[PATCH 0/6] drm: reject empty TTM range manager sizes

[PATCH 0/6] drm: reject empty TTM range manager sizes

[Jiale Yao]

drm_mm_init() rejects a zero-length allocation range with a BUG check.
Several DRM TTM users can derive a zero page count from device-provided
VRAM metadata and pass it to the range manager.

This series rejects empty ranges at the affected callers and adds a
defensive check in the common range manager. Patches 1 through 4 and
6 validate the individual driver inputs. Patch 5 protects the shared
range-manager API against any remaining zero-page caller.

The series was checked with scripts/checkpatch.pl for every code patch.

Jiale Yao (6):
  drm/vram-helper: reject empty VRAM ranges
  drm/nouveau: reject empty VRAM ranges
  drm/qxl: reject empty TTM memory ranges
  drm/radeon: reject empty VRAM ranges
  drm/ttm: reject empty range manager sizes
  drm/vmwgfx: reject empty VRAM ranges

 drivers/gpu/drm/drm_gem_vram_helper.c   | 3 +++
 drivers/gpu/drm/nouveau/nouveau_ttm.c   | 3 +++
 drivers/gpu/drm/qxl/qxl_ttm.c           | 3 +++
 drivers/gpu/drm/radeon/radeon_ttm.c     | 3 +++
 drivers/gpu/drm/ttm/ttm_range_manager.c | 3 +++
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.c     | 4 ++++
 6 files changed, 19 insertions(+)

-- 
2.34.1

[PATCH 1/6] drm/vram-helper: reject empty VRAM ranges

[Jiale Yao]

A VRAM range smaller than a page becomes a zero-page TTM range and
causes drm_mm_init() to hit its zero-range BUG check. Reject such
ranges before initializing the TTM device.

Fixes: 37205891d84f ("drm/ttm: make ttm_range_man_init/takedown take type + args")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/gpu/drm/drm_gem_vram_helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c b/drivers/gpu/drm/drm_gem_vram_helper.c
index bca802ccddee..f8bf2d002236 100644
--- a/drivers/gpu/drm/drm_gem_vram_helper.c
+++ b/drivers/gpu/drm/drm_gem_vram_helper.c
@@ -851,6 +851,9 @@ static int drm_vram_mm_init(struct drm_vram_mm *vmm, struct drm_device *dev,
 {
 	int ret;
 
+	if (vram_size < PAGE_SIZE)
+		return -EINVAL;
+
 	vmm->vram_base = vram_base;
 	vmm->vram_size = vram_size;
 
-- 
2.34.1

[PATCH 2/6] drm/nouveau: reject empty VRAM ranges

[Jiale Yao]

A VRAM range smaller than a page becomes a zero-page TTM range and
causes drm_mm_init() to hit its zero-range BUG check. Reject it before
creating the VRAM manager.

Fixes: 37205891d84f ("drm/ttm: make ttm_range_man_init/takedown take type + args")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/gpu/drm/nouveau/nouveau_ttm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
index cfc0868e2dd3..99c74c3b5976 100644
--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -181,6 +181,9 @@ nouveau_ttm_init_host(struct nouveau_drm *drm, u8 kind)
 static int
 nouveau_ttm_init_vram(struct nouveau_drm *drm)
 {
+	if (drm->gem.vram_available < PAGE_SIZE)
+		return -EINVAL;
+
 	if (drm->client.device.info.family >= NV_DEVICE_INFO_V0_TESLA) {
 		struct ttm_resource_manager *man = kzalloc_obj(*man);
 
-- 
2.34.1

[PATCH 3/6] drm/qxl: reject empty TTM memory ranges

[Jiale Yao]

A zero page count passed to the range manager reaches drm_mm_init()
and causes its zero-range BUG check to fire. Reject empty memory
ranges before initializing the manager.

Fixes: 37205891d84f ("drm/ttm: make ttm_range_man_init/takedown take type + args")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/gpu/drm/qxl/qxl_ttm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
index 5d495c4798a3..c8cda805b645 100644
--- a/drivers/gpu/drm/qxl/qxl_ttm.c
+++ b/drivers/gpu/drm/qxl/qxl_ttm.c
@@ -185,6 +185,9 @@ static int qxl_ttm_init_mem_type(struct qxl_device *qdev,
 				 unsigned int type,
 				 uint64_t size)
 {
+	if (!size)
+		return -EINVAL;
+
 	return ttm_range_man_init(&qdev->mman.bdev, type, false, size);
 }
 
-- 
2.34.1

[PATCH 4/6] drm/radeon: reject empty VRAM ranges

[Jiale Yao]

A VRAM size smaller than a page becomes a zero-page TTM range and
causes drm_mm_init() to hit its zero-range BUG check. Reject such a
range before initializing the VRAM manager.

Fixes: 37205891d84f ("drm/ttm: make ttm_range_man_init/takedown take type + args")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/gpu/drm/radeon/radeon_ttm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index e7ab8162ac69..925593af1688 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -69,6 +69,9 @@ struct radeon_device *radeon_get_rdev(struct ttm_device *bdev)
 
 static int radeon_ttm_init_vram(struct radeon_device *rdev)
 {
+	if (rdev->mc.real_vram_size < PAGE_SIZE)
+		return -EINVAL;
+
 	return ttm_range_man_init(&rdev->mman.bdev, TTM_PL_VRAM,
 				  false, rdev->mc.real_vram_size >> PAGE_SHIFT);
 }
-- 
2.34.1

[PATCH 5/6] drm/ttm: reject empty range manager sizes

[Jiale Yao]

A zero page count reaches drm_mm_init() and causes its zero-range BUG
check to fire. Return an error before allocating and installing the
range manager.

Fixes: 77ef8bbc87be ("drm: make drm_mm_init() return void")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/gpu/drm/ttm/ttm_range_manager.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/ttm/ttm_range_manager.c b/drivers/gpu/drm/ttm/ttm_range_manager.c
index b818836f0726..5fd484ae1706 100644
--- a/drivers/gpu/drm/ttm/ttm_range_manager.c
+++ b/drivers/gpu/drm/ttm/ttm_range_manager.c
@@ -184,6 +184,9 @@ int ttm_range_man_init_nocheck(struct ttm_device *bdev,
 	struct ttm_resource_manager *man;
 	struct ttm_range_manager *rman;
 
+	if (!p_size)
+		return -EINVAL;
+
 	rman = kzalloc_obj(*rman);
 	if (!rman)
 		return -ENOMEM;
-- 
2.34.1

[PATCH 6/6] drm/vmwgfx: reject empty VRAM ranges

[Jiale Yao]

A VRAM size smaller than a page becomes a zero-page TTM range and
causes drm_mm_init() to hit its zero-range BUG check. Reject such a
range before creating the VRAM manager.

Fixes: 37205891d84f ("drm/ttm: make ttm_range_man_init/takedown take type + args")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 0f101aedb49a..33284a776fa6 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -692,6 +692,10 @@ static int vmw_dma_masks(struct vmw_private *dev_priv)
 static int vmw_vram_manager_init(struct vmw_private *dev_priv)
 {
 	int ret;
+
+	if (dev_priv->vram_size < PAGE_SIZE)
+		return -EINVAL;
+
 	ret = ttm_range_man_init(&dev_priv->bdev, TTM_PL_VRAM, false,
 				 dev_priv->vram_size >> PAGE_SHIFT);
 	ttm_resource_manager_set_used(ttm_manager_type(&dev_priv->bdev, TTM_PL_VRAM), false);
-- 
2.34.1

Re: [PATCH 0/6] drm: reject empty TTM range manager sizes

[Christian König]

On 10/19/26 10:41, Jiale Yao wrote:
> drm_mm_init() rejects a zero-length allocation range with a BUG check.
> Several DRM TTM users can derive a zero page count from device-provided
> VRAM metadata and pass it to the range manager.

The BUG check is there to point out driver bugs which try to initialize a VRAM manager while no VRAM is installed.

That is intended behavior and returning an error instead of running into a BUG() makes that intended behavior go away and eventually cause more problems down the road.

So absolutely clear NAK to that.

Regards,
Christian.

> 
> This series rejects empty ranges at the affected callers and adds a
> defensive check in the common range manager. Patches 1 through 4 and
> 6 validate the individual driver inputs. Patch 5 protects the shared
> range-manager API against any remaining zero-page caller.
> 
> The series was checked with scripts/checkpatch.pl for every code patch.
> 
> Jiale Yao (6):
>   drm/vram-helper: reject empty VRAM ranges
>   drm/nouveau: reject empty VRAM ranges
>   drm/qxl: reject empty TTM memory ranges
>   drm/radeon: reject empty VRAM ranges
>   drm/ttm: reject empty range manager sizes
>   drm/vmwgfx: reject empty VRAM ranges
> 
>  drivers/gpu/drm/drm_gem_vram_helper.c   | 3 +++
>  drivers/gpu/drm/nouveau/nouveau_ttm.c   | 3 +++
>  drivers/gpu/drm/qxl/qxl_ttm.c           | 3 +++
>  drivers/gpu/drm/radeon/radeon_ttm.c     | 3 +++
>  drivers/gpu/drm/ttm/ttm_range_manager.c | 3 +++
>  drivers/gpu/drm/vmwgfx/vmwgfx_drv.c     | 4 ++++
>  6 files changed, 19 insertions(+)
> 

Re: [PATCH 4/6] drm/radeon: reject empty VRAM ranges

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/radeon: NULL pointer dereference in radeon_ttm_set_active_vram_size()
--

commit 5b48ce714a8da9ec1142b39b688fe2ea60f7c240
Author: Jiale Yao <yaojiale02@163.com>

drm/radeon: reject empty VRAM ranges

This commit rejects VRAM sizes smaller than a page in radeon_ttm_init_vram()
before calling ttm_range_man_init() to avoid hitting a zero-range BUG check
in drm_mm_init().

> diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
> index e7ab8162ac694..925593af1688b 100644
> --- a/drivers/gpu/drm/radeon/radeon_ttm.c
> +++ b/drivers/gpu/drm/radeon/radeon_ttm.c
> @@ -69,6 +69,9 @@ struct radeon_device *radeon_get_rdev(struct ttm_device *bdev)
>  
>  static int radeon_ttm_init_vram(struct radeon_device *rdev)
>  {
> +	if (rdev->mc.real_vram_size < PAGE_SIZE)
> +		return -EINVAL;
> +
>  	return ttm_range_man_init(&rdev->mman.bdev, TTM_PL_VRAM,
>  				  false, rdev->mc.real_vram_size >> PAGE_SHIFT);
>  }

[Severity: High]
Can returning -EINVAL here lead to a NULL pointer dereference in
radeon_ttm_set_active_vram_size() during error teardown?

In drivers/gpu/drm/radeon/radeon_ttm.c, radeon_ttm_init() sets
rdev->mman.initialized = true before calling radeon_ttm_init_vram():

drivers/gpu/drm/radeon/radeon_ttm.c:radeon_ttm_init() {
	...
	rdev->mman.initialized = true;

	r = radeon_ttm_init_vram(rdev);
	if (r) {
		DRM_ERROR("Failed initializing VRAM heap.\n");
		return r;
	}
	...
}

When rdev->mc.real_vram_size < PAGE_SIZE, radeon_ttm_init_vram() now
returns -EINVAL before ttm_range_man_init() registers the TTM_PL_VRAM
manager, leaving rdev->mman.initialized set to true while the TTM_PL_VRAM
manager slot remains NULL.

As the error propagates up through radeon_bo_init() -> rdev->asic->init() ->
radeon_device_init() to radeon_driver_load_kms(), error cleanup calls
radeon_driver_unload_kms() -> radeon_device_fini() -> radeon_fini().

The ASIC .fini callbacks (such as r100_fini(), r600_fini(), and cik_fini())
stop the CP/DMA engines before calling radeon_bo_fini(), which invokes
radeon_ttm_set_active_vram_size() (for example via r100_cp_fini() ->
r100_cp_disable()):

drivers/gpu/drm/radeon/radeon_ttm.c:radeon_ttm_set_active_vram_size() {
	struct ttm_resource_manager *man;

	if (!rdev->mman.initialized)
		return;

	man = ttm_manager_type(&rdev->mman.bdev, TTM_PL_VRAM);
	/* this just adjusts TTM size idea, which sets lpfn to the correct value */
	man->size = size >> PAGE_SHIFT;
}

Because rdev->mman.initialized is true, wouldn't this bypass the early
return and dereference a NULL man pointer (and also abort teardown before
radeon_bo_fini() and radeon_ttm_fini() can clean up the initialized
ttm_device)?

Should radeon_ttm_init() only set rdev->mman.initialized = true after
initialization succeeds (or clean up ttm_device_fini() on failure), or
should radeon_ttm_set_active_vram_size() also check if man is NULL?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019084138.1821477-1-yaojiale02@163.com?part=4

Re: [PATCH 3/6] drm/qxl: reject empty TTM memory ranges

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/qxl: missing TTM cleanup in qxl_ttm_init() on empty range error
--

commit f2a15ffcd9fd6a825e636790b113ef7e9cbc5bb0
Author: Jiale Yao <yaojiale02@163.com>

drm/qxl: reject empty TTM memory ranges

This commit adds a zero-size check to qxl_ttm_init_mem_type() so that empty
memory ranges return -EINVAL before reaching ttm_range_man_init() and
triggering a zero-range check in drm_mm_init().

> diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
> index 5d495c4798a35..c8cda805b6451 100644
> --- a/drivers/gpu/drm/qxl/qxl_ttm.c
> +++ b/drivers/gpu/drm/qxl/qxl_ttm.c
> @@ -185,6 +185,9 @@ static int qxl_ttm_init_mem_type(struct qxl_device *qdev,
>  				 unsigned int type,
>  				 uint64_t size)
>  {
> +	if (!size)
> +		return -EINVAL;
> +
>  	return ttm_range_man_init(&qdev->mman.bdev, type, false, size);
>  }

[Severity: High]
When qxl_ttm_init_mem_type() returns -EINVAL on a zero-page VRAM or Surfaces
range during qxl_pci_probe() -> qxl_device_init() -> qxl_bo_init() ->
qxl_ttm_init(), does qxl_ttm_init() leave qdev->mman.bdev initialized without
cleaning it up?

In drivers/gpu/drm/qxl/qxl_ttm.c, qxl_ttm_init() initializes the TTM device
before calling qxl_ttm_init_mem_type(), and returns directly on failure:

drivers/gpu/drm/qxl/qxl_ttm.c:qxl_ttm_init() {
	r = ttm_device_init(&qdev->mman.bdev, &qxl_bo_driver, NULL,
			    qdev->ddev.anon_inode->i_mapping,
			    qdev->ddev.vma_offset_manager,
			    0);
	if (r) {
		DRM_ERROR("failed initializing buffer object driver(%d).\n", r);
		return r;
	}
	/* NOTE: this includes the framebuffer (aka surface 0) */
	num_io_pages = qdev->rom->ram_header_offset / PAGE_SIZE;
	r = qxl_ttm_init_mem_type(qdev, TTM_PL_VRAM, num_io_pages);
	if (r) {
		DRM_ERROR("Failed initializing VRAM heap.\n");
		return r;
	}
	r = qxl_ttm_init_mem_type(qdev, TTM_PL_PRIV,
				  qdev->surfaceram_size / PAGE_SIZE);
	if (r) {
		DRM_ERROR("Failed initializing Surfaces heap.\n");
		return r;
	}
	...
}

In the caller qxl_device_init() in drivers/gpu/drm/qxl/qxl_kms.c, a failure in
qxl_bo_init() jumps to rom_unmap before qdev->gc_work is initialized, so
neither the error path nor qxl_device_fini() during devm release calls
qxl_bo_fini() / qxl_ttm_fini().

Because ttm_device_init() links &qdev->mman.bdev.device_list into the global
ttm_glob.device_list, won't returning here without calling
ttm_range_man_fini(&qdev->mman.bdev, TTM_PL_VRAM) (if the second call fails)
and ttm_device_fini(&qdev->mman.bdev) leak bdev->wq, bdev->pool, and the
TTM_PL_VRAM range manager, while leaving a dangling pointer in
ttm_glob.device_list after qdev is freed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019084138.1821477-1-yaojiale02@163.com?part=3

Re: [PATCH 2/6] drm/nouveau: reject empty VRAM ranges

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Critical] drm/nouveau: UAF and leaks in nouveau_ttm_init() on vram init failure
- [High] drm/nouveau: broken probe on VRAM-less SoCs in nouveau_ttm_init_vram()
--

commit 51b3731f82a143b12828ab1838f6ea352d2d1ef2
Author: Jiale Yao <yaojiale02@163.com>

drm/nouveau: reject empty VRAM ranges

This commit rejects VRAM sizes smaller than PAGE_SIZE in
nouveau_ttm_init_vram() to avoid passing a zero-page range to drm_mm_init().

> diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
> index ad01f922aa86a..6f8728f433645 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
> @@ -180,6 +180,9 @@ nouveau_ttm_init_host(struct nouveau_drm *drm, u8 kind)
>  static int
>  nouveau_ttm_init_vram(struct nouveau_drm *drm)
>  {
> +	if (drm->gem.vram_available < PAGE_SIZE)
> +		return -EINVAL;
> +
>  	if (drm->client.device.info.family >= NV_DEVICE_INFO_V0_TESLA) {
>  		struct ttm_resource_manager *man = kzalloc_obj(*man);
>  

[Severity: High]
Does placing this check before the family >= NV_DEVICE_INFO_V0_TESLA branch
break probe on VRAM-less Tegra SoC GPUs (such as GK20A, GM20B, GP10B, and
GV11B)?

On those platforms, fb->ram is NULL, so nvkm_udevice_info() sets ram_size and
ram_user to 0:

drivers/gpu/drm/nouveau/nvkm/engine/device/user.c:nvkm_udevice_info() {
	...
	if (fb && fb->ram)
		args->v0.ram_size = args->v0.ram_user = fb->ram->size;
	else
		args->v0.ram_size = args->v0.ram_user = 0;
	...
}

In nouveau_ttm_init(), drm->gem.vram_available is set to ram_user (0). For
family >= NV_DEVICE_INFO_V0_TESLA, nouveau_ttm_init_vram() does not call
ttm_range_man_init() or drm_mm_init(); instead it initializes
nouveau_vram_manager, which handles zero-VRAM devices in
nouveau_vram_manager_new():

drivers/gpu/drm/nouveau/nouveau_ttm.c:nouveau_vram_manager_new() {
	...
	if (drm->client.device.info.ram_size == 0)
		return -ENOMEM;
	...
}

Only the else branch (family < NV_DEVICE_INFO_V0_TESLA) calls
ttm_range_man_init(). Should this check only apply to that branch?

[Severity: Critical]
Also, when nouveau_ttm_init_vram() returns an error here, can this cause a
use-after-free of drm->ttm.bdev.device_list as well as leak bdev->wq,
bdev->pool, the ttm_glob reference, and the arch_io_reserve_memtype_wc()
reservation?

In nouveau_ttm_init(), ttm_device_init() and arch_io_reserve_memtype_wc() are
called before nouveau_ttm_init_vram():

drivers/gpu/drm/nouveau/nouveau_ttm.c:nouveau_ttm_init() {
	...
	ret = ttm_device_init(&drm->ttm.bdev, ...);
	if (ret) {
		NV_ERROR(drm, "error initialising bo driver, %d\n", ret);
		return ret;
	}

	/* VRAM init */
	drm->gem.vram_available = drm->client.device.info.ram_user;

	arch_io_reserve_memtype_wc(device->func->resource_addr(device, NVKM_BAR1_FB),
				   device->func->resource_size(device, NVKM_BAR1_FB));

	ret = nouveau_ttm_init_vram(drm);
	if (ret) {
		NV_ERROR(drm, "VRAM mm init failed, %d\n", ret);
		return ret;
	}
	...
}

ttm_device_init() links &bdev->device_list into the global
ttm_glob.device_list. When nouveau_ttm_init() fails,
nouveau_drm_device_init() jumps to fail_ttm (skipping nouveau_ttm_fini()),
and nouveau_drm_device_del() frees drm without calling ttm_device_fini() or
arch_io_free_memtype_wc().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019084138.1821477-1-yaojiale02@163.com?part=2