drm/panthor: check bo offset alignment in vm bind

PATCH In review Chia-I Wu 4 participants 5 messages Aug 28, 2025 – Sep 3, 2025

Subsystems (3)

DRM drivers DRM misc Arm Mali panthor DRM driver

lore

Share & tools

lore

Chia-I Wu

author

2025-08-28 20:01 UTC #0 lore raw

PATCH 1/1 drm/panthor: check bo offset alignment in vm bind

Fail early from panthor_vm_bind_prepare_op_ctx instead of late from ops->map_pages.

Signed-off-by Chia-I Wu <[email protected]>

Reviewed-by Boris Brezillon <[email protected]>

---
 drivers/gpu/drm/panthor/panthor_mmu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/gpu/drm/panthor/panthor_mmu.c +2 -2

index bad720f23eb70..6dec4354e3789 100644
@@ -1222,7 +1222,7 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
 	    (flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) != DRM_PANTHOR_VM_BIND_OP_TYPE_MAP)
 		return -EINVAL;
 
-	/* Make sure the VA and size are aligned and in-bounds. */
+	/* Make sure the VA and size are in-bounds. */
 	if (size > bo->base.base.size || offset > bo->base.base.size - size)
 		return -EINVAL;

@@ -2447,7 +2447,7 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file,
 	int ret;
 
 	/* Aligned on page size. */
-	if (!IS_ALIGNED(op->va | op->size, vm_pgsz))
+	if (!IS_ALIGNED(op->va | op->size | op->bo_offset, vm_pgsz))
 		return -EINVAL;
 
 	switch (op->flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) {

Signature · 1 line

2.51.0.318.gd7df087d1a-goog

Liviu Dudau

maintainer Reviewed-by on v1 1/1

2025-09-02 16:20 UTC #1 lore raw

Quoted 5 lines · Chia-I Wu

Fail early from panthor_vm_bind_prepare_op_ctx instead of late from ops->map_pages.
Signed-off-by Chia-I Wu <[email protected]>
Reviewed-by Boris Brezillon <[email protected]>

Reviewed-by Liviu Dudau <[email protected]>

Best regards,
Liviu

Quoted 29 lines

---
 drivers/gpu/drm/panthor/panthor_mmu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/gpu/drm/panthor/panthor_mmu.c +2 -2

index bad720f23eb70..6dec4354e3789 100644
@@ -1222,7 +1222,7 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
 	    (flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) != DRM_PANTHOR_VM_BIND_OP_TYPE_MAP)
 		return -EINVAL;
 
-	/* Make sure the VA and size are aligned and in-bounds. */
+	/* Make sure the VA and size are in-bounds. */
 	if (size > bo->base.base.size || offset > bo->base.base.size - size)
 		return -EINVAL;

@@ -2447,7 +2447,7 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file,
 	int ret;
 
 	/* Aligned on page size. */
-	if (!IS_ALIGNED(op->va | op->size, vm_pgsz))
+	if (!IS_ALIGNED(op->va | op->size | op->bo_offset, vm_pgsz))
 		return -EINVAL;
 
 	switch (op->flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) {

Signature · 1 line

2.51.0.318.gd7df087d1a-goog

Signature · 8 lines

====================
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯

Steven Price

maintainer Reviewed-by on v1 1/1

2025-09-03 11:29 UTC #2 lore raw

In reply to Chia-I Wu

Quoted 5 lines · Chia-I Wu

Fail early from panthor_vm_bind_prepare_op_ctx instead of late from ops->map_pages.
Signed-off-by Chia-I Wu <[email protected]>
Reviewed-by Boris Brezillon <[email protected]>

Reviewed-by Steven Price <[email protected]>

I'll push this to drm-misc-next.

Thanks,
Steve

Quoted 26 lines

---
 drivers/gpu/drm/panthor/panthor_mmu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/gpu/drm/panthor/panthor_mmu.c +2 -2

index bad720f23eb70..6dec4354e3789 100644
@@ -1222,7 +1222,7 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
 	    (flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) != DRM_PANTHOR_VM_BIND_OP_TYPE_MAP)
 		return -EINVAL;
 
-	/* Make sure the VA and size are aligned and in-bounds. */
+	/* Make sure the VA and size are in-bounds. */
 	if (size > bo->base.base.size || offset > bo->base.base.size - size)
 		return -EINVAL;

@@ -2447,7 +2447,7 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file,
 	int ret;
 
 	/* Aligned on page size. */
-	if (!IS_ALIGNED(op->va | op->size, vm_pgsz))
+	if (!IS_ALIGNED(op->va | op->size | op->bo_offset, vm_pgsz))
 		return -EINVAL;
 
 	switch (op->flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) {

Boris Brezillon

maintainer

2025-09-03 16:46 UTC #3 lore raw

In reply to Chia-I Wu

Quoted 23 lines · On Thu, 28 Aug 2025 13:01:16 -0700 Chia-I Wu <[email protected]> wrote:

Fail early from panthor_vm_bind_prepare_op_ctx instead of late from ops->map_pages.

Signed-off-by Chia-I Wu <[email protected]>

Reviewed-by Boris Brezillon <[email protected]>

---
 drivers/gpu/drm/panthor/panthor_mmu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/gpu/drm/panthor/panthor_mmu.c +1 -1

index bad720f23eb70..6dec4354e3789 100644
@@ -1222,7 +1222,7 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
 	    (flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) != DRM_PANTHOR_VM_BIND_OP_TYPE_MAP)
 		return -EINVAL;
 
-	/* Make sure the VA and size are aligned and in-bounds. */
+	/* Make sure the VA and size are in-bounds. */
 	if (size > bo->base.base.size || offset > bo->base.base.size - size)
 		return -EINVAL;

drivers/gpu/drm/panthor/panthor_mmu.c panthor_vm_bind_prepare_op_ctx(struct drm_file *file, · line 2451

Quoted 6 lines

drivers/gpu/drm/panthor/panthor_mmu.c +1 -1

@@ -2447,7 +2447,7 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file,
 	int ret;
 
 	/* Aligned on page size. */
-	if (!IS_ALIGNED(op->va | op->size, vm_pgsz))
+	if (!IS_ALIGNED(op->va | op->size | op->bo_offset, vm_pgsz))
 		return -EINVAL;

Now that I look at this, I think we'd be better moving this alignment check to panthor_vm_prepare_[un]map_op_ctx() to cover the in-kernel users.

Quoted 2 lines

drivers/gpu/drm/panthor/panthor_mmu.c +0 -0
 	switch (op->flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) {

Chia-I Wu

author

2025-09-03 19:46 UTC #4 lore raw

Quoted 29 lines · Boris Brezillon

Quoted 25 lines · On Thu, 28 Aug 2025 13:01:16 -0700 Chia-I Wu <[email protected]> wrote:

Fail early from panthor_vm_bind_prepare_op_ctx instead of late from ops->map_pages.

Signed-off-by Chia-I Wu <[email protected]>

Reviewed-by Boris Brezillon <[email protected]>

---
 drivers/gpu/drm/panthor/panthor_mmu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/gpu/drm/panthor/panthor_mmu.c +1 -1

index bad720f23eb70..6dec4354e3789 100644
@@ -1222,7 +1222,7 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
          (flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) != DRM_PANTHOR_VM_BIND_OP_TYPE_MAP)
              return -EINVAL;
 
-     /* Make sure the VA and size are aligned and in-bounds. */
+     /* Make sure the VA and size are in-bounds. */
      if (size > bo->base.base.size || offset > bo->base.base.size - size)
              return -EINVAL;

@@ -2447,7 +2447,7 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file,
      int ret;

Quoted 8 lines

drivers/gpu/drm/panthor/panthor_mmu.c panthor_vm_bind_prepare_op_ctx(struct drm_file *file, · line 2451
Quoted 4 lines
drivers/gpu/drm/panthor/panthor_mmu.c +1 -1
      /* Aligned on page size. */
-     if (!IS_ALIGNED(op->va | op->size, vm_pgsz))
+     if (!IS_ALIGNED(op->va | op->size | op->bo_offset, vm_pgsz))
              return -EINVAL;
Now that I look at this, I think we'd be better moving this alignment check to panthor_vm_prepare_[un]map_op_ctx() to cover the in-kernel users.

Yeah, it would be nice for this to validate for both, but it looks like the patch has been pushed.

panthor_vm_alloc_va already validates for kernel space so the suggested change is not urgent. Besides, I feel there might be other missing validations. Perhaps we can wait for igt tests[1], expand them, and improve our validation story more systematically.

[1] https://lists.freedesktop.org/archives/dri-devel/2025-August/521887.html

Quoted 4 lines

Quoted 3 lines
drivers/gpu/drm/panthor/panthor_mmu.c +0 -0
      switch (op->flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) {