[PATCH v2 0/2] drm/gpuvm: reject zero-length VM_BIND ranges at the shared gate

[Zhenhao Wan]

v1 fixed this in the nouveau driver by rejecting a zero-length range in
nouveau_uvmm_validate_range(). Danilo pointed out that this should be
fixed in GPUVM instead, and he is right: the defect is in the core, so
this v2 moves the fix there.

A zero-length range passes drm_gpuvm_range_valid() (0 is page-aligned and
addr + 0 does not overflow), and the GPUVA interval tree then computes a
node's last key as addr + range - 1, which underflows to addr - 1. The
resulting inverted interval corrupts the augmented rb-tree. Because both
the underflowing arithmetic and the single validation gate live in
drm_gpuvm.c, the core protects no one: nouveau and msm are affected, while
xe and imagination are saved only by their own explicit checks near the
ioctl boundary. Patch 2 adds the rejection to drm_gpuvm_range_valid(),
closing the hole for all callers at once.

Fixing only the core would, however, interact badly with panthor. Its
synchronous VM_BIND path already treats a zero-length op as a no-op
(returns 0), but its asynchronous path does not: a zero-length async
MAP/UNMAP reaches drm_gpuvm_sm_map()/drm_gpuvm_sm_unmap(). Today a
zero-length async map into unmapped space can already insert a malformed
node there, so patch 1 fixes a pre-existing corruption on its own; and
once the core starts rejecting a zero range, panthor_vm_bind_run_job()
would additionally escalate the resulting -EINVAL to
panthor_vm_declare_unusable(), permanently killing the VM. Patch 1
therefore makes panthor's asynchronous path treat a zero-length op as a
no-op, matching its synchronous path, and must be applied before patch 2.

Both patches are Cc: stable.

Changes since v1:
- Move the fix from the nouveau driver into the GPUVM core
  (drm_gpuvm_range_valid()), per Danilo's feedback.
- Add a preparatory panthor patch so the core change does not regress
  panthor's asynchronous VM_BIND path.
- Link to v1: https://lore.kernel.org/all/20260812-nouveau-uvmm-pt-fixes-v1-1-ab3a823f946e@xxxxxxxxx

Signed-off-by: Zhenhao Wan <whi4ed0g@xxxxxxxxx>
---
Zhenhao Wan (2):
      drm/panthor: Treat a zero-length VM_BIND op as a no-op
      drm/gpuvm: reject zero-length range in drm_gpuvm_range_valid()

 drivers/gpu/drm/drm_gpuvm.c           | 6 ++++--
 drivers/gpu/drm/panthor/panthor_mmu.c | 9 +++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)
---
base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
change-id: 20260902-drm-gpuvm-zerorange-v2-a2148df386b8

Best regards,
--  
Zhenhao Wan <whi4ed0g@xxxxxxxxx>