Two independent fixes to the uAPI added by b88baab82871 ("drm/nouveau:
implement new VM_BIND uAPI").Patch 1 bounds the sync and operation counts in EXEC and VM_BIND. nouveau_exec_ucopy() and nouveau_uvmm_vm_bind_ucopy() hand user-supplied u32 counts straight to u_memcpya(), which only rejects multiplication overflow -- something a u32 count times a small element size never reaches on 64-bit. A wait_count of 0xffffffff thus becomes a 64 GB vmemdup_user() request: above INT_MAX that trips the WARN_ON_ONCE() in __kvmalloc_node_noprof(), and below it the kernel attempts a vmalloc of up to 2 GB that GFP_USER leaves uncharged to the caller's memcg. Patch 2 rejects a second VM_INIT. nouveau_uvmm_ioctl_vm_init() never checks whether the client already has a GPU VA space before overwriting cli->uvmm.ptr, so a second call orphans the first nouveau_uvmm with no remaining reference to it. The orphan, its drm_gpuvm, that gpuvm's reservation object and its region maple tree are never freed, the buffer objects mapped in it stay pinned, and its nvif vmm keeps the GPU page directories allocated until the file is closed. Signed-off-by: Junrui Luo <[email protected]> --- Junrui Luo (2): drm/nouveau: bound sync and op counts in EXEC and VM_BIND drm/nouveau/uvmm: reject a second VM_INIT drivers/gpu/drm/nouveau/nouveau_exec.c | 12 ++++++++++++ drivers/gpu/drm/nouveau/nouveau_uvmm.c | 24 ++++++++++++++++++++++++ include/uapi/drm/nouveau_drm.h | 18 ++++++++++++++++++ 3 files changed, 54 insertions(+) --- base-commit: 075b74841bd0065a3bda3440873c747938e69b68 change-id: 20260808-nouveau-fixes-70a70f3f5385 Best regards, -- Junrui Luo <[email protected]>
