[PATCH] drm/gpuvm: skip setting kernel_alloc_node range on overflow

[PATCH] drm/gpuvm: skip setting kernel_alloc_node range on overflow

[Alice Ryhl]

When the reserved VA range overflows in drm_gpuvm_init(), insertion of
kernel_alloc_node is skipped, leaving its vm pointer NULL. However,
va.range is still set to a non-zero value, which causes drm_gpuvm_fini()
to dereference the NULL vm pointer when removing the node. Thus, only
initialize kernel_alloc_node's address and range when the overflow check
succeeds.

Note that this fixes unsoundness in the Rust GpuVm::new() abstraction:
passing a backwards reserve_range (start > end) when overflow checks are
disabled causes `end - start` to wrap around, triggering the overflow in
drm_gpuvm_init() and dereferencing NULL when the GpuVm is dropped.

Fixes: e6303f323b1a ("drm: manager to keep track of GPUs VA mappings")
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
---
 drivers/gpu/drm/drm_gpuvm.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/drm_gpuvm.c b/drivers/gpu/drm/drm_gpuvm.c
index d1c80ad3dead..626985743943 100644
--- a/drivers/gpu/drm/drm_gpuvm.c
+++ b/drivers/gpu/drm/drm_gpuvm.c
@@ -1127,12 +1127,12 @@ drm_gpuvm_init(struct drm_gpuvm *gpuvm, const char *name,
 
 	memset(&gpuvm->kernel_alloc_node, 0, sizeof(struct drm_gpuva));
 	if (reserve_range) {
-		gpuvm->kernel_alloc_node.va.addr = reserve_offset;
-		gpuvm->kernel_alloc_node.va.range = reserve_range;
-
 		if (likely(!drm_gpuvm_warn_check_overflow(gpuvm, reserve_offset,
-							  reserve_range)))
+							  reserve_range))) {
+			gpuvm->kernel_alloc_node.va.addr = reserve_offset;
+			gpuvm->kernel_alloc_node.va.range = reserve_range;
 			__drm_gpuva_insert(gpuvm, &gpuvm->kernel_alloc_node);
+		}
 	}
 }
 EXPORT_SYMBOL_GPL(drm_gpuvm_init);

---
base-commit: a90ee4305c4a5df72c11b31dacfdc76e00fcf78a
change-id: 20261011-gpuvm-reserve-overflow-5b520d76889e

Best regards,
-- 
Alice Ryhl <aliceryhl@google.com>

Re: [PATCH] drm/gpuvm: skip setting kernel_alloc_node range on overflow

[Danilo Krummrich]

On Sun Oct 11, 2026 at 9:22 AM CEST, Alice Ryhl wrote:
> When the reserved VA range overflows in drm_gpuvm_init(), insertion of
> kernel_alloc_node is skipped, leaving its vm pointer NULL. However,
> va.range is still set to a non-zero value, which causes drm_gpuvm_fini()
> to dereference the NULL vm pointer when removing the node. Thus, only
> initialize kernel_alloc_node's address and range when the overflow check
> succeeds.
>
> Note that this fixes unsoundness in the Rust GpuVm::new() abstraction:
> passing a backwards reserve_range (start > end) when overflow checks are
> disabled causes `end - start` to wrap around, triggering the overflow in
> drm_gpuvm_init() and dereferencing NULL when the GpuVm is dropped.
>
> Fixes: e6303f323b1a ("drm: manager to keep track of GPUs VA mappings")
> Signed-off-by: Alice Ryhl <aliceryhl@google.com>

Good catch! Please also add Cc: stable.

> @@ -1127,12 +1127,12 @@ drm_gpuvm_init(struct drm_gpuvm *gpuvm, const char *name,
>  
>  	memset(&gpuvm->kernel_alloc_node, 0, sizeof(struct drm_gpuva));
>  	if (reserve_range) {
> -		gpuvm->kernel_alloc_node.va.addr = reserve_offset;
> -		gpuvm->kernel_alloc_node.va.range = reserve_range;
> -
>  		if (likely(!drm_gpuvm_warn_check_overflow(gpuvm, reserve_offset,
> -							  reserve_range)))
> +							  reserve_range))) {
> +			gpuvm->kernel_alloc_node.va.addr = reserve_offset;
> +			gpuvm->kernel_alloc_node.va.range = reserve_range;
>  			__drm_gpuva_insert(gpuvm, &gpuvm->kernel_alloc_node);
> +		}
>  	}

Please collapse this to a single if statement.

Thanks,
Danilo