Re: [PATCH] drm/gpusvm: Zero HMM PFNs before scanning ranges

[Matthew Brost <matthew.brost@intel.com>]

On Mon, Jul 20, 2026 at 04:48:02PM -0700, Stanislav Kinsburskii wrote:
> On Mon, Jul 20, 2026 at 11:54:50AM -0700, Matthew Brost wrote:
> > On Tue, Jul 14, 2026 at 03:54:32PM -0700, Stanislav Kinsburskii wrote:
> > > drm_gpusvm_scan_mm() asks HMM to report the current CPU page-table
> > > state without faulting missing entries by leaving default_flags set to
> > > zero. The HMM PFN array is still caller-owned input/output state, and
> > > the framework may preserve input bits while filling entries. It is not
> > > safe for the caller to hand HMM an uninitialized array and then treat
> > > entries without HMM_PFN_VALID as an authoritative unpopulated result.
> > > 
> > > Use kvcalloc() for the temporary PFN array so entries that are not
> > > reported as valid start from the documented zero state. This prevents
> > > random stack or heap contents from being interpreted as HMM PFN flags or
> > > PFN values during the scan.
> > > 
> > > Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
> > > Cc: stable@vger.kernel.org
> > > Signed-off-by: Stanislav Kinsburskii <skinsburskii@gmail.com>
> > > ---
> > >  drivers/gpu/drm/drm_gpusvm.c |    2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> > > index 1a8bb83bd28d..c8f489d7ff7e 100644
> > > --- a/drivers/gpu/drm/drm_gpusvm.c
> > > +++ b/drivers/gpu/drm/drm_gpusvm.c
> > > @@ -859,7 +859,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
> > 
> > Two other cases in gpusvm would need to be fixed as well:
> > 
> > - drm_gpusvm_get_pages
> > - drm_gpusvm_range_evict
> > 
> 
> No, these two are fine, as the faulting is done with HMM_PFN_REQ_FAULT,
> which either populates all the PFNs or fails.
> 

Ah, yes clearly misunderstood the issue here / didn't read the commit
message.

This patch LGTM:
Reviewed-by: Matthew Brost <matthew.brost@intel.com>

Will merge to drm-misc-fixes shortly.

But then drm_gpusvm_check_pages() should be fixed too as we don't set
HMM_PFN_REQ_FAULT there either.

Matt

> The only case where PFNs must be zeroed is when the caller wants to
> collect the mapped PFNs. In this case, the missing PFNs are simply
> ignored by the HMM framework.
> 
> Thanks,
> Stanislav
> 
> > The offending patch is likely the one that added sticky bits to HMM:
> > `git format-patch -1 285e871884ff3` for above two cases.
> > 
> > While I think zeroing here would be the safest approach, it does not appear
> > to be a problem in practice because the sticky bits are only used by
> > `hmm_dma_map_pfn()` and `hmm_dma_unmap_pfn()`.
> > 
> > Also, there are several non-gpusvm cases in the kernel that do not zero
> > the PFN array either. So I'd say we should either fix the entire kernel
> > in one pass, document that pfns must initialized to a known state, or
> > leave this code alone.
> > 
> > Matt
> > 
> > >  	const struct dev_pagemap *other = NULL;
> > >  	int err, i;
> > >  
> > > -	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> > > +	pfns = kvcalloc(npages, sizeof(*pfns), GFP_KERNEL);
> > >  	if (!pfns)
> > >  		return DRM_GPUSVM_SCAN_UNPOPULATED;
> > >  
> > > 
> > >