[PATCH] drm/nouveau/uvmm: reject zero-length range in validate_range

nouveau_uvmm_validate_range() rejects misaligned addresses and ranges and
defers the remaining bounds check to drm_gpuvm_range_valid(), but neither
rejects a zero range: 0 is page-aligned and addr + 0 does not overflow, so
a zero-length VM_BIND request from userspace passes validation. It then
reaches the generic GPUVA interval-tree insertion, where the node last key
is computed as addr + range - 1. With range == 0 this underflows to
addr - 1, producing an interval whose end lies below its start. The
resulting malformed node corrupts the augmented interval tree and misleads
the overlap checks of later map/unmap operations on the same VM.

drm_gpuvm_range_valid() intentionally leaves the zero-range rejection to
its callers; drm/imagination does exactly this with an explicit "size != 0"
test next to its drm_gpuvm_range_valid() call. nouveau simply omitted it.

Reject range == 0 alongside the existing alignment test.

Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI")
Reported-by: Yuhao Jiang <[email protected]>
Assisted-by: Claude:claude-opus-5
Cc: [email protected]
Signed-off-by: Zhenhao Wan <[email protected]>
---
 drivers/gpu/drm/nouveau/nouveau_uvmm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_uvmm.c b/drivers/gpu/drm/nouveau/nouveau_uvmm.c
index f5e4756b4de4..0efedd9ecc75 100644
--- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c
@@ -1008,7 +1008,7 @@ nouveau_uvmm_validate_range(struct nouveau_uvmm *uvmm, u64 addr, u64 range)
 	if (addr & ~PAGE_MASK)
 		return -EINVAL;
 
-	if (range & ~PAGE_MASK)
+	if (!range || range & ~PAGE_MASK)
 		return -EINVAL;
 
 	if (!drm_gpuvm_range_valid(&uvmm->base, addr, range))

---
base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
change-id: 20260812-nouveau-uvmm-pt-fixes-9706da1a03cf

Best regards,
--  
Zhenhao Wan <[email protected]>