[PATCH 0/6] drm: reject empty TTM range manager sizes

[PATCH 0/6] drm: reject empty TTM range manager sizes

[Jiale Yao]

drm_mm_init() rejects a zero-length allocation range with a BUG check.
Several DRM TTM users can derive a zero page count from device-provided
VRAM metadata and pass it to the range manager.

This series rejects empty ranges at the affected callers and adds a
defensive check in the common range manager. Patches 1 through 4 and
6 validate the individual driver inputs. Patch 5 protects the shared
range-manager API against any remaining zero-page caller.

The series was checked with scripts/checkpatch.pl for every code patch.

Jiale Yao (6):
  drm/vram-helper: reject empty VRAM ranges
  drm/nouveau: reject empty VRAM ranges
  drm/qxl: reject empty TTM memory ranges
  drm/radeon: reject empty VRAM ranges
  drm/ttm: reject empty range manager sizes
  drm/vmwgfx: reject empty VRAM ranges

 drivers/gpu/drm/drm_gem_vram_helper.c   | 3 +++
 drivers/gpu/drm/nouveau/nouveau_ttm.c   | 3 +++
 drivers/gpu/drm/qxl/qxl_ttm.c           | 3 +++
 drivers/gpu/drm/radeon/radeon_ttm.c     | 3 +++
 drivers/gpu/drm/ttm/ttm_range_manager.c | 3 +++
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.c     | 4 ++++
 6 files changed, 19 insertions(+)

-- 
2.34.1

[PATCH 1/6] drm/vram-helper: reject empty VRAM ranges

[Jiale Yao]

A VRAM range smaller than a page becomes a zero-page TTM range and
causes drm_mm_init() to hit its zero-range BUG check. Reject such
ranges before initializing the TTM device.

Fixes: 37205891d84f ("drm/ttm: make ttm_range_man_init/takedown take type + args")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/gpu/drm/drm_gem_vram_helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c b/drivers/gpu/drm/drm_gem_vram_helper.c
index bca802ccddee..f8bf2d002236 100644
--- a/drivers/gpu/drm/drm_gem_vram_helper.c
+++ b/drivers/gpu/drm/drm_gem_vram_helper.c
@@ -851,6 +851,9 @@ static int drm_vram_mm_init(struct drm_vram_mm *vmm, struct drm_device *dev,
 {
 	int ret;
 
+	if (vram_size < PAGE_SIZE)
+		return -EINVAL;
+
 	vmm->vram_base = vram_base;
 	vmm->vram_size = vram_size;
 
-- 
2.34.1

[PATCH 2/6] drm/nouveau: reject empty VRAM ranges

[Jiale Yao]

A VRAM range smaller than a page becomes a zero-page TTM range and
causes drm_mm_init() to hit its zero-range BUG check. Reject it before
creating the VRAM manager.

Fixes: 37205891d84f ("drm/ttm: make ttm_range_man_init/takedown take type + args")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/gpu/drm/nouveau/nouveau_ttm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
index cfc0868e2dd3..99c74c3b5976 100644
--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -181,6 +181,9 @@ nouveau_ttm_init_host(struct nouveau_drm *drm, u8 kind)
 static int
 nouveau_ttm_init_vram(struct nouveau_drm *drm)
 {
+	if (drm->gem.vram_available < PAGE_SIZE)
+		return -EINVAL;
+
 	if (drm->client.device.info.family >= NV_DEVICE_INFO_V0_TESLA) {
 		struct ttm_resource_manager *man = kzalloc_obj(*man);
 
-- 
2.34.1

[PATCH 3/6] drm/qxl: reject empty TTM memory ranges

[Jiale Yao]

A zero page count passed to the range manager reaches drm_mm_init()
and causes its zero-range BUG check to fire. Reject empty memory
ranges before initializing the manager.

Fixes: 37205891d84f ("drm/ttm: make ttm_range_man_init/takedown take type + args")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/gpu/drm/qxl/qxl_ttm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
index 5d495c4798a3..c8cda805b645 100644
--- a/drivers/gpu/drm/qxl/qxl_ttm.c
+++ b/drivers/gpu/drm/qxl/qxl_ttm.c
@@ -185,6 +185,9 @@ static int qxl_ttm_init_mem_type(struct qxl_device *qdev,
 				 unsigned int type,
 				 uint64_t size)
 {
+	if (!size)
+		return -EINVAL;
+
 	return ttm_range_man_init(&qdev->mman.bdev, type, false, size);
 }
 
-- 
2.34.1

[PATCH 4/6] drm/radeon: reject empty VRAM ranges

[Jiale Yao]

A VRAM size smaller than a page becomes a zero-page TTM range and
causes drm_mm_init() to hit its zero-range BUG check. Reject such a
range before initializing the VRAM manager.

Fixes: 37205891d84f ("drm/ttm: make ttm_range_man_init/takedown take type + args")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/gpu/drm/radeon/radeon_ttm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index e7ab8162ac69..925593af1688 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -69,6 +69,9 @@ struct radeon_device *radeon_get_rdev(struct ttm_device *bdev)
 
 static int radeon_ttm_init_vram(struct radeon_device *rdev)
 {
+	if (rdev->mc.real_vram_size < PAGE_SIZE)
+		return -EINVAL;
+
 	return ttm_range_man_init(&rdev->mman.bdev, TTM_PL_VRAM,
 				  false, rdev->mc.real_vram_size >> PAGE_SHIFT);
 }
-- 
2.34.1

[PATCH 5/6] drm/ttm: reject empty range manager sizes

[Jiale Yao]

A zero page count reaches drm_mm_init() and causes its zero-range BUG
check to fire. Return an error before allocating and installing the
range manager.

Fixes: 77ef8bbc87be ("drm: make drm_mm_init() return void")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/gpu/drm/ttm/ttm_range_manager.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/ttm/ttm_range_manager.c b/drivers/gpu/drm/ttm/ttm_range_manager.c
index b818836f0726..5fd484ae1706 100644
--- a/drivers/gpu/drm/ttm/ttm_range_manager.c
+++ b/drivers/gpu/drm/ttm/ttm_range_manager.c
@@ -184,6 +184,9 @@ int ttm_range_man_init_nocheck(struct ttm_device *bdev,
 	struct ttm_resource_manager *man;
 	struct ttm_range_manager *rman;
 
+	if (!p_size)
+		return -EINVAL;
+
 	rman = kzalloc_obj(*rman);
 	if (!rman)
 		return -ENOMEM;
-- 
2.34.1

[PATCH 6/6] drm/vmwgfx: reject empty VRAM ranges

[Jiale Yao]

A VRAM size smaller than a page becomes a zero-page TTM range and
causes drm_mm_init() to hit its zero-range BUG check. Reject such a
range before creating the VRAM manager.

Fixes: 37205891d84f ("drm/ttm: make ttm_range_man_init/takedown take type + args")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 0f101aedb49a..33284a776fa6 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -692,6 +692,10 @@ static int vmw_dma_masks(struct vmw_private *dev_priv)
 static int vmw_vram_manager_init(struct vmw_private *dev_priv)
 {
 	int ret;
+
+	if (dev_priv->vram_size < PAGE_SIZE)
+		return -EINVAL;
+
 	ret = ttm_range_man_init(&dev_priv->bdev, TTM_PL_VRAM, false,
 				 dev_priv->vram_size >> PAGE_SHIFT);
 	ttm_resource_manager_set_used(ttm_manager_type(&dev_priv->bdev, TTM_PL_VRAM), false);
-- 
2.34.1

Re: [PATCH 0/6] drm: reject empty TTM range manager sizes

[Christian König]

On 10/19/26 10:41, Jiale Yao wrote:
> drm_mm_init() rejects a zero-length allocation range with a BUG check.
> Several DRM TTM users can derive a zero page count from device-provided
> VRAM metadata and pass it to the range manager.

The BUG check is there to point out driver bugs which try to initialize a VRAM manager while no VRAM is installed.

That is intended behavior and returning an error instead of running into a BUG() makes that intended behavior go away and eventually cause more problems down the road.

So absolutely clear NAK to that.

Regards,
Christian.

> 
> This series rejects empty ranges at the affected callers and adds a
> defensive check in the common range manager. Patches 1 through 4 and
> 6 validate the individual driver inputs. Patch 5 protects the shared
> range-manager API against any remaining zero-page caller.
> 
> The series was checked with scripts/checkpatch.pl for every code patch.
> 
> Jiale Yao (6):
>   drm/vram-helper: reject empty VRAM ranges
>   drm/nouveau: reject empty VRAM ranges
>   drm/qxl: reject empty TTM memory ranges
>   drm/radeon: reject empty VRAM ranges
>   drm/ttm: reject empty range manager sizes
>   drm/vmwgfx: reject empty VRAM ranges
> 
>  drivers/gpu/drm/drm_gem_vram_helper.c   | 3 +++
>  drivers/gpu/drm/nouveau/nouveau_ttm.c   | 3 +++
>  drivers/gpu/drm/qxl/qxl_ttm.c           | 3 +++
>  drivers/gpu/drm/radeon/radeon_ttm.c     | 3 +++
>  drivers/gpu/drm/ttm/ttm_range_manager.c | 3 +++
>  drivers/gpu/drm/vmwgfx/vmwgfx_drv.c     | 4 ++++
>  6 files changed, 19 insertions(+)
>