[PATCH v3] drm/gpusvm: Zero HMM PFNs before scanning ranges

[PATCH v3] drm/gpusvm: Zero HMM PFNs before scanning ranges

[Stanislav Kinsburskii]

drm_gpusvm_check_pages() asks HMM to report the current CPU page-table
state without faulting missing entries by leaving default_flags set to
zero. The HMM PFN array is still caller-owned input/output state, and the
framework may preserve input bits while filling entries. It is not safe for
the caller to hand HMM an uninitialized array and then treat entries
without HMM_PFN_VALID as an authoritative unpopulated result.

Use kvcalloc() for the temporary PFN array so entries that are not reported
as valid start from the documented zero state. This prevents random stack
or heap contents from being interpreted as HMM PFN flags or PFN values
during the scan.

Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
Cc: stable@vger.kernel.org
Signed-off-by: Stanislav Kinsburskii <skinsburskii@gmail.com>
---
 drivers/gpu/drm/drm_gpusvm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
index b946f920b7a0..52573626387c 100644
--- a/drivers/gpu/drm/drm_gpusvm.c
+++ b/drivers/gpu/drm/drm_gpusvm.c
@@ -708,7 +708,7 @@ static bool drm_gpusvm_check_pages(struct drm_gpusvm *gpusvm,
 
 	mmap_assert_locked(gpusvm->mm);
 
-	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
+	pfns = kvcalloc(npages, sizeof(*pfns), GFP_KERNEL);
 	if (!pfns)
 		return false;
 

---
base-commit: baa47c6547b94a164b70924e53d2bcf16f483e6c
change-id: 20260723-drm-gpusvm-fixes-d97ddda62219

Best regards,
-- 
Stanislav Kinsburskii <skinsburskii@gmail.com>

Re: [PATCH v3] drm/gpusvm: Zero HMM PFNs before scanning ranges

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Incomplete fix: drm_gpusvm_scan_mm() still passes uninitialized memory to hmm_range_fault()
--

--- Patch [1]: [PATCH v3] drm/gpusvm: Zero HMM PFNs before scanning ranges ---
commit 94c866dacf02fc79cf17cd390ee14ceb8a723458
Author: Stanislav Kinsburskii <skinsburskii@gmail.com>

drm/gpusvm: Zero HMM PFNs before scanning ranges

This commit fixes an issue where drm_gpusvm_check_pages() passes an
uninitialized PFN array to HMM. It changes the allocation to use kvcalloc()
to ensure the array is zero-initialized before HMM scanning, which prevents
random memory contents from being interpreted as valid PFN flags.

> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index fcfe635bc1956..736c3a3e28f80 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c
> @@ -787,7 +787,7 @@ static bool drm_gpusvm_check_pages(struct drm_gpusvm *gpusvm,
>  
>  	mmap_assert_locked(gpusvm->mm);
>  
> -	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> +	pfns = kvcalloc(npages, sizeof(*pfns), GFP_KERNEL);
>  	if (!pfns)
>  		return false;

[Severity: Medium]
This isn't a bug introduced by this patch, but does the same fix need to be
applied to drm_gpusvm_scan_mm() in the same file?

drivers/gpu/drm/drm_gpusvm.c:drm_gpusvm_scan_mm() {
...
	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
	if (!pfns)
		return DRM_GPUSVM_SCAN_UNPOPULATED;

	hmm_range.hmm_pfns = pfns;
...
}

It appears drm_gpusvm_scan_mm() also allocates the uninitialized PFN array
using kvmalloc_array() and passes it to hmm_range_fault() with default_flags
set to 0. It then reads pfns[i] to check HMM_PFN_VALID, leaving it
susceptible to the exact same uninitialized memory issue fixed here.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723-drm-gpusvm-fixes-v3-1-4346a61d093a@gmail.com?part=1

Re: [PATCH v3] drm/gpusvm: Zero HMM PFNs before scanning ranges

[Matthew Brost]

On Thu, Jul 23, 2026 at 10:49:02AM -0700, Stanislav Kinsburskii wrote:
> drm_gpusvm_check_pages() asks HMM to report the current CPU page-table
> state without faulting missing entries by leaving default_flags set to
> zero. The HMM PFN array is still caller-owned input/output state, and the
> framework may preserve input bits while filling entries. It is not safe for
> the caller to hand HMM an uninitialized array and then treat entries
> without HMM_PFN_VALID as an authoritative unpopulated result.
> 
> Use kvcalloc() for the temporary PFN array so entries that are not reported
> as valid start from the documented zero state. This prevents random stack
> or heap contents from being interpreted as HMM PFN flags or PFN values
> during the scan.
> 
> Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
> Cc: stable@vger.kernel.org
> Signed-off-by: Stanislav Kinsburskii <skinsburskii@gmail.com>

Reviewed-by: Matthew Brost <matthew.brost@intel.com>

> ---
>  drivers/gpu/drm/drm_gpusvm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index b946f920b7a0..52573626387c 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c
> @@ -708,7 +708,7 @@ static bool drm_gpusvm_check_pages(struct drm_gpusvm *gpusvm,
>  
>  	mmap_assert_locked(gpusvm->mm);
>  
> -	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> +	pfns = kvcalloc(npages, sizeof(*pfns), GFP_KERNEL);
>  	if (!pfns)
>  		return false;
>  
> 
> ---
> base-commit: baa47c6547b94a164b70924e53d2bcf16f483e6c
> change-id: 20260723-drm-gpusvm-fixes-d97ddda62219
> 
> Best regards,
> -- 
> Stanislav Kinsburskii <skinsburskii@gmail.com>
>