get_num_xgmi_sdma_queues(dqm));
> +
> + num_sdma_queues = get_num_sdma_queues(dqm);
> + if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap))
> + dqm->sdma_bitmap = ULLONG_MAX;
> + else
> + dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1);
> +
> + num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm);
> + if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm->xgmi_sdma_bitmap))
> + dqm->xgmi_sdma_bitmap = ULLONG_MAX;
> + else
> + dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) - 1);
>
> INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception);
>
--
Sincerely,
Lyude Paul (she/her)
Software Engineer at Red Hat
Note: I deal with a lot of emails and have a lot of bugs on my plate. If you've
asked me a question, are waiting for a review/merge on a patch, etc. and I
haven't responded in a while, please feel free to send me another email to check
on my status. I don't bite!
___
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx
Re: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
Tested-by: Lyude Paul
That just leaves the KASAN error from read_indirect_azalia_reg, thanks for the
fix!
On Thu, 2021-03-04 at 15:08 -0500, Anson Jacob wrote:
> If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up
> doing a shift operation where the number of bits shifted equals
> number of bits in the operand. This behaviour is undefined.
>
> Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the
> count is >= number of bits in the operand.
>
> Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1472
> Reported-by: Lyude Paul
> Signed-off-by: Anson Jacob
> Reviewed-by: Alex Deucher
> Reviewed-by: Felix Kuehling
> ---
> .../drm/amd/amdkfd/kfd_device_queue_manager.c | 17 +++--
> 1 file changed, 15 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> index c37e9c4b1fb4..e7a3c496237f 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> @@ -1128,6 +1128,9 @@ static int set_sched_resources(struct
> device_queue_manager *dqm)
>
> static int initialize_cpsch(struct device_queue_manager *dqm)
> {
> + uint64_t num_sdma_queues;
> + uint64_t num_xgmi_sdma_queues;
> +
> pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm));
>
> mutex_init(&dqm->lock_hidden);
> @@ -1136,8 +1139,18 @@ static int initialize_cpsch(struct device_queue_manager
> *dqm)
> dqm->active_cp_queue_count = 0;
> dqm->gws_queue_count = 0;
> dqm->active_runlist = false;
> - dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm));
> - dqm->xgmi_sdma_bitmap = ~0ULL >> (64 - get_num_xgmi_sdma_queues(dqm));
> +
> + num_sdma_queues = get_num_sdma_queues(dqm);
> + if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap))
> + dqm->sdma_bitmap = ULLONG_MAX;
> + else
> + dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1);
> +
> + num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm);
> + if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm->xgmi_sdma_bitmap))
> + dqm->xgmi_sdma_bitmap = ULLONG_MAX;
> + else
> + dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) - 1);
>
> INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception);
>
--
Sincerely,
Lyude Paul (she/her)
Software Engineer at Red Hat
Note: I deal with a lot of emails and have a lot of bugs on my plate. If you've
asked me a question, are waiting for a review/merge on a patch, etc. and I
haven't responded in a while, please feel free to send me another email to check
on my status. I don't bite!
___
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx
RE: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
[AMD Public Use]
Hi Anson,
Please ignore the earlier comment.
Thanks,
Lijo
-Original Message-
From: Lazar, Lijo
Sent: Friday, March 5, 2021 11:05 AM
To: Anson Jacob ; amd-gfx@lists.freedesktop.org
Cc: Jacob, Anson ; Deucher, Alexander
; Kuehling, Felix
Subject: RE: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
[AMD Public Use]
-Original Message-
From: amd-gfx On Behalf Of Anson Jacob
Sent: Friday, March 5, 2021 1:39 AM
To: amd-gfx@lists.freedesktop.org
Cc: Jacob, Anson ; Deucher, Alexander
; Kuehling, Felix
Subject: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up doing a
shift operation where the number of bits shifted equals number of bits in the
operand. This behaviour is undefined.
Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the count is >=
number of bits in the operand.
Bug:
https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgitlab.freedesktop.org%2Fdrm%2Famd%2F-%2Fissues%2F1472&data=04%7C01%7Clijo.lazar%40amd.com%7Cc731ee10b10b4728138808d8df496648%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637504853648181515%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=iNLxyPbJfbuUeKFA6ygwcBGDSRJcfgOGjMFNHwGzun0%3D&reserved=0
Reported-by: Lyude Paul
Signed-off-by: Anson Jacob
Reviewed-by: Alex Deucher
Reviewed-by: Felix Kuehling
---
.../drm/amd/amdkfd/kfd_device_queue_manager.c | 17 +++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index c37e9c4b1fb4..e7a3c496237f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -1128,6 +1128,9 @@ static int set_sched_resources(struct
device_queue_manager *dqm)
static int initialize_cpsch(struct device_queue_manager *dqm) {
+ uint64_t num_sdma_queues;
+ uint64_t num_xgmi_sdma_queues;
+
pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm));
mutex_init(&dqm->lock_hidden);
@@ -1136,8 +1139,18 @@ static int initialize_cpsch(struct device_queue_manager
*dqm)
dqm->active_cp_queue_count = 0;
dqm->gws_queue_count = 0;
dqm->active_runlist = false;
- dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm));
- dqm->xgmi_sdma_bitmap = ~0ULL >> (64 - get_num_xgmi_sdma_queues(dqm));
+
+ num_sdma_queues = get_num_sdma_queues(dqm);
+ if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap))
< > No assumption about bitmap size here
+ dqm->sdma_bitmap = ULLONG_MAX;
<> This assumes/fixes the max size. In that case why not make the earlier check
also consistent?
+ else
+ dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1);
+
+ num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm);
+ if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm->xgmi_sdma_bitmap))
+ dqm->xgmi_sdma_bitmap = ULLONG_MAX;
+ else
+ dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) - 1);
INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception);
--
2.25.1
___
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.freedesktop.org%2Fmailman%2Flistinfo%2Famd-gfx&data=04%7C01%7Clijo.lazar%40amd.com%7Cc731ee10b10b4728138808d8df496648%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637504853648191471%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=EpuPBBf03EMa0S7rOqI8JieOmcT3GvsnsQMaYujGgeY%3D&reserved=0
___
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx
RE: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
[AMD Public Use]
-Original Message-
From: amd-gfx On Behalf Of Anson Jacob
Sent: Friday, March 5, 2021 1:39 AM
To: amd-gfx@lists.freedesktop.org
Cc: Jacob, Anson ; Deucher, Alexander
; Kuehling, Felix
Subject: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up doing a
shift operation where the number of bits shifted equals number of bits in the
operand. This behaviour is undefined.
Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the count is >=
number of bits in the operand.
Bug:
https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgitlab.freedesktop.org%2Fdrm%2Famd%2F-%2Fissues%2F1472&data=04%7C01%7Clijo.lazar%40amd.com%7Cc731ee10b10b4728138808d8df496648%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637504853648181515%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=iNLxyPbJfbuUeKFA6ygwcBGDSRJcfgOGjMFNHwGzun0%3D&reserved=0
Reported-by: Lyude Paul
Signed-off-by: Anson Jacob
Reviewed-by: Alex Deucher
Reviewed-by: Felix Kuehling
---
.../drm/amd/amdkfd/kfd_device_queue_manager.c | 17 +++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index c37e9c4b1fb4..e7a3c496237f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -1128,6 +1128,9 @@ static int set_sched_resources(struct
device_queue_manager *dqm)
static int initialize_cpsch(struct device_queue_manager *dqm) {
+ uint64_t num_sdma_queues;
+ uint64_t num_xgmi_sdma_queues;
+
pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm));
mutex_init(&dqm->lock_hidden);
@@ -1136,8 +1139,18 @@ static int initialize_cpsch(struct device_queue_manager
*dqm)
dqm->active_cp_queue_count = 0;
dqm->gws_queue_count = 0;
dqm->active_runlist = false;
- dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm));
- dqm->xgmi_sdma_bitmap = ~0ULL >> (64 - get_num_xgmi_sdma_queues(dqm));
+
+ num_sdma_queues = get_num_sdma_queues(dqm);
+ if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap))
< > No assumption about bitmap size here
+ dqm->sdma_bitmap = ULLONG_MAX;
<> This assumes/fixes the max size. In that case why not make the earlier check
also consistent?
+ else
+ dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1);
+
+ num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm);
+ if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm->xgmi_sdma_bitmap))
+ dqm->xgmi_sdma_bitmap = ULLONG_MAX;
+ else
+ dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) - 1);
INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception);
--
2.25.1
___
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.freedesktop.org%2Fmailman%2Flistinfo%2Famd-gfx&data=04%7C01%7Clijo.lazar%40amd.com%7Cc731ee10b10b4728138808d8df496648%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637504853648191471%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=EpuPBBf03EMa0S7rOqI8JieOmcT3GvsnsQMaYujGgeY%3D&reserved=0
___
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx
[PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up
doing a shift operation where the number of bits shifted equals
number of bits in the operand. This behaviour is undefined.
Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the
count is >= number of bits in the operand.
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1472
Reported-by: Lyude Paul
Signed-off-by: Anson Jacob
Reviewed-by: Alex Deucher
Reviewed-by: Felix Kuehling
---
.../drm/amd/amdkfd/kfd_device_queue_manager.c | 17 +++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index c37e9c4b1fb4..e7a3c496237f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -1128,6 +1128,9 @@ static int set_sched_resources(struct
device_queue_manager *dqm)
static int initialize_cpsch(struct device_queue_manager *dqm)
{
+ uint64_t num_sdma_queues;
+ uint64_t num_xgmi_sdma_queues;
+
pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm));
mutex_init(&dqm->lock_hidden);
@@ -1136,8 +1139,18 @@ static int initialize_cpsch(struct device_queue_manager
*dqm)
dqm->active_cp_queue_count = 0;
dqm->gws_queue_count = 0;
dqm->active_runlist = false;
- dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm));
- dqm->xgmi_sdma_bitmap = ~0ULL >> (64 - get_num_xgmi_sdma_queues(dqm));
+
+ num_sdma_queues = get_num_sdma_queues(dqm);
+ if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap))
+ dqm->sdma_bitmap = ULLONG_MAX;
+ else
+ dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1);
+
+ num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm);
+ if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm->xgmi_sdma_bitmap))
+ dqm->xgmi_sdma_bitmap = ULLONG_MAX;
+ else
+ dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) - 1);
INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception);
--
2.25.1
___
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx
