panthor_vm_bind_exec_sync_op() short-circuits a zero-length operation: it
returns 0 immediately when op->size is 0. The asynchronous VM_BIND path
has no equivalent guard.
An async MAP or UNMAP with size == 0 is not rejected: only alignment is
checked in panthor_vm_bind_prepare_op_ctx() and IS_ALIGNED(0) is true, so
the op is queued and panthor_vm_exec_op() calls drm_gpuvm_sm_map() /
drm_gpuvm_sm_unmap() with a zero range. A zero-length map into unmapped
space then reaches drm_gpuva_insert(), where the GPUVA interval-tree last
key addr + range - 1 underflows to addr - 1 and a malformed node whose end
lies below its start can be inserted, corrupting the augmented interval
tree.
Mirror the synchronous path and treat a zero-length map or unmap as a no-op
in panthor_vm_exec_op(), before any lock is taken or the GPUVA tree is
touched. This also keeps the async path robust if the core drm_gpuvm range
validation is tightened to reject a zero range, which would otherwise make
panthor_vm_bind_run_job() flag the VM unusable on the resulting -EINVAL.
Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block")
Reported-by: Yuhao Jiang <[email protected]>
Assisted-by: Claude:claude-opus-5
Cc: [email protected]
Signed-off-by: Zhenhao Wan <[email protected]>
---
drivers/gpu/drm/panthor/panthor_mmu.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c
b/drivers/gpu/drm/panthor/panthor_mmu.c
index e592a8ebb478..93542f59cb5e 100644
--- a/drivers/gpu/drm/panthor/panthor_mmu.c
+++ b/drivers/gpu/drm/panthor/panthor_mmu.c
@@ -2591,6 +2591,15 @@ panthor_vm_exec_op(struct panthor_vm *vm, struct
panthor_vm_op_ctx *op,
if (op_type == DRM_PANTHOR_VM_BIND_OP_TYPE_SYNC_ONLY)
return 0;
+ /*
+ * A zero-length map or unmap is a no-op. The synchronous bind path
+ * already short-circuits it in panthor_vm_bind_exec_sync_op(); mirror
+ * that here so an asynchronous zero-length op does not fail and flag
the
+ * VM as unusable.
+ */
+ if (!op->va.range)
+ return 0;
+
mutex_lock(&vm->op_lock);
vm->op_ctx = op;
--
2.34.1
