Re: [PATCH v2] drm/nouveau/uvmm: reject replace across page sizes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/nouveau: UAF in select_page_shift() due to lockless resource access
--

commit 96b9704295117874e5545da9ce1209804365ab06
Author: Junrui Luo <moonafterrain@outlook.com>

drm/nouveau/uvmm: reject replace across page sizes

This commit fixes an issue where rebinding mappings across different page
sizes leaves split remainders with incorrect page tables. It rejects binds
with mismatched page sizes and ensures split remainders inherit their
parent's page size.

Link: https://lore.kernel.org/r/20260817-nouveau-fixes-v1-0-f518d0c735f3@outlook.com

> diff --git a/drivers/gpu/drm/nouveau/nouveau_uvmm.c b/drivers/gpu/drm/nouveau/nouveau_uvmm.c
> index f5e4756b4de4a..aa5b93808f41c 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c
> @@ -684,8 +686,20 @@ nouveau_uvmm_sm_prepare(struct nouveau_uvmm *uvmm,
>  	struct drm_gpuva_op *op;
>  	u64 vmm_get_start = args ? args->addr : 0;
>  	u64 vmm_get_end = args ? args->addr + args->range : 0;
> +	u8 map_page_shift = 0;
>  	int ret;
>  
> +	/* A new mapping takes over the page tables of the mappings it replaces,
> +	 * so every one of them has to be using its page size. The new mapping
> +	 * is the last op drm_gpuvm_sm_map_ops_create() emits.
> +	 */
> +	if (args) {
> +		struct drm_gpuva_op *last = drm_gpuva_last_op(ops);
> +
> +		if (last->op == DRM_GPUVA_OP_MAP)
> +			map_page_shift = select_page_shift(uvmm, &last->map);

[Severity: High]
Does this call to select_page_shift() introduce a Use-After-Free (UAF) due to
lockless resource access?

In nouveau_uvmm_bind_job_submit(), the map prepare sequence is called before
drm_exec_until_all_locked() acquires the GEM objects' dma_resv locks:

drivers/gpu/drm/nouveau/nouveau_uvmm.c:nouveau_uvmm_bind_job_submit() {
    ...
    ret = nouveau_uvmm_sm_map_prepare(uvmm, &op->new,
                                      reg, op->ops,
                                      op->va.addr,
                                      op->va.range,
                                      op->flags & 0xff);
    ...
}

Inside select_page_shift(), the code accesses nvbo->bo.resource and dereferences
its properties without the dma_resv_lock held:

drivers/gpu/drm/nouveau/nouveau_uvmm.c:select_page_shift() {
    ...
    struct nouveau_mem *mem = nouveau_mem(nvbo->bo.resource);
    struct nvif_vmm *vmm = &uvmm->vmm.vmm;
    ...
        /* Skip incompatible domains. */
        if ((mem->mem.type & NVIF_MEM_VRAM) && !vmm->page[i].vram)
            continue;
    ...
}

Because the dma_resv lock is not held during this preparation phase, TTM can
concurrently evict or move the BO, freeing the old ttm_resource (and its
wrapping nouveau_mem structure).

This could leave a dangling pointer and cause a UAF when accessing
mem->mem.type, potentially leading to a kernel panic or privilege escalation.

> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009-nouveau-fixes-v2-1-a0b71bf8df1b@outlook.com?part=1