This check is being already carried out further down the call stack inside drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to fail early in the driver before GPUVM functions are invoked so that we won't waste time allocating vm_bind context resources.
Reported-by: Sashiko <[email protected]> Closes: https://sashiko.dev/#/message/20260623204220.CDB1B1F000E9%40smtp.kernel.org Fixes: 12cf826bf1dd ("drm/panthor: Support sparse mappings") Signed-off-by: Adrián Larumbe <[email protected]> --- drivers/gpu/drm/panthor/panthor_mmu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c index 77fdad4e5166..8bd9b975e5ce 100644 --- a/drivers/gpu/drm/panthor/panthor_mmu.c +++ b/drivers/gpu/drm/panthor/panthor_mmu.c @@ -1328,6 +1328,7 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx, struct drm_gpuvm_bo *preallocated_vm_bo; struct sg_table *sgt = NULL; int ret; + u64 end; if (!bo) return -EINVAL; @@ -1353,6 +1354,10 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx, if (is_sparse && (op->bo_handle || op->bo_offset)) return -EINVAL; + /* Protect against sparse VA range overflow */ + if (is_sparse && check_add_overflow(op->va, op->size, &end)) + return -EINVAL; + /* If the BO has an exclusive VM attached, it can't be mapped to other VMs. */ if (bo->exclusive_vm_root_gem && bo->exclusive_vm_root_gem != panthor_vm_root_gem(vm)) @@ -1418,7 +1423,9 @@ static int panthor_vm_prepare_unmap_op_ctx(struct panthor_vm_op_ctx *op_ctx, struct panthor_vm *vm, const struct drm_panthor_vm_bind_op *op) { + bool is_sparse = op->flags & DRM_PANTHOR_VM_BIND_OP_MAP_SPARSE; u32 pt_count = 0; + u64 end; int ret; memset(op_ctx, 0, sizeof(*op_ctx)); @@ -1432,6 +1439,10 @@ static int panthor_vm_prepare_unmap_op_ctx(struct panthor_vm_op_ctx *op_ctx, if (op->va != ALIGN(op->va, SZ_2M)) pt_count++; + /* Protect against sparse VA range overflow */ + if (is_sparse && check_add_overflow(op->va, op->size, &end)) + return -EINVAL; + if (op->va + op->size != ALIGN(op->va + op->size, SZ_2M) && ALIGN(op->va + op->size, SZ_2M) != ALIGN(op->va, SZ_2M)) pt_count++; -- 2.54.0
