Re: [PATCH v3] drm/gpusvm: Zero HMM PFNs before scanning ranges

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Incomplete fix: drm_gpusvm_scan_mm() still passes uninitialized memory to hmm_range_fault()
--

--- Patch [1]: [PATCH v3] drm/gpusvm: Zero HMM PFNs before scanning ranges ---
commit 94c866dacf02fc79cf17cd390ee14ceb8a723458
Author: Stanislav Kinsburskii <skinsburskii@gmail.com>

drm/gpusvm: Zero HMM PFNs before scanning ranges

This commit fixes an issue where drm_gpusvm_check_pages() passes an
uninitialized PFN array to HMM. It changes the allocation to use kvcalloc()
to ensure the array is zero-initialized before HMM scanning, which prevents
random memory contents from being interpreted as valid PFN flags.

> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index fcfe635bc1956..736c3a3e28f80 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c
> @@ -787,7 +787,7 @@ static bool drm_gpusvm_check_pages(struct drm_gpusvm *gpusvm,
>  
>  	mmap_assert_locked(gpusvm->mm);
>  
> -	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> +	pfns = kvcalloc(npages, sizeof(*pfns), GFP_KERNEL);
>  	if (!pfns)
>  		return false;

[Severity: Medium]
This isn't a bug introduced by this patch, but does the same fix need to be
applied to drm_gpusvm_scan_mm() in the same file?

drivers/gpu/drm/drm_gpusvm.c:drm_gpusvm_scan_mm() {
...
	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
	if (!pfns)
		return DRM_GPUSVM_SCAN_UNPOPULATED;

	hmm_range.hmm_pfns = pfns;
...
}

It appears drm_gpusvm_scan_mm() also allocates the uninitialized PFN array
using kvmalloc_array() and passes it to hmm_range_fault() with default_flags
set to 0. It then reads pfns[i] to check HMM_PFN_VALID, leaving it
susceptible to the exact same uninitialized memory issue fixed here.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723-drm-gpusvm-fixes-v3-1-4346a61d093a@gmail.com?part=1