Re: [PATCH] drm/i915: Fix potential overflow of shmem scatterlist length

[Andi Shyti <andi.shyti@linux.intel.com>]

Hi Janusz,

On Tue, Feb 24, 2026 at 10:49:06AM +0100, Janusz Krzysztofik wrote:
> When a scatterlists table of a GEM shmem object of size 4 GB or more is
> populated with pages allocated from a folio, unsigned int .length
> attribute of a scatterlist may get overflowed if total byte length of
> pages allocated to that single scatterlist happens to reach or cross the
> 4GB limit.  As a consequence, users of the object may suffer from hitting
> unexpected, premature end of the object's backing pages.
> 
> [278.780187] ------------[ cut here ]------------
> [278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915_mm.c:55 remap_sg+0x199/0x1d0 [i915]
> ...
> [278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gem_mmap_offset Tainted: G S   U              6.17.0-rc1-CI_DRM_16981-ged823aaa0607+ #1 PREEMPT(voluntary)
> [278.780656] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
> [278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIOS MTLPFWI1.R00.3471.D91.2401310918 01/31/2024
> [278.780659] RIP: 0010:remap_sg+0x199/0x1d0 [i915]
> ...
> [278.780786] Call Trace:
> [278.780787]  <TASK>
> [278.780788]  ? __apply_to_page_range+0x3e6/0x910
> [278.780795]  ? __pfx_remap_sg+0x10/0x10 [i915]
> [278.780906]  apply_to_page_range+0x14/0x30
> [278.780908]  remap_io_sg+0x14d/0x260 [i915]
> [278.781013]  vm_fault_cpu+0xd2/0x330 [i915]
> [278.781137]  __do_fault+0x3a/0x1b0
> [278.781140]  do_fault+0x322/0x640
> [278.781143]  __handle_mm_fault+0x938/0xfd0
> [278.781150]  handle_mm_fault+0x12c/0x300
> [278.781152]  ? lock_mm_and_find_vma+0x4b/0x760
> [278.781155]  do_user_addr_fault+0x2d6/0x8e0
> [278.781160]  exc_page_fault+0x96/0x2c0
> [278.781165]  asm_exc_page_fault+0x27/0x30
> ...
> 
> That issue was apprehended by the author of a change that introduced it,
> and potential risk even annotated with a comment, but then never addressed.
> 
> When adding folio pages to a scatterlist table, take care of byte length
> of any single scatterlist not exceeding max_segment.
> 
> Fixes: 0b62af28f249b ("i915: convert shmem_sg_free_table() to use a folio_batch")
> Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14809
> Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Cc: stable@vger.kernel.org # v6.5+
> Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>

Applied to drm-intel-gt-next.

Thanks,
Andi