On 10/15/26 10:37, Jesse Zhang wrote:
> For AMDGPU_GEM_USERPTR_ANONONLY, amdgpu_ttm_tt_get_user_pages() only
> checks the VMA at the start of the range for a backing file, and
> amdgpu_hmm_range_get_pages() then faults in the whole range, across any
> other VMAs. The check used to reject ranges ending beyond the first VMA
> (vma->vm_end < end), which got lost when the code moved to HMM.
>
> An ANONONLY userptr over one page of file-backed memory is rejected
> with -EPERM, but one over an anonymous page followed by the same
> file-backed page is accepted.
>
> Restore the check and reject ANONONLY userptrs that cross more than one
> VMA. The second userptr is now rejected too.
>
> v2: reject ranges spanning multiple VMAs instead of walking every VMA
> (Christian)
> v3: cast num_pages to u64 to avoid an overflow (Christian)
>
> Fixes: 6826cb3b92a3 ("drm/amdgpu: support userptr cross VMAs case with HMM")
> Cc: Christian König <[email protected]>
> Cc: Philip Yang <[email protected]>
> Cc: Felix Kuehling <[email protected]>
> Signed-off-by: Jesse Zhang <[email protected]>
Reviewed-by: Christian König <[email protected]>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> index 2103f8d6165d..9c3efc27b363 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> @@ -784,7 +784,8 @@ int amdgpu_ttm_tt_get_user_pages(struct amdgpu_bo *bo,
> goto out_unlock;
> }
> if (unlikely((gtt->userflags & AMDGPU_GEM_USERPTR_ANONONLY) &&
> - vma->vm_file)) {
> + (vma->vm_file ||
> + vma->vm_end < start + (u64)ttm->num_pages * PAGE_SIZE))) {
> r = -EPERM;
> goto out_unlock;
> }
