]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
authorYongqiang Sun <Yongqiang.Sun@amd.com>
Mon, 6 Jul 2026 19:15:07 +0000 (15:15 -0400)
committerAlex Deucher <alexander.deucher@amd.com>
Fri, 17 Jul 2026 21:37:12 +0000 (17:37 -0400)
commit2b0386d4293920e690c0e017708f999b93cc729b
tree4624d0f936824295aaa23ae02371eedb9b353728
parentfbbbd98f200f11e7f9b66ca7f2d18546be8b254e
drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

total_cwsr_size was computed in 32-bit before being used as a BO/SVM
allocation size.
With large ctx_save_restore_area_size and debug_memory_size
multiplied by the XCC count, the product can wrap,
yielding an undersized CWSR save area that firmware later overruns.

Promote total_cwsr_size to u64 and use check_add_overflow()/
check_mul_overflow() in both kfd_queue_acquire_buffers() and
kfd_queue_release_buffers().

Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com>
Reviewed-by: Philip Yang <philip.yang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 319f7e13423ae3f486b9aea82f9ad2d6af0ee608)
Cc: stable@vger.kernel.org
drivers/gpu/drm/amd/amdkfd/kfd_queue.c