Re: [PATCH] drm/gpuvm: skip setting kernel_alloc_node range on overflow

[Danilo Krummrich]

On Sun Oct 11, 2026 at 9:22 AM CEST, Alice Ryhl wrote:
> When the reserved VA range overflows in drm_gpuvm_init(), insertion of
> kernel_alloc_node is skipped, leaving its vm pointer NULL. However,
> va.range is still set to a non-zero value, which causes drm_gpuvm_fini()
> to dereference the NULL vm pointer when removing the node. Thus, only
> initialize kernel_alloc_node's address and range when the overflow check
> succeeds.
>
> Note that this fixes unsoundness in the Rust GpuVm::new() abstraction:
> passing a backwards reserve_range (start > end) when overflow checks are
> disabled causes `end - start` to wrap around, triggering the overflow in
> drm_gpuvm_init() and dereferencing NULL when the GpuVm is dropped.
>
> Fixes: e6303f323b1a ("drm: manager to keep track of GPUs VA mappings")
> Signed-off-by: Alice Ryhl <aliceryhl@xxxxxxxxxx>

Good catch! Please also add Cc: stable.

> @@ -1127,12 +1127,12 @@ drm_gpuvm_init(struct drm_gpuvm *gpuvm, const char *name,
>  
>  	memset(&gpuvm->kernel_alloc_node, 0, sizeof(struct drm_gpuva));
>  	if (reserve_range) {
> -		gpuvm->kernel_alloc_node.va.addr = reserve_offset;
> -		gpuvm->kernel_alloc_node.va.range = reserve_range;
> -
>  		if (likely(!drm_gpuvm_warn_check_overflow(gpuvm, reserve_offset,
> -							  reserve_range)))
> +							  reserve_range))) {
> +			gpuvm->kernel_alloc_node.va.addr = reserve_offset;
> +			gpuvm->kernel_alloc_node.va.range = reserve_range;
>  			__drm_gpuva_insert(gpuvm, &gpuvm->kernel_alloc_node);
> +		}
>  	}

Please collapse this to a single if statement.

Thanks,
Danilo