v1 fixed this in the nouveau driver by rejecting a zero-length range in nouveau_uvmm_validate_range(). Danilo pointed out that this should be fixed in GPUVM instead, and he is right: the defect is in the core, so this v2 moves the fix there.
A zero-length range passes drm_gpuvm_range_valid() (0 is page-aligned and addr + 0 does not overflow), and the GPUVA interval tree then computes a node's last key as addr + range - 1, which underflows to addr - 1. The resulting inverted interval corrupts the augmented rb-tree. Because both the underflowing arithmetic and the single validation gate live in drm_gpuvm.c, the core protects no one: nouveau and msm are affected, while xe and imagination are saved only by their own explicit checks near the ioctl boundary. Patch 2 adds the rejection to drm_gpuvm_range_valid(), closing the hole for all callers at once. Fixing only the core would, however, interact badly with panthor. Its synchronous VM_BIND path already treats a zero-length op as a no-op (returns 0), but its asynchronous path does not: a zero-length async MAP/UNMAP reaches drm_gpuvm_sm_map()/drm_gpuvm_sm_unmap(). Today a zero-length async map into unmapped space can already insert a malformed node there, so patch 1 fixes a pre-existing corruption on its own; and once the core starts rejecting a zero range, panthor_vm_bind_run_job() would additionally escalate the resulting -EINVAL to panthor_vm_declare_unusable(), permanently killing the VM. Patch 1 therefore makes panthor's asynchronous path treat a zero-length op as a no-op, matching its synchronous path, and must be applied before patch 2. Both patches are Cc: stable. Changes since v1: - Move the fix from the nouveau driver into the GPUVM core (drm_gpuvm_range_valid()), per Danilo's feedback. - Add a preparatory panthor patch so the core change does not regress panthor's asynchronous VM_BIND path. - Link to v1: https://lore.kernel.org/all/[email protected] Signed-off-by: Zhenhao Wan <[email protected]> --- Zhenhao Wan (2): drm/panthor: Treat a zero-length VM_BIND op as a no-op drm/gpuvm: reject zero-length range in drm_gpuvm_range_valid() drivers/gpu/drm/drm_gpuvm.c | 6 ++++-- drivers/gpu/drm/panthor/panthor_mmu.c | 9 +++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) --- base-commit: db2ddb87143519e20a95aa36c60b36107b736a58 change-id: 20260902-drm-gpuvm-zerorange-v2-a2148df386b8 Best regards, -- Zhenhao Wan <[email protected]>
