When the reserved VA range overflows in drm_gpuvm_init(), insertion of kernel_alloc_node is skipped, leaving its vm pointer NULL. However, va.range is still set to a non-zero value, which causes drm_gpuvm_fini() to dereference the NULL vm pointer when removing the node. Thus, only initialize kernel_alloc_node's address and range when the overflow check succeeds.
Note that this fixes unsoundness in the Rust GpuVm::new() abstraction: passing a backwards reserve_range (start > end) when overflow checks are disabled causes `end - start` to wrap around, triggering the overflow in drm_gpuvm_init() and dereferencing NULL when the GpuVm is dropped. Cc: [email protected] Fixes: e6303f323b1a ("drm: manager to keep track of GPUs VA mappings") Signed-off-by: Alice Ryhl <[email protected]> --- Changes in v2: - Collapse the two if statements into one. - Add Cc: stable. - Link to v1: https://lore.kernel.org/r/[email protected] --- drivers/gpu/drm/drm_gpuvm.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/drm_gpuvm.c b/drivers/gpu/drm/drm_gpuvm.c index d1c80ad3dead..8e74d171125b 100644 --- a/drivers/gpu/drm/drm_gpuvm.c +++ b/drivers/gpu/drm/drm_gpuvm.c @@ -1126,13 +1126,12 @@ drm_gpuvm_init(struct drm_gpuvm *gpuvm, const char *name, gpuvm->mm_range = range; memset(&gpuvm->kernel_alloc_node, 0, sizeof(struct drm_gpuva)); - if (reserve_range) { + if (reserve_range && + likely(!drm_gpuvm_warn_check_overflow(gpuvm, reserve_offset, + reserve_range))) { gpuvm->kernel_alloc_node.va.addr = reserve_offset; gpuvm->kernel_alloc_node.va.range = reserve_range; - - if (likely(!drm_gpuvm_warn_check_overflow(gpuvm, reserve_offset, - reserve_range))) - __drm_gpuva_insert(gpuvm, &gpuvm->kernel_alloc_node); + __drm_gpuva_insert(gpuvm, &gpuvm->kernel_alloc_node); } } EXPORT_SYMBOL_GPL(drm_gpuvm_init); --- base-commit: a90ee4305c4a5df72c11b31dacfdc76e00fcf78a change-id: 20261011-gpuvm-reserve-overflow-5b520d76889e Best regards, -- Alice Ryhl <[email protected]>
