From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A21C23F6C50 for ; Tue, 4 Aug 2026 14:34:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785854086; cv=none; b=iMJ6Hn2epx8/wJH/NxCK8dG4VW9S+EdCwzJHs3Y3PJU0W4obykK9slA7OjXtBHtxm4YW3b1Hkqz7iQF5n9ZCiuSmHP4wb6v+km3dY5COq5ngzmKchE1N0G+TQlqS31GeCXK7G1ll2jhHdkAxoU56jjM50sBo67QeuxhX2mJ8xjQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785854086; c=relaxed/simple; bh=t2/dzBTyaqSCZw1EvUdAXRFRaOxYUcoJjZpvMK48UmE=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=q50Wxf0UXsjV4C+yiUpVVF46kKfIBVAciCyVDLh6Em3iwqNkiqR+ih0MQBx3JNw3+VqlVZqU7hSmy9VNukF5iCBHszvK7gfCUf+zp6ddZ4P/7jyATJCPeWnjTd9nz3nOAa2i+gqQVN9bVVAdmIry+jHFLr5RUBmS2rqUveAgTh4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=ji9LdWq4; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="ji9LdWq4" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1785854070; bh=t2/dzBTyaqSCZw1EvUdAXRFRaOxYUcoJjZpvMK48UmE=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=ji9LdWq4IpXUZokTPsvP3oo9BStidXc2recnK8/+iFL9Y8o6+NnLTnCJs+GB9JQ9L hanbzWxBOzLyFyo6sbIwq9ZTDVglTxtf6Lk66TZuBzDSP5mzaMNj3ExUwlQgay7i7k ZH8CfDwtm40bknAIMErFhO9MJb9ReNGLQCQIupnDmy/n1klNsxWTYpsPcspS7tXD/8 biUPBVMwHpAoMtneUja/ZUobixgeKbkPsa/XOMt54faiF0NzHN6cCLSSRj/PLw54iB tGGGVKRhhC8EeqJ1406CJB6fbHqgsbBJKO58uqbrBeA/0lX/076oF6hw58qiocDdYD rue0kw9cYTJxQ== Received: from fedora-21.home (unknown [100.64.0.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange secp256r1 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: bbrezillon) by bali.collaboradmins.com (Postfix) with ESMTPSA id 9C2E417E06DB; Tue, 04 Aug 2026 16:34:29 +0200 (CEST) Date: Tue, 4 Aug 2026 16:34:25 +0200 From: Boris Brezillon To: "Christian A. Ehrhardt" Cc: dri-devel@lists.freedesktop.org, Pedro Demarchi Gomes , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Andrew Morton , linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: Re: [PATCH] drm/shmem_helper: Check VMA boundaries for PMD mappings Message-ID: <20260804163425.222363ca@fedora-21.home> In-Reply-To: <20260622215718.1532689-1-lk@c--e.de> References: <20260622215718.1532689-1-lk@c--e.de> Organization: Collabora X-Mailer: Claws Mail 4.4.0 (GTK 3.24.52; x86_64-redhat-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Mon, 22 Jun 2026 23:57:17 +0200 "Christian A. Ehrhardt" wrote: > In the ->huge_fault handler do not install a PMD huge page > mapping if the huge page exceeds the boundaries of the VMA. > > All other ->huge_fault handlers have similar checks and the > resulting mapping will trigger a VM_BUG_ON_VMA() if it ever > reaches copy_pmd_range(). > > Cc: Pedro Demarchi Gomes > Cc: Boris Brezillon > Cc: stable@vger.kernel.org > Fixes: fc3bbf34e643 ("drm/shmem-helper: Fix huge page mapping in fault handler") > Signed-off-by: Christian A. Ehrhardt It looks like this one fell through the cracks and was never queued. I just queued it to drm-misc-fixes. Sorry for the delay. > --- > drivers/gpu/drm/drm_gem_shmem_helper.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c > index c989459eb215..00807039f8d7 100644 > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > @@ -597,9 +597,13 @@ static vm_fault_t try_insert_pfn(struct vm_fault *vmf, unsigned int order, > #ifdef CONFIG_ARCH_SUPPORTS_PMD_PFNMAP > } else if (order == PMD_ORDER) { > unsigned long paddr = pfn << PAGE_SHIFT; > + struct vm_area_struct *vma = vmf->vma; > + unsigned long start = ALIGN_DOWN(vmf->address, PMD_SIZE); > + unsigned long end = start + PMD_SIZE; > + bool in_range = vma->vm_start <= start && end <= vma->vm_end; > bool aligned = (vmf->address & ~PMD_MASK) == (paddr & ~PMD_MASK); > > - if (aligned && > + if (aligned && in_range && > folio_test_pmd_mappable(page_folio(pfn_to_page(pfn)))) { > vm_fault_t ret; >