From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8286C369D6A for ; Sun, 11 Oct 2026 07:22:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.70 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791703355; cv=none; b=Okotbnj+FaZNMMeD/1s9aMfJ3pN+FJpUdKEQi/YR8/4/QHGqxSGylD8rWZkyRTKRDuO9OaIGbd+zoV8cD20lDeczvz38/wFr72Ym7UO6OwdHD3B69l5W80GvjBKMc0EQPd72twcgBtVMS15jpKLopUccg67Myu9Z+2yHMH7HxCM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791703355; c=relaxed/simple; bh=ziT/zq8KkzNVIsF0WWx+lXTJdR2Ix6V6zIRJw4f+Xsg=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=a76eTSnzMlAHCTdHIDNB3K//Z88qIgWCL57WYKWwJFV57Wgb5EgSddtTRBVRJYUPuf8UK2kJ/k8AvLVESOCD5VkNlFduxmH0Qyy2mMeUwWc9rwD0TzjVI888+SZJhgEto0uYbzd30gHcTjboiucdwtjVsBt3bZJFBHivInIN2HI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=gPE83poW; arc=none smtp.client-ip=209.85.128.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="gPE83poW" Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-4a1612c4b80so10534485e9.0 for ; Sun, 11 Oct 2026 00:22:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1791703352; x=1792308152; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:mime-version:date:from :to:cc:subject:date:message-id:reply-to:content-type; bh=hvbrsW1mo/6FXW+04W7eG9GRRwc1pm+Fzyrx7oUOUKY=; b=gPE83poWEfQNOgTtmRD5IhFEaNJyLndy43YK8PuEDnvPstCG/+Sy51wBDeviCdWEeW y2FRx27HiUOgIFOH6b4brkEQYF7WUaHDipHIqC7GUxlD/OX0mDtxAe7FauZHYNa0xMTA 1vb6aQOzE+jhIxQ17zl5Fhs6WcG0gQYfeA1Sw3oe0YyB1gBKi2erN0oq7mfdxPoFDxSn ovsElIrSYmOH2RFVqSwjuHoORAuAWUqjr6NMKKzGBB2qEE2p9EF/7U9rBkH1XPIv20Qo PJRxTM1VyG8zeI4I2jiucAwTZVTo8snQYCLlE56MK4HxLxrli2Z7meFVWl/eq2L81oA7 4fJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791703352; x=1792308152; h=content-type:cc:to:from:subject:message-id:mime-version:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=hvbrsW1mo/6FXW+04W7eG9GRRwc1pm+Fzyrx7oUOUKY=; b=G/pedPfQ6Ubjq51ZQSRhRzV4TgEulEgRi0Y5T8BmWvaN2dwoMTCM24eEaaqmHW1PyL z+wBq/vfHIOnyThEC3Zq94rUd4M4R9zDZeabqvAR1UcjcjdR2nbcbBwoTfgj3PHJkiBn 16gumVIXuBk9KTFzm03wsSxSM76Ts/J/wnayJ94QJJuLLCZyBRm8XepgA6MBGtoMY9Ia sl9dwZ1/Ep2YZrCHCDRZFbjI2nqNt3NI8JHtDVKjenowVLTFifOMCeuGcxgQh16Tssk0 VeE3sVfm7fBNQmb4zl8GsIp8zmPqx8FC3WMk5pUMKuowaQJmbdBsgM+Rtw8b2atd6Yo4 wPOA== X-Forwarded-Encrypted: i=1; AKwUvBxWkpsrV4HjzcAfRoUqt8lZXAN11/aFhA/cuohTGZWrO3601jggmL+Tn4nYExuI6dkZ9/VmNvsdXfn2fos=@vger.kernel.org X-Gm-Message-State: AFq9FYLUYHJwxnsfTe5kr61dOQufX66Kd2Tpcutrh5NDXR77wLkqpR7f HcyyJEhoN+3GT+K63IXdCFUdh+Vb4XdEjDcz+z7+IlsHwk1mJvpAkrXHRCFWlOX5hxfyvJJGgOT Nf9JER/6szr33v56PSg== X-Received: from wrvo9.prod.google.com ([2002:a5d:62c9:0:b0:48b:b2:a375]) (user=aliceryhl job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:154c:b0:4a1:7c7d:8881 with SMTP id 5b1f17b1804b1-4a18e4a9b88mr129872505e9.13.1791703351428; Sun, 11 Oct 2026 00:22:31 -0700 (PDT) Date: Sun, 11 Oct 2026 07:22:22 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-B4-Tracking: v=1; b=H4sIAC05y2oC/x3MQQqEMBAF0atIr21IAjrqVcSFo19tUCMdjAPi3 Q2zrMWrmwJUEKjJblJECeL3FDbPaFj6fQbLmJqccaU11vJ8nHFjRXIR7CN0Wv3FxbdwZvyUVVW DEj4Uk/z+47Z7nhf1Ku0NaAAAAA== X-Change-Id: 20261011-gpuvm-reserve-overflow-5b520d76889e X-Developer-Key: i=aliceryhl@google.com; a=openpgp; fpr=49F6C1FAA74960F43A5B86A1EE7A392FDE96209F X-Developer-Signature: v=1; a=openpgp-sha256; l=1884; i=aliceryhl@google.com; h=from:subject:message-id; bh=ziT/zq8KkzNVIsF0WWx+lXTJdR2Ix6V6zIRJw4f+Xsg=; b=owEBbQKS/ZANAwAKAQRYvu5YxjlGAcsmYgBqyzkyOJ70AQD13qV9X0DzlJkRrhzWP3pQIVWBZ cQOWHFsopKJAjMEAAEKAB0WIQSDkqKUTWQHCvFIvbIEWL7uWMY5RgUCass5MgAKCRAEWL7uWMY5 RihfD/9agbFtirssrsDUXcyn9UYZDRBpdwjYrwBBnCDaKKxWc/EDMmuVPTolahMPyyev4ryitR7 TlhCOpZ92X5HOj656cEaQfEQJE0yqRqQPh0aYZCBuQXt5daDucF/hSFIBSsnuuT25s1Fjlw+oLw J3vuaUzurS1lC9AZjrV6HcSpRkGH/lMC4KExhiI7ibmTOi5erlqAB/JoZhUReMUjGEzCNIntuVn +TbdF1c6+6kJZAWY2bQiWsjwR+fw2EvOJhtBtR2JXKEDSmegM2y7G+FUk0iZDHnvFIf7UAf0XqC h2oRAPZEozMUpbgLYzRNDIjxZ81ZjsfmEMRAPKGh6WjWrAh9Cq5s43R3SZSxGbcvD0zJQQM+Njz x429P4lQH7CagQ8LQ/PYXUgWuxBHY4xR1t1p85OG697TmjOtC1F4ZfS5WAMTK18j+88Kv2E/3/W 4GS09ILc9NKQVtOBCiazMVYaWVg96teChsQCIryV3VXL4o+YbQmZaiUlu6SoYTII86oNO+5VCJ7 8hD4G6vAOq6OZrGuIykTyECpv2xiqEHaiwQuyl8m4br/T6c15p7+rwH1ArmWlbx/YPxPGMhyWfi ikJVsqJRfHq0lCDCIhyNhNZU+ewzHhdXPRb1UR8H8cNtWecLTQRPWR/Wq7zFwLl2ObwAEDceB64 U3I09HoDW086s7w== X-Mailer: b4 0.14.3 Message-ID: <20261011-gpuvm-reserve-overflow-v1-1-9c0cb23d7409@google.com> Subject: [PATCH] drm/gpuvm: skip setting kernel_alloc_node range on overflow From: Alice Ryhl To: Danilo Krummrich , Matthew Brost , "=?utf-8?q?Thomas_Hellstr=C3=B6m?=" Cc: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Miguel Ojeda , Boqun Feng , Gary Guo , "=?utf-8?q?Bj=C3=B6rn_Roy_Baron?=" , Benno Lossin , Andreas Hindborg , Trevor Gross , Daniel Almeida , Tamir Duberstein , Alexandre Courbot , "=?utf-8?q?Onur_=C3=96zkan?=" , Boris Brezillon , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, rust-for-linux@vger.kernel.org, Alice Ryhl Content-Type: text/plain; charset="utf-8" When the reserved VA range overflows in drm_gpuvm_init(), insertion of kernel_alloc_node is skipped, leaving its vm pointer NULL. However, va.range is still set to a non-zero value, which causes drm_gpuvm_fini() to dereference the NULL vm pointer when removing the node. Thus, only initialize kernel_alloc_node's address and range when the overflow check succeeds. Note that this fixes unsoundness in the Rust GpuVm::new() abstraction: passing a backwards reserve_range (start > end) when overflow checks are disabled causes `end - start` to wrap around, triggering the overflow in drm_gpuvm_init() and dereferencing NULL when the GpuVm is dropped. Fixes: e6303f323b1a ("drm: manager to keep track of GPUs VA mappings") Signed-off-by: Alice Ryhl --- drivers/gpu/drm/drm_gpuvm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_gpuvm.c b/drivers/gpu/drm/drm_gpuvm.c index d1c80ad3dead..626985743943 100644 --- a/drivers/gpu/drm/drm_gpuvm.c +++ b/drivers/gpu/drm/drm_gpuvm.c @@ -1127,12 +1127,12 @@ drm_gpuvm_init(struct drm_gpuvm *gpuvm, const char *name, memset(&gpuvm->kernel_alloc_node, 0, sizeof(struct drm_gpuva)); if (reserve_range) { - gpuvm->kernel_alloc_node.va.addr = reserve_offset; - gpuvm->kernel_alloc_node.va.range = reserve_range; - if (likely(!drm_gpuvm_warn_check_overflow(gpuvm, reserve_offset, - reserve_range))) + reserve_range))) { + gpuvm->kernel_alloc_node.va.addr = reserve_offset; + gpuvm->kernel_alloc_node.va.range = reserve_range; __drm_gpuva_insert(gpuvm, &gpuvm->kernel_alloc_node); + } } } EXPORT_SYMBOL_GPL(drm_gpuvm_init); --- base-commit: a90ee4305c4a5df72c11b31dacfdc76e00fcf78a change-id: 20261011-gpuvm-reserve-overflow-5b520d76889e Best regards, -- Alice Ryhl