drm/panthor: Check VMA boundaries for PMD mappings

When checking a different patch[1] sashiko AI pointed out that
panthor needs the same fix[2]:

In the ->huge_fault handler do not install a PMD huge page
mapping if the huge page exceeds the boundaries of the VMA.

[1] https://lore.kernel.org/lkml/20260622215718.1532689-1-lk@c--e.de/
[2] https://sashiko.dev/#/patchset/20260622215718.1532689-1-lk%40c--e.de

Cc: Boris Brezillon <boris.brezillon@collabora.com>
Cc: Steven Price <steven.price@arm.com>
Cc: Liviu Dudau <liviu.dudau@arm.com>
Fixes: 68cbf96b1e9b ("drm/panthor: Part ways with drm_gem_shmem_object")
Signed-off-by: Christian A. Ehrhardt <lk@c--e.de>
Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://lore.kernel.org/lkml/20260622215718.1532689-1-lk@c--e.de/
Link: https://patch.msgid.link/20260623181942.1536598-1-lk@c--e.de
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>

diff --git a/drivers/gpu/drm/panthor/panthor_gem.c b/drivers/gpu/drm/panthor/panthor_gem.c
index a1e2eb1ca7bbe6bae585fef384caef445563530d..54535bae2b0cfe6dfbe76703d5100aac409040f7 100644 (file)
--- a/drivers/gpu/drm/panthor/panthor_gem.c
+++ b/drivers/gpu/drm/panthor/panthor_gem.c
@@ -802,9 +802,13 @@ static vm_fault_t insert_page(struct vm_fault *vmf, unsigned int order, struct p
        } else if (order == PMD_ORDER) {
                unsigned long pfn = page_to_pfn(page);
                unsigned long paddr = pfn << PAGE_SHIFT;
+               struct vm_area_struct *vma = vmf->vma;
+               unsigned long start = ALIGN_DOWN(vmf->address, PMD_SIZE);
+               unsigned long end = start + PMD_SIZE;
+               bool in_range = vma->vm_start <= start && end <= vma->vm_end;
                bool aligned = (vmf->address & ~PMD_MASK) == (paddr & ~PMD_MASK);
 
-               if (aligned &&
+               if (aligned && in_range &&
                    folio_test_pmd_mappable(page_folio(page))) {
                        pfn &= PMD_MASK >> PAGE_SHIFT;
                        return vmf_insert_pfn_pmd(vmf, pfn, vmf->flags & FAULT_FLAG_WRITE);