On Mon, Jul 20, 2026 at 04:48:02PM -0700, Stanislav Kinsburskii wrote:
> On Mon, Jul 20, 2026 at 11:54:50AM -0700, Matthew Brost wrote:
> > On Tue, Jul 14, 2026 at 03:54:32PM -0700, Stanislav Kinsburskii wrote:
> > > drm_gpusvm_scan_mm() asks HMM to report the current CPU page-table
> > > state without faulting missing entries by leaving default_flags set to
> > > zero. The HMM PFN array is still caller-owned input/output state, and
> > > the framework may preserve input bits while filling entries. It is not
> > > safe for the caller to hand HMM an uninitialized array and then treat
> > > entries without HMM_PFN_VALID as an authoritative unpopulated result.
> > >
> > > Use kvcalloc() for the temporary PFN array so entries that are not
> > > reported as valid start from the documented zero state. This prevents
> > > random stack or heap contents from being interpreted as HMM PFN flags or
> > > PFN values during the scan.
> > >
> > > Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the
> > > current migration state")
> > > Cc: [email protected]
> > > Signed-off-by: Stanislav Kinsburskii <[email protected]>
> > > ---
> > > drivers/gpu/drm/drm_gpusvm.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> > > index 1a8bb83bd28d..c8f489d7ff7e 100644
> > > --- a/drivers/gpu/drm/drm_gpusvm.c
> > > +++ b/drivers/gpu/drm/drm_gpusvm.c
> > > @@ -859,7 +859,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct
> > > drm_gpusvm_range *range,
> >
> > Two other cases in gpusvm would need to be fixed as well:
> >
> > - drm_gpusvm_get_pages
> > - drm_gpusvm_range_evict
> >
>
> No, these two are fine, as the faulting is done with HMM_PFN_REQ_FAULT,
> which either populates all the PFNs or fails.
>
Ah, yes clearly misunderstood the issue here / didn't read the commit
message.
This patch LGTM:
Reviewed-by: Matthew Brost <[email protected]>
Will merge to drm-misc-fixes shortly.
But then drm_gpusvm_check_pages() should be fixed too as we don't set
HMM_PFN_REQ_FAULT there either.
Matt
> The only case where PFNs must be zeroed is when the caller wants to
> collect the mapped PFNs. In this case, the missing PFNs are simply
> ignored by the HMM framework.
>
> Thanks,
> Stanislav
>
> > The offending patch is likely the one that added sticky bits to HMM:
> > `git format-patch -1 285e871884ff3` for above two cases.
> >
> > While I think zeroing here would be the safest approach, it does not appear
> > to be a problem in practice because the sticky bits are only used by
> > `hmm_dma_map_pfn()` and `hmm_dma_unmap_pfn()`.
> >
> > Also, there are several non-gpusvm cases in the kernel that do not zero
> > the PFN array either. So I'd say we should either fix the entire kernel
> > in one pass, document that pfns must initialized to a known state, or
> > leave this code alone.
> >
> > Matt
> >
> > > const struct dev_pagemap *other = NULL;
> > > int err, i;
> > >
> > > - pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> > > + pfns = kvcalloc(npages, sizeof(*pfns), GFP_KERNEL);
> > > if (!pfns)
> > > return DRM_GPUSVM_SCAN_UNPOPULATED;
> > >
> > >
> > >
