From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sender4-op-o11.zoho.com (sender4-op-o11.zoho.com [136.143.188.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 38D4D37DAA4 for ; Mon, 29 Jun 2026 20:17:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.11 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782764267; cv=pass; b=eDiOkrxyUG7a+MKGAPA/5fKckhsjoL3T1r1EN2hKCrFpHODctBnK3l/VvQBgo+HNs35RnwfIao3oivjeG3YuIFzs1BaCECkxaYAEPQwVyu7niXtzZom64vDY6spfGEwa0by0Rm8qEOKMwqiv1HWpMDiE3uRUkSN4VeeX007r0sY= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782764267; c=relaxed/simple; bh=+mGRw7mVgUaPh96FfLsfP5ChuFDuncaGNjHDG8+Q/FM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=kwL8Jev+7WjnnBvNi3dgpS/sROlwbCcAbSpGmp2yU1bImhwhT+Nz3hZohKUd7xHjVmDtExJr9wU3pZ7+6IMqmJ076cmupEU8REzdrMcUTGhvULC4WeQzRUvkbrlZ2/L8KVjMcG5ST6GrlnyIegpTMgWeeEq0iDa2zDrZ8qeo2Uw= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (1024-bit key) header.d=collabora.com header.i=adrian.larumbe@collabora.com header.b=iUiPz2tZ; arc=pass smtp.client-ip=136.143.188.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=collabora.com header.i=adrian.larumbe@collabora.com header.b="iUiPz2tZ" ARC-Seal: i=1; a=rsa-sha256; t=1782764249; cv=none; d=zohomail.com; s=zohoarc; b=FFDk5tBbjYCIq+DYkvI63Dn3HuosoBIfR+eF6azQfVjVhwy9LkbZAmSZftmqK6zrUWPwXOQH0hAB+nSCk3AnqmzB87XsHDOuBpZBZbdgj8V0Jen9HBu4FMO5LxsspW7SPeCCx2k30Fq2xagciTL+QmfdhVCrvXOtO7nkbRxjiHw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782764249; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=skcBfSeZPONe2o3Djh24lxLgkSwmdgz8Pb0lPRkydH8=; b=c05cU+UlwUx3/iDl+xUpe+fqAuDUfTSdbUxhCnyuSfI7Su0euGTs8gCV+kSNMKqWrMe95g9YpcvjvANIWYIh22rbwsbzLpP4OzlTWyfWKZtMHm9OEUkV64JfwDsVKvOE42yeys13EI3lFu3ryEQ/+wKfCEbTfIQZgQL00q/7Y3M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=collabora.com; spf=pass smtp.mailfrom=adrian.larumbe@collabora.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1782764249; s=zohomail; d=collabora.com; i=adrian.larumbe@collabora.com; h=From:From:Date:Date:Subject:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-Id:Message-Id:References:In-Reply-To:To:To:Cc:Cc:Reply-To; bh=skcBfSeZPONe2o3Djh24lxLgkSwmdgz8Pb0lPRkydH8=; b=iUiPz2tZPSOfs/3XWXgrIGLym+67VkEu8rMwbuEqhX8gNQu/qhGjxYeAjs29Ctk8 TeRjr0ZY8+1XlKOkkfXYlOvEgsTJefXafDTSQbfi8VdiRnrfqNO/diFxYKxdNxW30De ZSmXwE60UzlIjvLiO2l3zYOzBEf6bj8q4UmhALKQ= Received: by mx.zohomail.com with SMTPS id 1782764247563417.74878732894445; Mon, 29 Jun 2026 13:17:27 -0700 (PDT) From: =?utf-8?q?Adri=C3=A1n_Larumbe?= Date: Mon, 29 Jun 2026 21:17:08 +0100 Subject: [PATCH v3 4/4] drm/panthor: Check for sparse binding range overflow Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20260629-vm_bind_checks-v3-4-85e6740f6c2e@collabora.com> References: <20260629-vm_bind_checks-v3-0-85e6740f6c2e@collabora.com> In-Reply-To: <20260629-vm_bind_checks-v3-0-85e6740f6c2e@collabora.com> To: Boris Brezillon , Steven Price , Liviu Dudau , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Heiko Stuebner , Grant Likely Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, =?utf-8?q?Adri=C3=A1n_Larumbe?= , Sashiko X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=2364; i=adrian.larumbe@collabora.com; h=from:subject:message-id; bh=+mGRw7mVgUaPh96FfLsfP5ChuFDuncaGNjHDG8+Q/FM=; b=owEB7QES/pANAwAKAQ4mfkzuU0M9AcsmYgBqQtLDX2DXScNvQdaAPWzSBmrPlMG5HAkK46uNP ycdfzYQan+JAbMEAAEKAB0WIQQyQDDowAUXXfk3B6QOJn5M7lNDPQUCakLSwwAKCRAOJn5M7lND PZRbC/9DYNVo2rpIcDEz6nsT+k+C/7+IpPvJ3u+NtsPyQX0dwDoxKqNGLus6ePa4uF7jEQCKfSV isZ3UVKEm4upy1ehbwF3qY0L2aL2O5FIg0vSPZWhV3RkuB+upCBoF2ppfq54471ajQIgOxwSn+m yvKvSTKTxlHI/cCwBsnWjWlN8+voWo2gzrhmAUc/SO44ygwNvKyN/dO0x5DMBihVO/dBLDbgZIi DWUbrjELhjI3i4NN7Bp+kLsjyQkhc3HAlL66cDWo0Ds1kriSaNNYIDmWwbXO8aRM1B7r6Tnpa/c 9Cf0hZ0mUbjP9Ua5a55P9LGr5LZvZlnBse68C/h9GijrFqyzqhqt4SYkmTxJL+RNtloXBVHAp9i qPQxbM9uTorYTwMMi944S1meUn8iKwZkx/JttsjSQPWgvgwsFmF7JZmBVwqwbh0qXOyjjZH3gAF l+jpuEnzDREFBaxQkefEyq38TK4iqWO/hocqnMK00bduvr/jYZ4T7adybYYr/lVtNXjTE= X-Developer-Key: i=adrian.larumbe@collabora.com; a=openpgp; fpr=324030E8C005175DF93707A40E267E4CEE53433D This check is being already carried out further down the call stack inside drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to fail early in the driver before GPUVM functions are invoked so that we won't waste time allocating vm_bind context resources. Reported-by: Sashiko Closes: https://sashiko.dev/#/message/20260623204220.CDB1B1F000E9%40smtp.kernel.org Fixes: 12cf826bf1dd ("drm/panthor: Support sparse mappings") Signed-off-by: Adrián Larumbe --- drivers/gpu/drm/panthor/panthor_mmu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c index 77fdad4e5166..8bd9b975e5ce 100644 --- a/drivers/gpu/drm/panthor/panthor_mmu.c +++ b/drivers/gpu/drm/panthor/panthor_mmu.c @@ -1328,6 +1328,7 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx, struct drm_gpuvm_bo *preallocated_vm_bo; struct sg_table *sgt = NULL; int ret; + u64 end; if (!bo) return -EINVAL; @@ -1353,6 +1354,10 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx, if (is_sparse && (op->bo_handle || op->bo_offset)) return -EINVAL; + /* Protect against sparse VA range overflow */ + if (is_sparse && check_add_overflow(op->va, op->size, &end)) + return -EINVAL; + /* If the BO has an exclusive VM attached, it can't be mapped to other VMs. */ if (bo->exclusive_vm_root_gem && bo->exclusive_vm_root_gem != panthor_vm_root_gem(vm)) @@ -1418,7 +1423,9 @@ static int panthor_vm_prepare_unmap_op_ctx(struct panthor_vm_op_ctx *op_ctx, struct panthor_vm *vm, const struct drm_panthor_vm_bind_op *op) { + bool is_sparse = op->flags & DRM_PANTHOR_VM_BIND_OP_MAP_SPARSE; u32 pt_count = 0; + u64 end; int ret; memset(op_ctx, 0, sizeof(*op_ctx)); @@ -1432,6 +1439,10 @@ static int panthor_vm_prepare_unmap_op_ctx(struct panthor_vm_op_ctx *op_ctx, if (op->va != ALIGN(op->va, SZ_2M)) pt_count++; + /* Protect against sparse VA range overflow */ + if (is_sparse && check_add_overflow(op->va, op->size, &end)) + return -EINVAL; + if (op->va + op->size != ALIGN(op->va + op->size, SZ_2M) && ALIGN(op->va + op->size, SZ_2M) != ALIGN(op->va, SZ_2M)) pt_count++; -- 2.54.0