[PATCH] drm/amdgpu: validate doorbell_offset in user queue creation

[PATCH] drm/amdgpu: validate doorbell_offset in user queue creation

[Junrui Luo]

amdgpu_userq_get_doorbell_index() passes the user-provided
doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds
checking. An arbitrarily large doorbell_offset can cause the
calculated doorbell index to fall outside the allocated doorbell BO,
potentially corrupting kernel doorbell space.

Validate that doorbell_offset falls within the doorbell BO before
computing the BAR index, using u64 arithmetic to prevent overflow.

Fixes: f09c1e6077ab ("drm/amdgpu: generate doorbell index for userqueue")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
index 7c450350847d..0a1b93259887 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
@@ -600,6 +600,13 @@ amdgpu_userq_get_doorbell_index(struct amdgpu_userq_mgr *uq_mgr,
 		goto unpin_bo;
 	}
 
+	/* Validate doorbell_offset is within the doorbell BO */
+	if ((u64)db_info->doorbell_offset * db_size + db_size >
+	    amdgpu_bo_size(db_obj->obj)) {
+		r = -EINVAL;
+		goto unpin_bo;
+	}
+
 	index = amdgpu_doorbell_index_on_bar(uq_mgr->adev, db_obj->obj,
 					     db_info->doorbell_offset, db_size);
 	drm_dbg_driver(adev_to_drm(uq_mgr->adev),

---
base-commit: c369299895a591d96745d6492d4888259b004a9e
change-id: 20260324-fixes-9ee6cab7bc47

Best regards,
-- 
Junrui Luo <moonafterrain@outlook.com>

Re: [PATCH] drm/amdgpu: validate doorbell_offset in user queue creation

[Alex Deucher]

Applied.  Thanks!

On Tue, Mar 24, 2026 at 5:49 AM Junrui Luo <moonafterrain@outlook.com> wrote:
>
> amdgpu_userq_get_doorbell_index() passes the user-provided
> doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds
> checking. An arbitrarily large doorbell_offset can cause the
> calculated doorbell index to fall outside the allocated doorbell BO,
> potentially corrupting kernel doorbell space.
>
> Validate that doorbell_offset falls within the doorbell BO before
> computing the BAR index, using u64 arithmetic to prevent overflow.
>
> Fixes: f09c1e6077ab ("drm/amdgpu: generate doorbell index for userqueue")
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> index 7c450350847d..0a1b93259887 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
> @@ -600,6 +600,13 @@ amdgpu_userq_get_doorbell_index(struct amdgpu_userq_mgr *uq_mgr,
>                 goto unpin_bo;
>         }
>
> +       /* Validate doorbell_offset is within the doorbell BO */
> +       if ((u64)db_info->doorbell_offset * db_size + db_size >
> +           amdgpu_bo_size(db_obj->obj)) {
> +               r = -EINVAL;
> +               goto unpin_bo;
> +       }
> +
>         index = amdgpu_doorbell_index_on_bar(uq_mgr->adev, db_obj->obj,
>                                              db_info->doorbell_offset, db_size);
>         drm_dbg_driver(adev_to_drm(uq_mgr->adev),
>
> ---
> base-commit: c369299895a591d96745d6492d4888259b004a9e
> change-id: 20260324-fixes-9ee6cab7bc47
>
> Best regards,
> --
> Junrui Luo <moonafterrain@outlook.com>
>

Claude review: drm/amdgpu: validate doorbell_offset in user queue creation

[Claude Code Review Bot]

Patch Review

**Positive aspects:**
- Correctly identifies a missing bounds check on user-supplied input
- Properly uses `(u64)` cast to prevent overflow when `doorbell_offset` (uint32_t) is multiplied by `db_size` (int, value 8)
- Uses the existing `unpin_bo` error path correctly
- Appropriate Fixes/Cc-stable tags

**Issue — missing error message:**

The existing error paths in this function all log a diagnostic message via `drm_file_err()` before jumping to the error label. This new validation silently returns `-EINVAL`:

```c
+	if ((u64)db_info->doorbell_offset * db_size + db_size >
+	    amdgpu_bo_size(db_obj->obj)) {
+		r = -EINVAL;
+		goto unpin_bo;
+	}
```

Adding a `drm_file_err()` (or at minimum `drm_dbg_driver()`) message here would be consistent with the rest of the function and helpful for debugging. Something like:

```c
drm_file_err(uq_mgr->file,
    "[Usermode queues] doorbell_offset %u out of range for doorbell BO\n",
    db_info->doorbell_offset);
```

**Minor style note:**

The bounds check `(u64)db_info->doorbell_offset * db_size + db_size` computes `(offset + 1) * db_size`. This is correct — it verifies that the last byte of the doorbell slot at the given offset fits within the BO. It could arguably be written more clearly as `((u64)db_info->doorbell_offset + 1) * db_size`, but the current form is also fine and equivalent.

**Overall:** The fix is correct and addresses a valid security concern. With the addition of an error log message for consistency and debuggability, this would be ready to merge.

---
Generated by Claude Code Patch Reviewer

Claude review: drm/amdgpu: validate doorbell_offset in user queue creation

[Claude Code Review Bot]

Overall Series Review

Subject: drm/amdgpu: validate doorbell_offset in user queue creation
Author: Junrui Luo <moonafterrain@outlook.com>
Patches: 2
Reviewed: 2026-03-25T06:55:42.528640

---

This is a single-patch fix that adds bounds checking for the user-provided `doorbell_offset` before it is passed to `amdgpu_doorbell_index_on_bar()` during usermode queue creation. The fix addresses a real security issue: a malicious or buggy userspace could provide an out-of-bounds doorbell offset, causing accesses outside the doorbell BO. The fix is correct in approach and small in scope.

**Verdict: The patch is reasonable and addresses a legitimate vulnerability, but has a minor issue worth noting.**

---
Generated by Claude Code Patch Reviewer