Re: [PATCH 3/3] drm/ttm: check for NULL resource in ttm_bo_vm_fault_reserved()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] drm/xe/oa: missing vm_pgoff check in xe_oa_mmap() [1]
--

commit e95d22b6c456f4e471c0ed18ffb86dc352011af3
Author: Harsh Parmar <kaii02ctf@gmail.com>

drm/ttm: check for NULL resource in ttm_bo_vm_fault_reserved()

This commit adds a NULL check on bo->resource in ttm_bo_vm_fault_reserved()
and returns VM_FAULT_SIGBUS when a buffer object has no backing store.

> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> index 872bf444b1f0f..69dd6bdd54022 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> @@ -205,6 +205,9 @@ vm_fault_t ttm_bo_vm_fault_reserved(struct vm_fault *vmf,
>  	if (unlikely(ret != 0))
>  		return ret;
>  
> +	if (unlikely(!bo->resource))
> +		return VM_FAULT_SIGBUS;
> +
>  	err = ttm_mem_io_reserve(bo->bdev, bo->resource);
>  	if (unlikely(err != 0))
>  		return VM_FAULT_SIGBUS;

[Severity: Critical]
This problem wasn't introduced by this patch, but can the prefault loop in
ttm_bo_vm_fault_reserved() read past the end of ttm->pages[] [1] when a
VMA has a non-zero vm_pgoff?

drivers/gpu/drm/ttm/ttm_bo_vm.c:ttm_bo_vm_fault_reserved() {
	...
	page_offset = linear_page_index(vma, address) -
		drm_vma_node_start(&bo->base.vma_node);
	page_last = vma_end_pgoff(vma) -
		drm_vma_node_start(&bo->base.vma_node);

	if (unlikely(page_offset >= PFN_UP(bo->base.size)))
		return VM_FAULT_SIGBUS;
	...
	for (i = 0; i < num_prefault; ++i) {
		if (bo->resource->bus.is_iomem) {
			pfn = ttm_bo_io_mem_pfn(bo, page_offset);
		} else {
			page = ttm->pages[page_offset];
			...
			pfn = page_to_pfn(page);
		}
		...
		ret = vmf_insert_pfn_prot(vma, address, pfn, prot);
		...
		address += PAGE_SIZE;
		if (unlikely(++page_offset >= page_last))
			break;
	}
}

For example, xe_oa_mmap() checks that the VMA size equals xe_bo_size(bo)
before calling drm_gem_mmap_obj(), but neither checks nor zeroes
vma->vm_pgoff.  Because stream->oa_buffer.bo is a ttm_bo_type_kernel object,
drm_vma_node_start(&bo->base.vma_node) is 0 and page_last becomes
vma->vm_pgoff + PFN_UP(bo->base.size).  A fault near the end of the buffer
passes the initial PFN_UP(bo->base.size) check, and the prefault loop then
steps page_offset past PFN_UP(bo->base.size) toward page_last, dereferencing
out-of-bounds ttm->pages[] entries or mapping out-of-bounds PFNs into
userspace.

[1] https://sashiko.dev/#/bug/linux-d5cc9df6-b93b-44e4-8837-59f1909411f7

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109202330.1816799-1-harshicon28@gmail.com?part=3