drm_gpuvm_range_valid() is the common gate every GPUVM map/unmap path
funnels through: drm_gpuva_insert(), __drm_gpuvm_sm_map() and
__drm_gpuvm_sm_unmap() all reject a request unless it passes. It checks
for overflow, the managed-range bounds and kernel-node overlap, but it
never rejects a zero-length range. A range of 0 is page-aligned and
addr + 0 does not overflow, so a zero-length VM_BIND request from
userspace passes validation.
The GPUVA interval tree derives a node's last key as addr + range - 1
(GPUVA_LAST()). With range == 0 this underflows to addr - 1, producing
an interval whose end lies below its start (and, for addr == 0, wraps to
U64_MAX). __drm_gpuva_insert() then issues its overlap query with that
inverted interval, so the -EEXIST guard matches nothing and a malformed
zero-length node is inserted, corrupting the augmented interval tree's
subtree-last invariant and misleading the overlap checks of later
map/unmap operations on the same VM.
Because the shared helper's own kerneldoc promises to validate "the
range" yet silently accepts range == 0, drivers have papered over this
individually and inconsistently: imagination and xe reject a zero range
at/near the ioctl boundary, while nouveau and msm do not. Fix it once at
the common gate so every current and future caller is covered.
The only in-tree user that legitimately accepts a zero range,
xe's DRM_XE_VM_BIND_OP_UNMAP_ALL, interprets it at its ioctl layer and
never passes range == 0 into the GPUVM core, so it is unaffected. The
in-core lookups drm_gpuva_find_prev()/drm_gpuva_find_next() pass
range == 1 and are likewise unaffected.
Fixes: e6303f323b1a ("drm: manager to keep track of GPUs VA mappings")
Reported-by: Yuhao Jiang <[email protected]>
Assisted-by: Claude:claude-opus-5
Cc: [email protected]
Signed-off-by: Zhenhao Wan <[email protected]>
---
drivers/gpu/drm/drm_gpuvm.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/drm_gpuvm.c b/drivers/gpu/drm/drm_gpuvm.c
index c422c5af1f4b..b73ad6988171 100644
--- a/drivers/gpu/drm/drm_gpuvm.c
+++ b/drivers/gpu/drm/drm_gpuvm.c
@@ -1021,7 +1021,8 @@ drm_gpuvm_in_kernel_node(struct drm_gpuvm *gpuvm, u64
addr, u64 range)
* @addr: the base address
* @range: the range starting from the base address
*
- * Checks whether the range is within the GPUVM's managed boundaries.
+ * Checks whether the range is non-zero and within the GPUVM's managed
+ * boundaries.
*
* Returns: true for a valid range, false otherwise
*/
@@ -1029,7 +1030,8 @@ bool
drm_gpuvm_range_valid(struct drm_gpuvm *gpuvm,
u64 addr, u64 range)
{
- return !drm_gpuvm_check_overflow(addr, range) &&
+ return range != 0 &&
+ !drm_gpuvm_check_overflow(addr, range) &&
drm_gpuvm_in_mm_range(gpuvm, addr, range) &&
!drm_gpuvm_in_kernel_node(gpuvm, addr, range);
}
--
2.34.1
