From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from cae.in-ulm.de (cae.in-ulm.de [217.10.14.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB4B9348C7B for ; Mon, 22 Jun 2026 22:03:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.10.14.231 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782165806; cv=none; b=nxyasiY/Gs5C5tU2zGovUKy3a1aZQt9Pkv4rt8MyHri9/AT6AT8eKf27YMVv6ozW82N94ap2WuQIwLu9d2TWQmPnXx8+Sx7zeOdduuncGh6PLoQZZZ1c2dgj4YI9dVCGpOj22tao5OxC4h34wcPpw1PW1MLdXzYz9g5z0EoC7+Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782165806; c=relaxed/simple; bh=s5R2r4G/IsGeytbNz2/a/ARO/Hg3+42NWcFqtWO4f0A=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=lJ8b1aAda5fG+DGoUI/SOLfSQPQYhY3GQBgxWHHlt6h1HHnFWD9Z9RlTMBRcKezZ3b1aZSO+qb3ilbb9OKP17HdOF9c01TwfDoDM088eGmuLCGgDXlcFAG2QLeEmgARBxpp5uVHwnYX/OwZ+NXiMe+o++QBlZMNc9zxYmnaInA0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=c--e.de; spf=pass smtp.mailfrom=c--e.de; arc=none smtp.client-ip=217.10.14.231 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=c--e.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=c--e.de Received: by cae.in-ulm.de (Postfix, from userid 1000) id 3B08F140033; Mon, 22 Jun 2026 23:57:54 +0200 (CEST) From: "Christian A. Ehrhardt" To: dri-devel@lists.freedesktop.org Cc: "Christian A. Ehrhardt" , Pedro Demarchi Gomes , Boris Brezillon , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrew Morton , linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH] drm/shmem_helper: Check VMA boundaries for PMD mappings Date: Mon, 22 Jun 2026 23:57:17 +0200 Message-Id: <20260622215718.1532689-1-lk@c--e.de> X-Mailer: git-send-email 2.39.5 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In the ->huge_fault handler do not install a PMD huge page mapping if the huge page exceeds the boundaries of the VMA. All other ->huge_fault handlers have similar checks and the resulting mapping will trigger a VM_BUG_ON_VMA() if it ever reaches copy_pmd_range(). Cc: Pedro Demarchi Gomes Cc: Boris Brezillon Cc: stable@vger.kernel.org Fixes: fc3bbf34e643 ("drm/shmem-helper: Fix huge page mapping in fault handler") Signed-off-by: Christian A. Ehrhardt --- drivers/gpu/drm/drm_gem_shmem_helper.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index c989459eb215..00807039f8d7 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -597,9 +597,13 @@ static vm_fault_t try_insert_pfn(struct vm_fault *vmf, unsigned int order, #ifdef CONFIG_ARCH_SUPPORTS_PMD_PFNMAP } else if (order == PMD_ORDER) { unsigned long paddr = pfn << PAGE_SHIFT; + struct vm_area_struct *vma = vmf->vma; + unsigned long start = ALIGN_DOWN(vmf->address, PMD_SIZE); + unsigned long end = start + PMD_SIZE; + bool in_range = vma->vm_start <= start && end <= vma->vm_end; bool aligned = (vmf->address & ~PMD_MASK) == (paddr & ~PMD_MASK); - if (aligned && + if (aligned && in_range && folio_test_pmd_mappable(page_folio(pfn_to_page(pfn)))) { vm_fault_t ret; -- 2.43.0