Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Zero-size asynchronous VM_BIND operations can corrupt the drm_gpuvm interval tree. -- --- Patch [1]: [PATCH v5 1/2] drm/panthor: Add vm_bind region with kbo range overlap check --- commit 0c0faa58a385567244a3f75b05f6667907422807 Author: Adrián Larumbe <[email protected]> drm/panthor: Add vm_bind region with kbo range overlap check When a VM is created, the caller has to specify the range of the address space carve-out set aside for mapping kernel buffer objects. That means vm_bind mappings of userspace-exposed objects should not intersect with that region, which this patch checks during the vm_bind ioctl. > diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c > b/drivers/gpu/drm/panthor/panthor_mmu.c > index 31cc57029c12c..910c8e579770d 100644 > --- a/drivers/gpu/drm/panthor/panthor_mmu.c > +++ b/drivers/gpu/drm/panthor/panthor_mmu.c [ ... ] > @@ -2981,6 +2986,10 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file, > if (!IS_ALIGNED(op->va | op->size | op->bo_offset, vm_pgsz)) > return -EINVAL; > > + /* We don't allow mappings that overlap with kbo's reserved range */ > + if (range_overflows(op->va, op->size, vm->user_va_range)) > + return -EINVAL; > + [Severity: High] This is a pre-existing issue, but does this function need to reject op->size == 0 before proceeding? A zero-size map operation is currently treated as aligned, and range_overflows() will return false, allowing it to pass this validation. If userspace passes a zero size, inserting a zero-size interval into the interval tree will compute an end address of addr - 1. This violates the red-black augmented tree invariants which require start to be less than or equal to last. Could this cause structural corruption of the interval subtree values, leading to subsequent tree traversals silently failing to find mapped regions? Unlike the sync path, panthor_vm_bind_job_create() appears to lack a size check for asynchronous jobs, which might allow unprivileged userspace to trigger this directly. > switch (op->flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) { > case DRM_PANTHOR_VM_BIND_OP_TYPE_MAP: > if (!(op->flags & DRM_PANTHOR_VM_BIND_OP_MAP_SPARSE)) { -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
