[PATCH v3 0/4] Add vm_bind param check to ensure no overlap with kbo AS carveout

[PATCH v3 0/4] Add vm_bind param check to ensure no overlap with kbo AS carveout

[Adrián Larumbe]

Just a quick check to make sure user-supplied vm_bind regions aren't
clashing with the region reserved for kernel bo's.

I tried to introduce a similar check for panthor_vm_alloc_va(), to throw
back an error when mappings of kernel bo's against specific addresses fall
within the auto_va region. However that is not possible, since there's one
FW region that must be mapped right at CSF_MCU_SHARED_REGION_START. That
is usually not a problem, since drm_mm_insert_node_in_range() will pick
the next one available.

v3 also comes with an early bind range overflow check for sparse mappings.

Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
---
Changes in v3:
- Fixed off-by-one error for user va range calculations.
- Added new commit for panthor_vm_prepare_unmap_op_ctx to take a whole operation.
- Added commit with bind range early overflow check.
- Link to v2: https://patch.msgid.link/20260619-vm_bind_checks-v2-0-b51abab35f71@collabora.com

Changes in v2:
- Simplified user VA range with kernel BO range overlap to a single statement.
- Link to v1: https://patch.msgid.link/20260616-vm_bind_checks-v1-0-956198602ae3@collabora.com

To: Boris Brezillon <boris.brezillon@collabora.com>
To: Steven Price <steven.price@arm.com>
To: Liviu Dudau <liviu.dudau@arm.com>
To: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
To: Maxime Ripard <mripard@kernel.org>
To: Thomas Zimmermann <tzimmermann@suse.de>
To: David Airlie <airlied@gmail.com>
To: Simona Vetter <simona@ffwll.ch>
To: Heiko Stuebner <heiko@sntech.de>
To: Grant Likely <grant.likely@linaro.org>
To: Adrián Larumbe <adrian.larumbe@collabora.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org

---
Adrián Larumbe (4):
      drm/panthor: Add vm_bind region with kbo range overlap check
      drm/panthor: Fix comment to reflect actual struct field name
      drm/panthor: Have prepare_unmap_op_ctx receive a whole vm_bind op
      drm/panthor: Check for sparse binding range overflow

 drivers/gpu/drm/panthor/panthor_mmu.c | 42 +++++++++++++++++++++++++++--------
 1 file changed, 33 insertions(+), 9 deletions(-)
---
base-commit: 8fca3d8dbebf8d960dad7b10db3cb4a61139454b
change-id: 20260614-vm_bind_checks-46075ba069a0

Best regards,
--  
Adrián Larumbe <adrian.larumbe@collabora.com>

[PATCH v3 1/4] drm/panthor: Add vm_bind region with kbo range overlap check

[Adrián Larumbe]

When a VM is created, caller has to specify the range of the address space
carve-out set aside for mapping kernel BO's. That means vm_bind mappings of
UM-exposed BO's should not intersect with that region, but at the moment
we're not checking this.

At first, I thought of giving these values to drm_gpuvm_init() through its
reserve_{offset, range} arguments, but it turns out that is meant for VM
address spans that are not managed through the usual drm_gpuvm split/merge
circuit, so storing the end of the user VA range at VM creation time and
doing a quick check in the vm_bind ioctl path was the simplest workaround.

Fixes: tag and reference the relevant sparse binding support commit.
Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block")
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
---
 drivers/gpu/drm/panthor/panthor_mmu.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
index 31cc57029c12..94789777aac4 100644
--- a/drivers/gpu/drm/panthor/panthor_mmu.c
+++ b/drivers/gpu/drm/panthor/panthor_mmu.c
@@ -310,6 +310,9 @@ struct panthor_vm {
 		u64 end;
 	} kernel_auto_va;
 
+	/** @user_va_range: Upper boundary of VAs VM users can map objects against. */
+	u64 user_va_range;
+
 	/** @as: Address space related fields. */
 	struct {
 		/**
@@ -2893,6 +2896,8 @@ panthor_vm_create(struct panthor_device *ptdev, bool for_mcu,
 		va_range = full_va_range;
 	}
 
+	vm->user_va_range = kernel_va_start;
+
 	mutex_init(&vm->mm_lock);
 	drm_mm_init(&vm->mm, kernel_va_start, kernel_va_size);
 	vm->kernel_auto_va.start = auto_kernel_va_start;
@@ -2981,6 +2986,10 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file,
 	if (!IS_ALIGNED(op->va | op->size | op->bo_offset, vm_pgsz))
 		return -EINVAL;
 
+	/* We don't allow mappings that overlap with kbo's reserved range */
+	if (op->va + op->size > vm->user_va_range)
+		return -EINVAL;
+
 	switch (op->flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) {
 	case DRM_PANTHOR_VM_BIND_OP_TYPE_MAP:
 		if (!(op->flags & DRM_PANTHOR_VM_BIND_OP_MAP_SPARSE)) {

-- 
2.54.0

[PATCH v3 2/4] drm/panthor: Fix comment to reflect actual struct field name

[Adrián Larumbe]

The mismatch would pop up when building the kernel with W=1.

Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
---
 drivers/gpu/drm/panthor/panthor_mmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
index 94789777aac4..48aa23573cd6 100644
--- a/drivers/gpu/drm/panthor/panthor_mmu.c
+++ b/drivers/gpu/drm/panthor/panthor_mmu.c
@@ -306,7 +306,7 @@ struct panthor_vm {
 		/** @kernel_auto_va.start: Start of the automatic VA-range for kernel BOs. */
 		u64 start;
 
-		/** @kernel_auto_va.size: Size of the automatic VA-range for kernel BOs. */
+		/** @kernel_auto_va.end: End of the automatic VA-range for kernel BOs. */
 		u64 end;
 	} kernel_auto_va;
 

-- 
2.54.0

[PATCH v3 3/4] drm/panthor: Have prepare_unmap_op_ctx receive a whole vm_bind op

[Adrián Larumbe]

This change was already enforced for panthor_vm_prepare_map_op_ctx. In a
future commit, access to the drm_panthor_vm_bind_op flags will be needed
inside panthor_vm_prepare_unmap_op_ctx, so rather than expanding the
parameter list, simply pass the operation struct instead.

Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
---
 drivers/gpu/drm/panthor/panthor_mmu.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
index 48aa23573cd6..77fdad4e5166 100644
--- a/drivers/gpu/drm/panthor/panthor_mmu.c
+++ b/drivers/gpu/drm/panthor/panthor_mmu.c
@@ -1416,24 +1416,24 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
 
 static int panthor_vm_prepare_unmap_op_ctx(struct panthor_vm_op_ctx *op_ctx,
 					   struct panthor_vm *vm,
-					   u64 va, u64 size)
+					   const struct drm_panthor_vm_bind_op *op)
 {
 	u32 pt_count = 0;
 	int ret;
 
 	memset(op_ctx, 0, sizeof(*op_ctx));
-	op_ctx->va.range = size;
-	op_ctx->va.addr = va;
+	op_ctx->va.range = op->size;
+	op_ctx->va.addr = op->va;
 	op_ctx->flags = DRM_PANTHOR_VM_BIND_OP_TYPE_UNMAP;
 
 	/* Pre-allocate L3 page tables to account for the split-2M-block
 	 * situation on unmap.
 	 */
-	if (va != ALIGN(va, SZ_2M))
+	if (op->va != ALIGN(op->va, SZ_2M))
 		pt_count++;
 
-	if (va + size != ALIGN(va + size, SZ_2M) &&
-	    ALIGN(va + size, SZ_2M) != ALIGN(va, SZ_2M))
+	if (op->va + op->size != ALIGN(op->va + op->size, SZ_2M) &&
+	    ALIGN(op->va + op->size, SZ_2M) != ALIGN(op->va, SZ_2M))
 		pt_count++;
 
 	ret = panthor_vm_op_ctx_prealloc_vmas(op_ctx);
@@ -3012,7 +3012,7 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file,
 		if (op->bo_handle || op->bo_offset)
 			return -EINVAL;
 
-		return panthor_vm_prepare_unmap_op_ctx(op_ctx, vm, op->va, op->size);
+		return panthor_vm_prepare_unmap_op_ctx(op_ctx, vm, op);
 
 	case DRM_PANTHOR_VM_BIND_OP_TYPE_SYNC_ONLY:
 		if (op->flags & ~DRM_PANTHOR_VM_BIND_OP_TYPE_MASK)
@@ -3232,10 +3232,14 @@ int panthor_vm_map_bo_range(struct panthor_vm *vm, struct panthor_gem_object *bo
  */
 int panthor_vm_unmap_range(struct panthor_vm *vm, u64 va, u64 size)
 {
+	struct drm_panthor_vm_bind_op op = {
+		.size = size,
+		.va = va,
+	};
 	struct panthor_vm_op_ctx op_ctx;
 	int ret;
 
-	ret = panthor_vm_prepare_unmap_op_ctx(&op_ctx, vm, va, size);
+	ret = panthor_vm_prepare_unmap_op_ctx(&op_ctx, vm, &op);
 	if (ret)
 		return ret;
 

-- 
2.54.0

[PATCH v3 4/4] drm/panthor: Check for sparse binding range overflow

[Adrián Larumbe]

This check is being already carried out further down the call stack inside
drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to fail early in
the driver before GPUVM functions are invoked so that we won't waste time
allocating vm_bind context resources.

Reported-by: Sashiko <noreply@sashiko.dev>
Closes: https://sashiko.dev/#/message/20260623204220.CDB1B1F000E9%40smtp.kernel.org
Fixes: 12cf826bf1dd ("drm/panthor: Support sparse mappings")
Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
---
 drivers/gpu/drm/panthor/panthor_mmu.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
index 77fdad4e5166..8bd9b975e5ce 100644
--- a/drivers/gpu/drm/panthor/panthor_mmu.c
+++ b/drivers/gpu/drm/panthor/panthor_mmu.c
@@ -1328,6 +1328,7 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
 	struct drm_gpuvm_bo *preallocated_vm_bo;
 	struct sg_table *sgt = NULL;
 	int ret;
+	u64 end;
 
 	if (!bo)
 		return -EINVAL;
@@ -1353,6 +1354,10 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
 	if (is_sparse && (op->bo_handle || op->bo_offset))
 		return -EINVAL;
 
+	/* Protect against sparse VA range overflow */
+	if (is_sparse && check_add_overflow(op->va, op->size, &end))
+		return -EINVAL;
+
 	/* If the BO has an exclusive VM attached, it can't be mapped to other VMs. */
 	if (bo->exclusive_vm_root_gem &&
 	    bo->exclusive_vm_root_gem != panthor_vm_root_gem(vm))
@@ -1418,7 +1423,9 @@ static int panthor_vm_prepare_unmap_op_ctx(struct panthor_vm_op_ctx *op_ctx,
 					   struct panthor_vm *vm,
 					   const struct drm_panthor_vm_bind_op *op)
 {
+	bool is_sparse = op->flags & DRM_PANTHOR_VM_BIND_OP_MAP_SPARSE;
 	u32 pt_count = 0;
+	u64 end;
 	int ret;
 
 	memset(op_ctx, 0, sizeof(*op_ctx));
@@ -1432,6 +1439,10 @@ static int panthor_vm_prepare_unmap_op_ctx(struct panthor_vm_op_ctx *op_ctx,
 	if (op->va != ALIGN(op->va, SZ_2M))
 		pt_count++;
 
+	/* Protect against sparse VA range overflow */
+	if (is_sparse && check_add_overflow(op->va, op->size, &end))
+		return -EINVAL;
+
 	if (op->va + op->size != ALIGN(op->va + op->size, SZ_2M) &&
 	    ALIGN(op->va + op->size, SZ_2M) != ALIGN(op->va, SZ_2M))
 		pt_count++;

-- 
2.54.0

Re: [PATCH v3 4/4] drm/panthor: Check for sparse binding range overflow

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

New issues:
- [Low] The newly added overflow check in `panthor_vm_prepare_unmap_op_ctx` is mathematically dead code because the `MAP_SPARSE` flag is explicitly rejected for UNMAP operations.
- [Low] The overflow check in `panthor_vm_prepare_map_op_ctx` is artificially restricted to sparse mappings, bypassing early protection for non-sparse mappings.

Pre-existing issues:
- [High] Unbounded sparse mappings allow unprivileged users to instantly consume massive amounts of un-accounted kernel memory, causing system-wide OOM (Denial of Service).
--

commit 5e16f4b93a1093aa035900789a27182078dc6a8d
Author: Adrián Larumbe <adrian.larumbe@collabora.com>

drm/panthor: Check for sparse binding range overflow

This commit adds checks to prevent sparse binding range overflows early in
the driver before GPUVM functions are invoked. This avoids wasting time
allocating vm_bind context resources.

Closes: https://sashiko.dev/#/message/20260623204220.CDB1B1F000E9%40smtp.kernel.org
Fixes: 12cf826bf1dd ("drm/panthor: Support sparse mappings")

> diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
> index 77fdad4e51665..8bd9b975e5ce2 100644
> --- a/drivers/gpu/drm/panthor/panthor_mmu.c
> +++ b/drivers/gpu/drm/panthor/panthor_mmu.c

[ ... ]

> @@ -1353,6 +1354,10 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
>  	if (is_sparse && (op->bo_handle || op->bo_offset))
>  		return -EINVAL;
>  
> +	/* Protect against sparse VA range overflow */
> +	if (is_sparse && check_add_overflow(op->va, op->size, &end))
> +		return -EINVAL;
> +

[Severity: Low]
Is this overflow check artificially restricted to sparse mappings?

If a non-sparse mapping request overflows the 64-bit bounds, the wrapped sum
bypasses the vm->user_va_range check and misses this new early check. The
driver will needlessly pin the BO and pre-allocate context resources before
safely failing downstream in drm_gpuvm_sm_map().

Would dropping the is_sparse condition here correctly fail early for both
sparse and non-sparse mappings?

[Severity: High]
This is a pre-existing issue, but does the lack of accounting on pt_cache
allow untrusted users to cause a system-wide OOM?

When a user submits a sparse mapping request with a massive size (e.g., 512GB)
and va = 0, it skips the backing GEM size validations. In
panthor_vm_op_ctx_prealloc_pts(), pt_count is calculated assuming the entire
range needs full L1-L3 page tables:

drivers/gpu/drm/panthor/panthor_mmu.c:panthor_vm_op_ctx_prealloc_pts() {
    ...
    ret = kmem_cache_alloc_bulk(pt_cache, GFP_KERNEL, pt_count,
                                op_ctx->rsvd_page_tables.pages);
    ...
}

Because pt_cache is created without the SLAB_ACCOUNT flag:

drivers/gpu/drm/panthor/panthor_mmu.c:panthor_mmu_pt_cache_init() {
    pt_cache = kmem_cache_create("panthor-mmu-pt", SZ_4K, SZ_4K, 0, NULL);
    ...
}

Can a local user execute this ioctl concurrently in a loop, draining tens of
gigabytes of memory that remain invisible to cgroup limits, to crash the host?

>  	/* If the BO has an exclusive VM attached, it can't be mapped to other VMs. */
>  	if (bo->exclusive_vm_root_gem &&
>  	    bo->exclusive_vm_root_gem != panthor_vm_root_gem(vm))

[ ... ]

> @@ -1432,6 +1439,10 @@ static int panthor_vm_prepare_unmap_op_ctx(struct panthor_vm_op_ctx *op_ctx,
>  	if (op->va != ALIGN(op->va, SZ_2M))
>  		pt_count++;
>  
> +	/* Protect against sparse VA range overflow */
> +	if (is_sparse && check_add_overflow(op->va, op->size, &end))
> +		return -EINVAL;
> +

[Severity: Low]
Is this overflow check mathematically dead code?

In panthor_vm_bind_prepare_op_ctx(), any UNMAP operation containing flags
outside of DRM_PANTHOR_VM_BIND_OP_TYPE_MASK (which includes MAP_SPARSE) is
explicitly rejected with -EINVAL.

Because of this, is_sparse will evaluate to false unconditionally for UNMAP
operations, causing this check to always be skipped.

>  	if (op->va + op->size != ALIGN(op->va + op->size, SZ_2M) &&
>  	    ALIGN(op->va + op->size, SZ_2M) != ALIGN(op->va, SZ_2M))
>  		pt_count++;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629-vm_bind_checks-v3-0-85e6740f6c2e@collabora.com?part=4

Re: [PATCH v3 1/4] drm/panthor: Add vm_bind region with kbo range overlap check

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Page table bulk allocations for VM bindings are not accounted to the requesting process's memcg, allowing an unprivileged user to easily exhaust system memory and trigger an Out-Of-Memory (OOM) panic via huge sparse mappings.
--

commit 4e78b0100b6b8317cc7157628ece362a9c968f70
Author: Adrián Larumbe <adrian.larumbe@collabora.com>

drm/panthor: Add vm_bind region with kbo range overlap check

When a VM is created, caller has to specify the range of the address space
carve-out set aside for mapping kernel BO's. This patch ensures that vm_bind
mappings of UM-exposed BO's do not intersect with that region. It stores the
end of the user VA range at VM creation time and performs a quick check in
the vm_bind ioctl path.

> diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
> index 31cc57029c12c..94789777aac48 100644
> --- a/drivers/gpu/drm/panthor/panthor_mmu.c
> +++ b/drivers/gpu/drm/panthor/panthor_mmu.c

[ ... ]

> @@ -2981,6 +2986,10 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file,
>  	if (!IS_ALIGNED(op->va | op->size | op->bo_offset, vm_pgsz))
>  		return -EINVAL;
>  
> +	/* We don't allow mappings that overlap with kbo's reserved range */
> +	if (op->va + op->size > vm->user_va_range)
> +		return -EINVAL;
> +
>  	switch (op->flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) {
>  	case DRM_PANTHOR_VM_BIND_OP_TYPE_MAP:
>  		if (!(op->flags & DRM_PANTHOR_VM_BIND_OP_MAP_SPARSE)) {

[Severity: High]
This is a pre-existing issue, but I noticed a potential memory exhaustion issue
with sparse mappings here.

When an unprivileged user submits a DRM_IOCTL_PANTHOR_VM_BIND ioctl with the
DRM_PANTHOR_VM_BIND_OP_MAP_SPARSE flag and an extremely large op->size (e.g.,
1TB), it appears it can exhaust system memory.

In panthor_vm_op_ctx_prealloc_pts(), a massive pt_count is derived from this
size and allocations are made using GFP_KERNEL:

panthor_mmu.c:panthor_vm_op_ctx_prealloc_pts() {
    ...
	op_ctx->rsvd_page_tables.pages = kzalloc_objs(*op_ctx->rsvd_page_tables.pages,
						      pt_count);
	if (!op_ctx->rsvd_page_tables.pages)
		return -ENOMEM;

	ret = kmem_cache_alloc_bulk(pt_cache, GFP_KERNEL, pt_count,
				    op_ctx->rsvd_page_tables.pages);
    ...
}

Since pt_cache was created in panthor_mmu_pt_cache_init() without the
SLAB_ACCOUNT flag:

panthor_mmu.c:panthor_mmu_pt_cache_init() {
    ...
	pt_cache = kmem_cache_create("panthor-mmu-pt", SZ_4K, SZ_4K, 0, NULL);
    ...
}

Should pt_cache be created with SLAB_ACCOUNT to ensure these massive allocations
are charged to the requesting process's memory control group (memcg) and prevent
Out-Of-Memory panics?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629-vm_bind_checks-v3-0-85e6740f6c2e@collabora.com?part=1

Re: [PATCH v3 4/4] drm/panthor: Check for sparse binding range overflow

[Boris Brezillon]

On Mon, 29 Jun 2026 21:17:08 +0100
Adrián Larumbe <adrian.larumbe@collabora.com> wrote:

> This check is being already carried out further down the call stack inside
> drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to fail early in
> the driver before GPUVM functions are invoked so that we won't waste time
> allocating vm_bind context resources.
> 
> Reported-by: Sashiko <noreply@sashiko.dev>
> Closes: https://sashiko.dev/#/message/20260623204220.CDB1B1F000E9%40smtp.kernel.org
> Fixes: 12cf826bf1dd ("drm/panthor: Support sparse mappings")
> Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
> ---
>  drivers/gpu/drm/panthor/panthor_mmu.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
> index 77fdad4e5166..8bd9b975e5ce 100644
> --- a/drivers/gpu/drm/panthor/panthor_mmu.c
> +++ b/drivers/gpu/drm/panthor/panthor_mmu.c
> @@ -1328,6 +1328,7 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
>  	struct drm_gpuvm_bo *preallocated_vm_bo;
>  	struct sg_table *sgt = NULL;
>  	int ret;
> +	u64 end;
>  
>  	if (!bo)
>  		return -EINVAL;
> @@ -1353,6 +1354,10 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
>  	if (is_sparse && (op->bo_handle || op->bo_offset))
>  		return -EINVAL;
>  
> +	/* Protect against sparse VA range overflow */
> +	if (is_sparse && check_add_overflow(op->va, op->size, &end))
> +		return -EINVAL;

Why should we limit this to sparse? Feels like the overflow check is
good to have for non-sparse as well.

> +
>  	/* If the BO has an exclusive VM attached, it can't be mapped to other VMs. */
>  	if (bo->exclusive_vm_root_gem &&
>  	    bo->exclusive_vm_root_gem != panthor_vm_root_gem(vm))
> @@ -1418,7 +1423,9 @@ static int panthor_vm_prepare_unmap_op_ctx(struct panthor_vm_op_ctx *op_ctx,
>  					   struct panthor_vm *vm,
>  					   const struct drm_panthor_vm_bind_op *op)
>  {
> +	bool is_sparse = op->flags & DRM_PANTHOR_VM_BIND_OP_MAP_SPARSE;
>  	u32 pt_count = 0;
> +	u64 end;
>  	int ret;
>  
>  	memset(op_ctx, 0, sizeof(*op_ctx));
> @@ -1432,6 +1439,10 @@ static int panthor_vm_prepare_unmap_op_ctx(struct panthor_vm_op_ctx *op_ctx,
>  	if (op->va != ALIGN(op->va, SZ_2M))
>  		pt_count++;
>  
> +	/* Protect against sparse VA range overflow */
> +	if (is_sparse && check_add_overflow(op->va, op->size, &end))
> +		return -EINVAL;
> +
>  	if (op->va + op->size != ALIGN(op->va + op->size, SZ_2M) &&
>  	    ALIGN(op->va + op->size, SZ_2M) != ALIGN(op->va, SZ_2M))
>  		pt_count++;
> 

Re: [PATCH v3 4/4] drm/panthor: Check for sparse binding range overflow

[Adrián Larumbe]

On 2026-06-30 10:23:36+02:00, Boris Brezillon wrote:
> On Mon, 29 Jun 2026 21:17:08 +0100
> Adrián Larumbe <adrian.larumbe@collabora.com> wrote:
> 
> > This check is being already carried out further down the call stack inside
> > drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to fail early in
> > the driver before GPUVM functions are invoked so that we won't waste time
> > allocating vm_bind context resources.
> > 
> > Reported-by: Sashiko <noreply@sashiko.dev>
> > Closes: https://sashiko.dev/#/message/20260623204220.CDB1B1F000E9%40smtp.kernel.org
> > Fixes: 12cf826bf1dd ("drm/panthor: Support sparse mappings")
> > Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
> > ---
> >  drivers/gpu/drm/panthor/panthor_mmu.c | 11 +++++++++++
> >  1 file changed, 11 insertions(+)
> > 
> > diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
> > index 77fdad4e5166..8bd9b975e5ce 100644
> > --- a/drivers/gpu/drm/panthor/panthor_mmu.c
> > +++ b/drivers/gpu/drm/panthor/panthor_mmu.c
> > @@ -1328,6 +1328,7 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
> >  	struct drm_gpuvm_bo *preallocated_vm_bo;
> >  	struct sg_table *sgt = NULL;
> >  	int ret;
> > +	u64 end;
> >  
> >  	if (!bo)
> >  		return -EINVAL;
> > @@ -1353,6 +1354,10 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
> >  	if (is_sparse && (op->bo_handle || op->bo_offset))
> >  		return -EINVAL;
> >  
> > +	/* Protect against sparse VA range overflow */
> > +	if (is_sparse && check_add_overflow(op->va, op->size, &end))
> > +		return -EINVAL;
> 
> Why should we limit this to sparse? Feels like the overflow check is
> good to have for non-sparse as well.

You're right, it should be done for all unmaps. On top of that, Sashiko pointed this out:

New issues:
- [Low] The newly added overflow check in `panthor_vm_prepare_unmap_op_ctx` is mathematically dead code because the `MAP_SPARSE` flag is explicitly rejected for UNMAP operations.
- [Low] The overflow check in `panthor_vm_prepare_map_op_ctx` is artificially restricted to sparse mappings, bypassing early protection for non-sparse mappings.

So it turns out that by limiting the overflow check to sparse unmaps, I've introduced a NOP.
That also made me think that even though in the uAPI we state the following:

* @DRM_PANTHOR_VM_BIND_OP_MAP_SPARSE: Sparsely map a virtual memory range
*
* Only valid with DRM_PANTHOR_VM_BIND_OP_TYPE_MAP.

I wrote no checks to validate this for the sparse mappings patch series.
So for v4 I'll be doing the overflow check unconditionally in panthor_vm_prepare_unmap_op_ctx() and also
return -EINVAL if DRM_PANTHOR_VM_BIND_OP_MAP_SPARSE is among the op flags.

Second Sashiko issue isn't relevant because right at the next statement we're clamping limiting mapping
ranges to the size of BOs.

Cheers,
Adrian

Re: [PATCH v3 1/4] drm/panthor: Add vm_bind region with kbo range overlap check

[Steven Price]

On 29/06/2026 21:17, Adrián Larumbe wrote:
> When a VM is created, caller has to specify the range of the address space
> carve-out set aside for mapping kernel BO's. That means vm_bind mappings of
> UM-exposed BO's should not intersect with that region, but at the moment
> we're not checking this.
> 
> At first, I thought of giving these values to drm_gpuvm_init() through its
> reserve_{offset, range} arguments, but it turns out that is meant for VM
> address spans that are not managed through the usual drm_gpuvm split/merge
> circuit, so storing the end of the user VA range at VM creation time and
> doing a quick check in the vm_bind ioctl path was the simplest workaround.
> 
> Fixes: tag and reference the relevant sparse binding support commit.
> Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block")
> Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
> Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
> ---
>  drivers/gpu/drm/panthor/panthor_mmu.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
> index 31cc57029c12..94789777aac4 100644
> --- a/drivers/gpu/drm/panthor/panthor_mmu.c
> +++ b/drivers/gpu/drm/panthor/panthor_mmu.c
> @@ -310,6 +310,9 @@ struct panthor_vm {
>  		u64 end;
>  	} kernel_auto_va;
>  
> +	/** @user_va_range: Upper boundary of VAs VM users can map objects against. */
> +	u64 user_va_range;
> +
>  	/** @as: Address space related fields. */
>  	struct {
>  		/**
> @@ -2893,6 +2896,8 @@ panthor_vm_create(struct panthor_device *ptdev, bool for_mcu,
>  		va_range = full_va_range;
>  	}
>  
> +	vm->user_va_range = kernel_va_start;
> +
>  	mutex_init(&vm->mm_lock);
>  	drm_mm_init(&vm->mm, kernel_va_start, kernel_va_size);
>  	vm->kernel_auto_va.start = auto_kernel_va_start;
> @@ -2981,6 +2986,10 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file,
>  	if (!IS_ALIGNED(op->va | op->size | op->bo_offset, vm_pgsz))
>  		return -EINVAL;
>  
> +	/* We don't allow mappings that overlap with kbo's reserved range */
> +	if (op->va + op->size > vm->user_va_range)

This can overflow, although you partially handle this case in patch 4.
Can we simply move the overflow check from patch 4 here along with the
user_va_range check?

Thanks,
Steve

> +		return -EINVAL;
> +
>  	switch (op->flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) {
>  	case DRM_PANTHOR_VM_BIND_OP_TYPE_MAP:
>  		if (!(op->flags & DRM_PANTHOR_VM_BIND_OP_MAP_SPARSE)) {
>