Re: [PATCH v3] drm/gpusvm: Zero HMM PFNs before scanning ranges

[Matthew Brost]

On Thu, Jul 23, 2026 at 10:49:02AM -0700, Stanislav Kinsburskii wrote:
> drm_gpusvm_check_pages() asks HMM to report the current CPU page-table
> state without faulting missing entries by leaving default_flags set to
> zero. The HMM PFN array is still caller-owned input/output state, and the
> framework may preserve input bits while filling entries. It is not safe for
> the caller to hand HMM an uninitialized array and then treat entries
> without HMM_PFN_VALID as an authoritative unpopulated result.
> 
> Use kvcalloc() for the temporary PFN array so entries that are not reported
> as valid start from the documented zero state. This prevents random stack
> or heap contents from being interpreted as HMM PFN flags or PFN values
> during the scan.
> 
> Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Stanislav Kinsburskii <skinsburskii@xxxxxxxxx>

Reviewed-by: Matthew Brost <matthew.brost@xxxxxxxxx>

> ---
>  drivers/gpu/drm/drm_gpusvm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index b946f920b7a0..52573626387c 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c
> @@ -708,7 +708,7 @@ static bool drm_gpusvm_check_pages(struct drm_gpusvm *gpusvm,
>  
>  	mmap_assert_locked(gpusvm->mm);
>  
> -	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> +	pfns = kvcalloc(npages, sizeof(*pfns), GFP_KERNEL);
>  	if (!pfns)
>  		return false;
>  
> 
> ---
> base-commit: baa47c6547b94a164b70924e53d2bcf16f483e6c
> change-id: 20260723-drm-gpusvm-fixes-d97ddda62219
> 
> Best regards,
> -- 
> Stanislav Kinsburskii <skinsburskii@xxxxxxxxx>
>