Re: [PATCH v5 1/2] drm/panthor: Add vm_bind region with kbo range overlap check

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Zero-size asynchronous VM_BIND operations can corrupt the drm_gpuvm interval tree.
--

--- Patch [1]: [PATCH v5 1/2] drm/panthor: Add vm_bind region with kbo range overlap check ---
commit 0c0faa58a385567244a3f75b05f6667907422807
Author: Adrián Larumbe <adrian.larumbe@collabora.com>

drm/panthor: Add vm_bind region with kbo range overlap check

When a VM is created, the caller has to specify the range of the address
space carve-out set aside for mapping kernel buffer objects. That means
vm_bind mappings of userspace-exposed objects should not intersect with
that region, which this patch checks during the vm_bind ioctl.

> diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
> index 31cc57029c12c..910c8e579770d 100644
> --- a/drivers/gpu/drm/panthor/panthor_mmu.c
> +++ b/drivers/gpu/drm/panthor/panthor_mmu.c

[ ... ]

> @@ -2981,6 +2986,10 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file,
>  	if (!IS_ALIGNED(op->va | op->size | op->bo_offset, vm_pgsz))
>  		return -EINVAL;
>  
> +	/* We don't allow mappings that overlap with kbo's reserved range */
> +	if (range_overflows(op->va, op->size, vm->user_va_range))
> +		return -EINVAL;
> +

[Severity: High]
This is a pre-existing issue, but does this function need to reject
op->size == 0 before proceeding?

A zero-size map operation is currently treated as aligned, and
range_overflows() will return false, allowing it to pass this validation.

If userspace passes a zero size, inserting a zero-size interval into the
interval tree will compute an end address of addr - 1. This violates the
red-black augmented tree invariants which require start to be less than
or equal to last.

Could this cause structural corruption of the interval subtree values,
leading to subsequent tree traversals silently failing to find mapped
regions? Unlike the sync path, panthor_vm_bind_job_create() appears to lack
a size check for asynchronous jobs, which might allow unprivileged
userspace to trigger this directly.

>  	switch (op->flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) {
>  	case DRM_PANTHOR_VM_BIND_OP_TYPE_MAP:
>  		if (!(op->flags & DRM_PANTHOR_VM_BIND_OP_MAP_SPARSE)) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-vm_bind_checks-v5-0-0d2314af8d9d@collabora.com?part=1