Re: [PATCH] drm/nouveau/uvmm: reject zero-length range in validate_range

[Danilo Krummrich]

On 8/12/26 4:56 PM, Zhenhao Wan wrote:
> nouveau_uvmm_validate_range() rejects misaligned addresses and ranges and
> defers the remaining bounds check to drm_gpuvm_range_valid(), but neither
> rejects a zero range: 0 is page-aligned and addr + 0 does not overflow, so
> a zero-length VM_BIND request from userspace passes validation. It then
> reaches the generic GPUVA interval-tree insertion, where the node last key
> is computed as addr + range - 1. With range == 0 this underflows to
> addr - 1, producing an interval whose end lies below its start. The
> resulting malformed node corrupts the augmented interval tree and misleads
> the overlap checks of later map/unmap operations on the same VM.

Given this, why do you think drm_gpuvm_range_valid() intentionally leaves
the zero-range rejection to its callers? Why not fix this in GPUVM instead?

> drm_gpuvm_range_valid() intentionally leaves the zero-range rejection to
> its callers; drm/imagination does exactly this with an explicit "size != 0"
> test next to its drm_gpuvm_range_valid() call. nouveau simply omitted it.
> 
> Reject range == 0 alongside the existing alignment test.
> 
> Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI")
> Reported-by: Yuhao Jiang <danisjiang@xxxxxxxxx>
> Assisted-by: Claude:claude-opus-5
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Zhenhao Wan <whi4ed0g@xxxxxxxxx>
> ---
>  drivers/gpu/drm/nouveau/nouveau_uvmm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/nouveau/nouveau_uvmm.c b/drivers/gpu/drm/nouveau/nouveau_uvmm.c
> index f5e4756b4de4..0efedd9ecc75 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c
> @@ -1008,7 +1008,7 @@ nouveau_uvmm_validate_range(struct nouveau_uvmm *uvmm, u64 addr, u64 range)
>  	if (addr & ~PAGE_MASK)
>  		return -EINVAL;
>  
> -	if (range & ~PAGE_MASK)
> +	if (!range || range & ~PAGE_MASK)
>  		return -EINVAL;
>  
>  	if (!drm_gpuvm_range_valid(&uvmm->base, addr, range))
> 
> ---
> base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
> change-id: 20260812-nouveau-uvmm-pt-fixes-9706da1a03cf
> 
> Best regards,
> --  
> Zhenhao Wan <whi4ed0g@xxxxxxxxx>
>