drm_gpusvm_check_pages() and drm_gpusvm_scan_mm() asks HMM to report the
current CPU page-table state without faulting missing entries by leaving
default_flags set to zero. The HMM PFN array is still caller-owned input/output
state, and the framework may preserve input bits while filling entries. It is
not safe for the caller to hand HMM an uninitialized array and then treat
entries without HMM_PFN_VALID as an authoritative unpopulated result.

Use kvcalloc() for the temporary PFN array so entries that are not
reported as valid start from the documented zero state. This prevents
random stack or heap contents from being interpreted as HMM PFN flags or
PFN values during the scan.

Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
Cc: stable@vger.kernel.org
Signed-off-by: Stanislav Kinsburskii <skinsburskii@gmail.com>
---
 drivers/gpu/drm/drm_gpusvm.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
index ca234fd2c491..6ca6e68be5a6 100644
--- a/drivers/gpu/drm/drm_gpusvm.c
+++ b/drivers/gpu/drm/drm_gpusvm.c
@@ -708,7 +708,7 @@ static bool drm_gpusvm_check_pages(struct drm_gpusvm *gpusvm,
 
 	mmap_assert_locked(gpusvm->mm);
 
-	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
+	pfns = kvcalloc(npages, sizeof(*pfns), GFP_KERNEL);
 	if (!pfns)
 		return false;
 
@@ -780,7 +780,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
 	const struct dev_pagemap *other = NULL;
 	int err, i;
 
-	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
+	pfns = kvcalloc(npages, sizeof(*pfns), GFP_KERNEL);
 	if (!pfns)
 		return DRM_GPUSVM_SCAN_UNPOPULATED;

On Tue, Jul 21, 2026 at 09:29:56AM -0700, Stanislav Kinsburskii wrote:
> drm_gpusvm_check_pages() and drm_gpusvm_scan_mm() asks HMM to report the
> current CPU page-table state without faulting missing entries by leaving
> default_flags set to zero. The HMM PFN array is still caller-owned input/output
> state, and the framework may preserve input bits while filling entries. It is
> not safe for the caller to hand HMM an uninitialized array and then treat
> entries without HMM_PFN_VALID as an authoritative unpopulated result.
> 
> Use kvcalloc() for the temporary PFN array so entries that are not
> reported as valid start from the documented zero state. This prevents
> random stack or heap contents from being interpreted as HMM PFN flags or
> PFN values during the scan.
> 
> Fixes: f1d08a586482 ("drm/gpusvm: Introduce a function to scan the current migration state")
> Cc: stable@vger.kernel.org
> Signed-off-by: Stanislav Kinsburskii <skinsburskii@gmail.com>
> ---
>  drivers/gpu/drm/drm_gpusvm.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
> index ca234fd2c491..6ca6e68be5a6 100644
> --- a/drivers/gpu/drm/drm_gpusvm.c
> +++ b/drivers/gpu/drm/drm_gpusvm.c
> @@ -708,7 +708,7 @@ static bool drm_gpusvm_check_pages(struct drm_gpusvm *gpusvm,
>  
>  	mmap_assert_locked(gpusvm->mm);
>  
> -	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> +	pfns = kvcalloc(npages, sizeof(*pfns), GFP_KERNEL);

This is different offending original patch:

99624bdff867 drm/gpusvm: Add support for GPU Shared Virtual Memory

>  	if (!pfns)
>  		return false;
>  
> @@ -780,7 +780,7 @@ enum drm_gpusvm_scan_result drm_gpusvm_scan_mm(struct drm_gpusvm_range *range,
>  	const struct dev_pagemap *other = NULL;
>  	int err, i;
>  
> -	pfns = kvmalloc_array(npages, sizeof(*pfns), GFP_KERNEL);
> +	pfns = kvcalloc(npages, sizeof(*pfns), GFP_KERNEL);

Hence I merged your v1 to drm-misc-fixes last night.

Can you repost with just the drm_gpusvm_check_pages fix?

Matt

>  	if (!pfns)
>  		return DRM_GPUSVM_SCAN_UNPOPULATED;
>  
> 
>