drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges

VMAs marked with VM_IO or VM_PFNMAP are not backed by struct page
objects, which GPUSVM requires in order to operate correctly. In
particular, get_pages() relies on hmm_range_fault() to resolve struct
pages for the target range.

Attempting to create an SVM range on such VMAs results in repeated
get_pages() failures and can lead to an infinite loop inside a driver’s
page‑fault handler. Prevent this by rejecting ranges on VM_IO or
VM_PFNMAP VMAs and returning -EIO.

Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory")
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Link: https://patch.msgid.link/20260325231608.25581-1-matthew.brost@intel.com

diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
index 4b928fda5b127fb4ef0830617eb2f204a61960cd..7993e85c05661f56960b50ce3fff3ab2c6d62432 100644 (file)
--- a/drivers/gpu/drm/drm_gpusvm.c
+++ b/drivers/gpu/drm/drm_gpusvm.c
@@ -1065,6 +1065,11 @@ drm_gpusvm_range_find_or_insert(struct drm_gpusvm *gpusvm,
                goto err_notifier_remove;
        }
 
+       if (vas->vm_flags & (VM_IO | VM_PFNMAP)) {
+               err = -EIO;
+               goto err_notifier_remove;
+       }
+
        range = drm_gpusvm_range_find(notifier, fault_addr, fault_addr + 1);
        if (range)
                goto out_mmunlock;