From nobody Sat Jul 25 23:03:39 2026 Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8752E39A7F6 for ; Sun, 12 Jul 2026 12:37:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783859855; cv=none; b=gCOkAbZr9dVBNZ2a1BSGNnSylEK0IP4/dROq2MjzISQJwFCpsKKfqwu/vvgzD+CljHQPFibCEEWZJIz3Rxr0K+jPgjcQF+bqW0r6nyR5efyz6a9/BaboKWOC7oOxbv1Gyvb9Yc3bjZbX3e9RhQ6oC/YiYxjjzOT/RgXDElXUDnk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783859855; c=relaxed/simple; bh=DyNZBgCN8atzNahh4j0zXns3XiMLFiYaiTFqRn4ZA6o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Wh6fu4iDhBGf7Hq2vZj74EVgT7+g+Yqk5KJWlUNMH42GrEjy+E7vI85c1Ffv4pm/lz0OIhDGPDg0qrk9tT75X+3gwCemiaNN37k+BelbacBOXPhR/pKg+Pog2RMUsWvJ7VncbGy13Sh8LxaY9WdMVWfMbrbl1JfEh2czJeLKHNg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=lGzEozEA; arc=none smtp.client-ip=209.85.128.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lGzEozEA" Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-493f60208a5so17976365e9.3 for ; Sun, 12 Jul 2026 05:37:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783859852; x=1784464652; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=x7IitsXdpTEQRJSq8p+rIrB3s36tgZetIRvXFPP7irs=; b=lGzEozEAv8uPseFkbCFby77c80Cf5MrnEjoJJuTEKeNO/pMokSi5dXVaQsF7ex6KCH RtFu4ezrfGTRfKIZtEiAyBCnchoD0IkZ1BiKeSaCl05aOQgIhmMgfTFRCFVSyXCC/hTH 1bLAMYOwdTgdk2C6FdGQTWERUogJL3sp69887QYfV1Np2jWzWyU+2EvfmgcqIiM9NK+q tbDgJw7VSBG/qhVnSUC+K9R/yuLJkymsOe6ZnQmQ2uk/W8nH2wDu4DSaNb62SJAD+2y4 wgZEClyD5kpB/z/2TSzxJbfn8CYU/rhvNKEjUYQ7norECIXTdCAJJ+CVSiwAagUMLpp3 eF1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783859852; x=1784464652; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=x7IitsXdpTEQRJSq8p+rIrB3s36tgZetIRvXFPP7irs=; b=PD4uVqmb+UlZygJmKyzQNbJuFipLKOQzRfCgTLKh+kOBHUPlOO1nkl/heEU5D8nrVO lyeq+KXK8tXM4tX8cB6srqP7raUbcD46t31TyuUNnWuxL2LEyukfKAEpeaNfEFK492C9 a4E0pYeMnsyHPMLtQyWdBVExVvtw6yeJ+WJT6izSSIRJng+/Y+Ah7L3EX8FEaBKXkNKc 6M0h0OSSNMicf30nzkPPM205RLO1OQBwX+0s808rRTSW6oDMol+bhRrDJeuNWgHAJ4eq 3dJi03552hirlRLePcauQz5p2jfhhuHU1fMiPQAHREDQz3eOVcL0cj/tQM7S2XaIWcMl WkLg== X-Forwarded-Encrypted: i=1; AHgh+Rpx2lROHwS0NV99RZj/TeV8gIkJCKdtsk8VIlnDegpIAPlJV8hOckpy2ysuuHvzunOQExZjDm5HT4nYcpM=@vger.kernel.org X-Gm-Message-State: AOJu0YwCkTKnvlft0/E3AKyt1R6OtxXR9pldQUEjkNVkAYxCFT7SOowc HQE/JPcEO6jaSkggKZKqIHNy8brQUnf7Doj4hZXqeEUDUiDy4BgINwyg X-Gm-Gg: AfdE7clv3X8hajqerEj1Z8EcUziIfLITANlmj820ctJFyb5HQko0A6XcUqtPYLfA6sN QeC9tJ2khziduEuHLbCb8bRuOMjmu4J0ZM+g91JNj8akBK1+XiWfhhQQy4fXq/sGvV9Kkf91I4Q kh6v9AsMSj/YoEu6novNiGevklajwbqbPIoGpdukyL+xVco9qzSpjyfgu5Er85rfeCWUPzWsjaz czXUiDPVETrD16MK5185YenjzCCxKKeyGx5WRt4N0VZYojSiCBiWD5xjVKo5l2h5o+4WTJBuUQe affY7iMiaMqwyUs8QcYLpPRPeS12F507bMhr4rwHOD5eMCqQxai+p1CHyIh4zGtEQQy5NaS0Ajv gVZ54vyAv0WrBRCvS0oPu+mTtRdhG/L4HcXf5D1qHHTnBLQbKUAKcg9lmhkYKaluNCgm6euEEja KTtjgWe3ENjfrYvu4= X-Received: by 2002:a05:600c:1386:b0:490:5057:f5f7 with SMTP id 5b1f17b1804b1-493f87e5164mr54882405e9.11.1783859851424; Sun, 12 Jul 2026 05:37:31 -0700 (PDT) Received: from fra-x8664 ([2a01:e11:8000:43b0:96d6:566b:35c:7b8c]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-493eb6f3c42sm280280485e9.1.2026.07.12.05.37.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 05:37:30 -0700 (PDT) From: Francesco Magazzu To: Lyude Paul , Danilo Krummrich Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Dan Carpenter , Karol Herbst Subject: [PATCH v2 1/4] drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update Date: Sun, 12 Jul 2026 14:36:13 +0200 Message-ID: <20260712123616.1180830-2-postadelmaga@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260712123616.1180830-1-postadelmaga@gmail.com> References: <20260712123616.1180830-1-postadelmaga@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If the requested pstate id is not present in the state list (or the list is empty, e.g. broken/missing perf tables), the list_for_each_entry cursor runs off the end of the list and the subsequent pstate->pstate !=3D req check dereferences the list head cast to a struct nvkm_pstate, which is an out-of-bounds read. Track whether the entry was actually found instead of inspecting the cursor after the loop. Fixes: 7c8565220697 ("drm/nouveau/clk: implement power state and engine clo= ck control in core") Signed-off-by: Francesco Magazzu --- Note: essentially the same fix was posted by Dan Carpenter in 2022 and never picked up; the bug is still present in drm-misc-next. Credit for spotting it goes to him. Link: https://lore.kernel.org/dri-devel/YvSkKAdk8Pe0g2K9@kili/ drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c b/drivers/gpu/d= rm/nouveau/nvkm/subdev/clk/base.c index 572e63846..42f3709e0 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c @@ -479,13 +479,17 @@ nvkm_clk_ustate_update(struct nvkm_clk *clk, int req) return -ENOSYS; =20 if (req !=3D -1 && req !=3D -2) { + bool found =3D false; + list_for_each_entry(pstate, &clk->states, head) { - if (pstate->pstate =3D=3D req) + if (pstate->pstate =3D=3D req) { + found =3D true; break; + } i++; } =20 - if (pstate->pstate !=3D req) + if (!found) return -EINVAL; req =3D i; } --=20 2.55.0 From nobody Sat Jul 25 23:03:39 2026 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9084B3A6B85 for ; Sun, 12 Jul 2026 12:37:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783859859; cv=none; b=R4fD1JndAU3qWwyZhqZbDLKbldD8vdJ/3ZB38VHUba8bblNFMY8L1pj3iPds7oaSpHGSIxaixHp+gLTZOGwRUeWILXqANIxjjzsdWdGrHX2lvrMTrIIMAmcWVmbF7YxDVNxqnopMxJ0SAZC6Sa9D9w/5V8SfL0XxI0A05oZ5zOg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783859859; c=relaxed/simple; bh=QeVuH9IkYEhWdGIAVRSEeO/O8I/8BFvs9tAfRoRFQvs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fFLGVPYBv/dyFPDC7qIXRcZgGnZ4VxnCZkJZ7YP6lWpD0k0yhIL6SG/XpfLokGV+MYLP22b1qw4OaEtZ5En32x4iMJKUiAarn865r9wc2RRx4FPeNHsAoPLXehEOoj8cCliTKng7Mz6q5W+7dXhq4nzf7kXWMXS4XgBWOYy0ZN4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=tIut/2yO; arc=none smtp.client-ip=209.85.128.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="tIut/2yO" Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-493b77b150aso19816885e9.2 for ; Sun, 12 Jul 2026 05:37:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783859856; x=1784464656; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=yZa2enwSIIgLldRkiC8kJq5D8PtsumlenYqYmwQU3wk=; b=tIut/2yOmUoN9ZV5Np57+9ZqbR3YE0RzB/++lfOHMdI2+bUYM2PchgmOFDCZVimW+x pfDZaoL6qXhC+gNRq3iz8u0rZvq4UBazx4p0j5ArcUeZHmk13Rb4eIQnngQLuXFY6iFe qwXlMhZ8QwGoPvdHtO4j/wBMIFuojLoO/m53aR6if8dJyIfbgpvXaZGKfc2eGoQAIsKn mX5gNNTJ5LVTJLhAjull9l4qY5OJVubSADNhZxAIPtQcxAoZqgii9lGQhKOeXkHA3cp8 k2drTN6fzxAbdUhY9V/fzrr1kz+bOYviRnBTdsOMQ/244CBKem8iwIxynpYtdwOlXUcr 1VOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783859856; x=1784464656; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=yZa2enwSIIgLldRkiC8kJq5D8PtsumlenYqYmwQU3wk=; b=TB0UfZlxbz6btihBIjlF4lL9l0v7WUoL+s4J+uhSR2c6KspL2oUUo563fxt/pqFqGW puNiTzj+YqpQ8QQJ3lyecv86nAkrF8VA/wfWdOJ4rzT6I7xI8ouGP9QbKn+k8kTO3Rp3 voAsgdSEO1LtIIRtnUAqfV0mamVtxmEbNA45X0P++ATcK+z6LJ86zgBYROQqpN+zgkIi V0koOe0y4OahKVsxTScBaZYWMA65NBgRKk1/OvqBr3u3xxdgZsbmsyxVI09Vo4ymH/ji ZLXFtplxC75vN6kl5xdjSKDj0hlHm79OD0fqezC4cVp40EMVuae4++n4HcGZTedBei1L GZGA== X-Forwarded-Encrypted: i=1; AHgh+RoTnpDF1kQqirqmb0ZnMkwSnj5gtUkABHdPlGfVipCvbyQ/xMCUrX54F6uN/E9FpVBKfNSrKsfNeIPTQ6Q=@vger.kernel.org X-Gm-Message-State: AOJu0YyKIrN9jrCB0wZwWP06+WPewEGDqNF76j9UWg1iTXwYfbG47yAx SeFNH6O8OfLaQOvuED9jUDylW872XlxGSNoHzbBEmxbTN+eXgpBFvsJF X-Gm-Gg: AfdE7ckQo+Dqj8HFC7WU2ciyhvYRLimHTPNWc7qX/G9bPG9xPbC7m5bcupi0XUcNp7X KLS1NGKwvtLjVYj01WHhRtNpkxzy1nX9P4ouo4TjWPtcfW80cZRvAzr58Zficfdjt0/9VHcfymj FOnT7BtwmxMo2ZvsHXs/w4aldY3X8GZ293Zqsf8Wvj4yS7U1fkiJUXSxCr/nUU7kVuwckPWMRsC FmcjcaUUPplaK2of5s1hhZgf5VLFcDUlWGaatbqAltd9N4kJwPIUTXETTew9dajNxLFn5W2dMP4 469TnFZFnuxg7ya5TkhGWaBd9JPDIWy0ryjxqqsUIrsNc2dMq8tqoDsqfOUuhyCxoySP1uN6ko5 AkRnM44cOzV/KEwvRCcqBlbvqVMDYx0dEz6LWGDfsJEYlyXiNs8UhBSC+WIYZs0bBO5Aw4K06We 9Iuw7wAH3U9peM5Xo= X-Received: by 2002:a05:600c:80c5:b0:493:a570:df7d with SMTP id 5b1f17b1804b1-493f881d20fmr37660025e9.20.1783859855726; Sun, 12 Jul 2026 05:37:35 -0700 (PDT) Received: from fra-x8664 ([2a01:e11:8000:43b0:96d6:566b:35c:7b8c]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-493eb6f3c42sm280280485e9.1.2026.07.12.05.37.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 05:37:35 -0700 (PDT) From: Francesco Magazzu To: Lyude Paul , Danilo Krummrich Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Dan Carpenter , Karol Herbst Subject: [PATCH v2 2/4] drm/nouveau/clk: don't use the pstate cursor after the loop Date: Sun, 12 Jul 2026 14:36:14 +0200 Message-ID: <20260712123616.1180830-3-postadelmaga@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260712123616.1180830-1-postadelmaga@gmail.com> References: <20260712123616.1180830-1-postadelmaga@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nvkm_pstate_prog() walks clk->states looking for the entry at index 'pstatei' and then keeps using the list_for_each_entry cursor after the loop. This is not triggerable today: every caller clamps the index against clk->state_nr before calling, so the loop always breaks on a real entry. It is safe by virtue of what the callers happen to do, not by anything the function itself checks. Should a caller ever pass an index that is not on the list, the cursor would point at the list head rather than at a pstate, and the pstate->base.domain[] and pstate->fanspeed accesses that follow would read past it. Rather than leave that trap in place for the next caller, track whether the entry was found and return -EINVAL if it was not. No functional change. Signed-off-by: Francesco Magazzu --- drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c b/drivers/gpu/d= rm/nouveau/nvkm/subdev/clk/base.c index 42f3709e0..4d546b07f 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c @@ -270,13 +270,19 @@ nvkm_pstate_prog(struct nvkm_clk *clk, int pstatei) struct nvkm_fb *fb =3D subdev->device->fb; struct nvkm_pci *pci =3D subdev->device->pci; struct nvkm_pstate *pstate; + bool found =3D false; int ret, idx =3D 0; =20 list_for_each_entry(pstate, &clk->states, head) { - if (idx++ =3D=3D pstatei) + if (idx++ =3D=3D pstatei) { + found =3D true; break; + } } =20 + if (!found) + return -EINVAL; + nvkm_debug(subdev, "setting performance state %d\n", pstatei); clk->pstate =3D pstatei; =20 --=20 2.55.0 From nobody Sat Jul 25 23:03:39 2026 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 25DF43AA1BB for ; Sun, 12 Jul 2026 12:37:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783859861; cv=none; b=S26vf6FpXWLwBd7DcAAjSRwtIlTqFlN+C+CKrvvk5IX6ZxH0z7sQfXiZ7v4EVL6bws+rsLa2IVs24eo/s1kaLgIWT74HG/0jEB+IcGano91rucTwkYQngBHG6Q096bDGrzEEMJXxEnKUva6LtTwM3Z1dJyXqeKD5QVvHamPg1iE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783859861; c=relaxed/simple; bh=FQTU3SNvcssT6eHKr33e8BEqhU4FBZVWtQtLycfAJa4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hgNMznoxjh6eNOZVtwCu73QyP7pdLINyKVVY1MGkW+MpVX8ADxeTarSW5nMWemRVgPEWArckbgKKEHxonI3ZO+II5vHvyCiL09HwKv3q0AEOF53Vy3i0RHhu2ksxeQ7qSI3q2TkA+hGjeOmIH9G3lENFK35xt1wmncCm9GlLzhM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=gASzP1Sh; arc=none smtp.client-ip=209.85.128.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="gASzP1Sh" Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-493c52cde9eso21401345e9.3 for ; Sun, 12 Jul 2026 05:37:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783859858; x=1784464658; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=CJi+7sCg+GNZFhEJVD2Hmu/wR2anVVL7EeD+/Q0E5aU=; b=gASzP1ShbcJV8SzBdu6O32oX6Cepxab1YCGtq99bGgkoxcYnEe1gsf5NWkM3EHARto K3tdmmBjRw2SE2iki0iMtoLTj4p2D5lVGhd8ki92Dp4vYNWMEcwsSAhb2z/+uOh0kM2v WSYSFmpNsY2lEB08MjF0HNXbhJNoGriL6I6fgNZdX2T0lO7si+/PfERCtVLaJCY/EiCt O2PYpKCdHTE+e1g/wpIQFxQNMu/vu2Atb3JWECznXlZg+RyKF1XOsB6HlbcX/fAgX5FL lSOAJK1MYsNtAs8VoRwSi+SiAl0UEMW12BnwqrSmADrmN/Ho2pZJUhZJ3YRaNI3DW+2C u+RQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783859858; x=1784464658; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=CJi+7sCg+GNZFhEJVD2Hmu/wR2anVVL7EeD+/Q0E5aU=; b=OpxRYGjaa4KukROA3NdGCn4B1Xpk382zASzbx2+mb4WrKAkH1AmVYSQtac1Nf1oPmg peGEdfFiho1Z8UtEWpKLrO3ShA6lvJ4k8EleuWT9ABxa/eALecc7B1XnVdmr10f/8psn riO/HcTAJ87oamuolifg3/0+h1l4pc8fnIDO99Mz3qRPWl7hnFHLdLUWUqmE28ENvDuN lmrqBFoUVuLu4LKACOB1+5IuLB/qo5CkLKAGqSUTZyOZjTDiavzCx6adVNwtsv/1qDrW Cfj870GEwqYNJqHvgS5ZprcgUwfYOa2pE7W0L5qGCd5iBnDK5B7BkSJ5a/FHwMgaDbP6 h+sQ== X-Forwarded-Encrypted: i=1; AHgh+Rq9Twk+piCA0beQC3nojGmGJj3zJrdRwTYGSFiQYBUnP/MSxynK2JEGy/nqS6ayUGcnE8K2iNqmIwyerT8=@vger.kernel.org X-Gm-Message-State: AOJu0YytELG2z4d7mCYD4MOdPJM94aZYQavZlXdQb5CwovSmAtFPtZIg BQ0JNQcuvDzGF073bIn0UmqWJkAQzIREPeVSi4ec7G453l1nAuNW62bk X-Gm-Gg: AfdE7cmCm2MxAChFowZiJMCenja1WjecWZrR/dNu5bI/sVudGjT66H3MR5QqH0FO8a7 YK6x01TirXoovzq7NSosOeHVMkc3TtiSfWezyBLRkHY1b/wKdWf+f2xCcQ/lAt4VGO9nC+kE66B Bfp6XQLmHHFWVRlEXBLgJ/o6Th1XxIzTwNuM1fPMB5zqrRAXm6nyR5W2Xe72kQCjJR334X64YKS JZA5//UwZ4/w0qFjkOGARpWcd09L4xiAut2WbdmCY4mQVbEn8Kp57XQ5glVcMNzPS4EPPqq1Hat lbtZHhnSRwDLvKXmAxLPPpHS2lKD5gV1z994n626HIoTSno64aopiUbAGTy8/e0Q8/n6BKHmuE7 YamxOSNdbIQgncYs2JDZtFvtcp0MlWsnfga8u/w1WCsmhGFba1F46AVWkuGyGGztTfiB2jK4G98 kG/9CAFQrikZ5/xmw= X-Received: by 2002:a05:600c:6d48:b0:490:9588:bdb6 with SMTP id 5b1f17b1804b1-493f88389c0mr40261455e9.33.1783859858299; Sun, 12 Jul 2026 05:37:38 -0700 (PDT) Received: from fra-x8664 ([2a01:e11:8000:43b0:96d6:566b:35c:7b8c]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-493eb6f3c42sm280280485e9.1.2026.07.12.05.37.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 05:37:37 -0700 (PDT) From: Francesco Magazzu To: Lyude Paul , Danilo Krummrich Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Dan Carpenter , Karol Herbst Subject: [PATCH v2 3/4] drm/nouveau/device: don't use the pstate cursor after the loop Date: Sun, 12 Jul 2026 14:36:15 +0200 Message-ID: <20260712123616.1180830-4-postadelmaga@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260712123616.1180830-1-postadelmaga@gmail.com> References: <20260712123616.1180830-1-postadelmaga@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nvkm_control_mthd_pstate_attr() looks up the pstate at the index supplied by userspace by walking clk->states, and then keeps using the list_for_each_entry cursor after the loop. This is not triggerable today: the function already rejects args->v0.state >=3D clk->state_nr before the loop, and clk->state_nr is kept in sync with the number of entries on clk->states, so the lookup always breaks on a real entry. Should the loop ever run to completion, the cursor would point at the list head rather than at a pstate, and the pstate->base.domain[] read and the walk of pstate->list that follow would read past it. Rather than leave that trap in place, track whether the entry was found and return -EINVAL if it was not, like the other lookup failures in this function. No functional change. Signed-off-by: Francesco Magazzu --- drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c b/drivers/gp= u/drm/nouveau/nvkm/engine/device/ctrl.c index f2e9a0626..28702741a 100644 --- a/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c +++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c @@ -74,6 +74,7 @@ nvkm_control_mthd_pstate_attr(struct nvkm_control *ctrl, = void *data, u32 size) const struct nvkm_domain *domain; struct nvkm_pstate *pstate; struct nvkm_cstate *cstate; + bool found =3D false; int i =3D 0, j =3D -1; u32 lo, hi; int ret =3D -ENOSYS; @@ -104,10 +105,15 @@ nvkm_control_mthd_pstate_attr(struct nvkm_control *ct= rl, void *data, u32 size) =20 if (args->v0.state !=3D NVIF_CONTROL_PSTATE_ATTR_V0_STATE_CURRENT) { list_for_each_entry(pstate, &clk->states, head) { - if (i++ =3D=3D args->v0.state) + if (i++ =3D=3D args->v0.state) { + found =3D true; break; + } } =20 + if (!found) + return -EINVAL; + lo =3D pstate->base.domain[domain->name]; hi =3D lo; list_for_each_entry(cstate, &pstate->list, head) { --=20 2.55.0 From nobody Sat Jul 25 23:03:39 2026 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5ABF43A6F00 for ; Sun, 12 Jul 2026 12:37:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783859864; cv=none; b=Cm0sWPVFdWm00bBdkfrckjj3HiwTd9timW8TQgyZFTKKmUtT/N/746xZhqM2zSNoaTXfLKWwFxBz9ArKdifSdLUoKVChJ9ClqXuw7kJQYL8IfdfHucYDsIHIP3pt0KYBwdRQX3tNjfqVRLiH6UaKPWz3Fw/CSezD36OUEWoIleI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783859864; c=relaxed/simple; bh=syj38HJ0/UXCc9P3lZdkd0oDCkLRFetu02r9wiSP/wI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=l97mcpY0/mUpsNGOSIE4jxsRLuv4HchHunYWhEp7ojErKZTi/oBcuSO8MYg3wUq2WWU6zlH9D48E6lbz+s6c3xtAaUDCS9V0DwDBc/yrj6NT0hOODO0GETgz6Z2pmkyhYEYmdDBf8+HJS/hT/rhPYAQ5Q+9LIjdzpfhJhD2th9s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=FmWPzPMU; arc=none smtp.client-ip=209.85.128.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="FmWPzPMU" Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-493f2e39e81so8135055e9.2 for ; Sun, 12 Jul 2026 05:37:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783859862; x=1784464662; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=hNARwloA3rbnFq4jTz32GunvMhdlXc/eq0tF3XfoMbU=; b=FmWPzPMUCfP2+l+q5fjnA/Wp0SoKU2TqpNp/KJjH5CMNNMfyQS3wT7lu2IwKfWcPr9 xwfioYomK1IAU5/gLY2eSxvKWZcqfaoHS8eVoxd++loSGvYCpuQBVf4q8CmF45ZvHDNh YYQC2MgIEJItdHnxV1n40gGlL7x8LB2b70iPW/O0X2bYtDX99KlFIGpBDcjjewOa7Bm3 8RFnQjfD7mpsi+GBcQSb07KUybCNbwFutWAIvliKZYnfQe5gheLRSHrZkpSRC/ybZKaK 1i8+dmlHfADGJW7U8gTwAttllY0jqT8WAn08G6si+VRNFuzPi+nzQcwGPGbHXHbwtEHQ BO3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783859862; x=1784464662; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=hNARwloA3rbnFq4jTz32GunvMhdlXc/eq0tF3XfoMbU=; b=LiH1XwxIExtXVhPQ0UwdWT79KjKkPvJY/IOUobonIu/rBoNIysbVPgm2IB07QeBwAe zo8avcJ4oIyjAbnn98f4VB7+jhStw7qmvXjTH/O+nLxJnyyw4C+7Qo+asn81Q9l3a5f0 /kdrxp1nYU6aDoOGb4jyAKwkV3bXrTsUV4C0LGyyuQEJW+ToShXO4ozGFScXmKLp6N+l 5AgVTW5XOGsc0qUatyqnSBpf5cLLlfY9FQ2CTIRhB/D+7rMjjKz4KeycKQlM6opjEyBz R543a/gSFARZbD3OStMSFdTMvWFx2Fxc5nB0uWnj++417ONDMF7c8TtjBwdrgcYGURAd APkQ== X-Forwarded-Encrypted: i=1; AHgh+RqvLXkLYl8+V4Gn7fzmdYRyc+Vw1oKKOKO9h+e184Ij1EQXVsi4K2aBpLx5OnqN84zeJr+HvT5/2OSE+w0=@vger.kernel.org X-Gm-Message-State: AOJu0Yycvrtolb1evHjKbCe/xGS5nl1PzbYNTtejlN7q3bTzTuVhtgIq kPJ9fM3iKdy+7SmY7gd8a8TaSv4QS6m9DUz6XCrayKx2ZgUE+N4LpU+J X-Gm-Gg: AfdE7clA6sMl5FVW2HFLon/COtsaG+6yNpt1OYtt52FkLIL9+0TF7HiGT2nU6fC0AfZ Dx9hfM1/gixHHoTi7symjnNcHHBMTrdA9W7YjgnHSs1vjJcwENYT35SGXyvsC6+H6vADTJSXQrN jvgmXy/QbCGQD3y5fiRBJfvbjcAeQHmx4Nj3SlRNCpE86Vay6qLRpUt+XeAXyXSTHCdu5I3cyyc EiXl5AfAITuDL9VIFBc0hQyUdsXFEJZZ/aj3z4QP09/Ai5ELmOLZCiV4XaqFKZEV9Kb7ZlR/9cc 1gY/GzHAUjybs90VnbND8IE0E++v5jqDRfAmwI0PpJxJKNmoG5LPH+ClrJAXU7WSdhihjvY3BQD Kisin/pG0PP9iYX3Ht1B6Qry5z6HStfT3bfv38q1kTInPUDKRfumVDtmjW3dxCXzyeY/JTOUP2W 6YETkRu/XxOYumZOfGWoE9riSvIw== X-Received: by 2002:a05:600c:45d4:b0:493:a966:d5b5 with SMTP id 5b1f17b1804b1-493f87dc5d3mr55586175e9.2.1783859861600; Sun, 12 Jul 2026 05:37:41 -0700 (PDT) Received: from fra-x8664 ([2a01:e11:8000:43b0:96d6:566b:35c:7b8c]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-493eb6f3c42sm280280485e9.1.2026.07.12.05.37.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 05:37:41 -0700 (PDT) From: Francesco Magazzu To: Lyude Paul , Danilo Krummrich Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Dan Carpenter , Karol Herbst Subject: [PATCH v2 4/4] drm/nouveau/clk: don't clobber reclock status when restoring volt/fan Date: Sun, 12 Jul 2026 14:36:16 +0200 Message-ID: <20260712123616.1180830-5-postadelmaga@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260712123616.1180830-1-postadelmaga@gmail.com> References: <20260712123616.1180830-1-postadelmaga@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nvkm_cstate_prog() reuses 'ret' for the voltage and fan-speed restore calls it makes after reprogramming the clocks. Those calls almost always succeed, so the status of the reclock itself is overwritten and the function reports success even when clk->func->calc() or clk->func->prog() failed. The converse is also true: a successful reclock is reported as an error if the final restore call fails, even though that failure is only logged and otherwise ignored. The only consumer of the return value is the error message in nvkm_pstate_work(), so in practice a failing reclock is simply never reported. Nothing else changes, but a function that returns success on failure is a trap for the next caller. Keep the calc/prog status in 'ret' and use a separate local for the restore calls. Fixes: 3eca809b3c05 ("drm/nouveau/clk: cosmetic changes") Signed-off-by: Francesco Magazzu --- drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c b/drivers/gpu/d= rm/nouveau/nvkm/subdev/clk/base.c index 4d546b07f..05336fc7d 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c @@ -199,16 +199,18 @@ nvkm_cstate_prog(struct nvkm_clk *clk, struct nvkm_ps= tate *pstate, int cstatei) } =20 if (volt) { - ret =3D nvkm_volt_set_id(volt, cstate->voltage, - pstate->base.voltage, clk->temp, -1); - if (ret && ret !=3D -ENODEV) - nvkm_error(subdev, "failed to lower voltage: %d\n", ret); + int err =3D nvkm_volt_set_id(volt, cstate->voltage, + pstate->base.voltage, clk->temp, -1); + + if (err && err !=3D -ENODEV) + nvkm_error(subdev, "failed to lower voltage: %d\n", err); } =20 if (therm) { - ret =3D nvkm_therm_cstate(therm, pstate->fanspeed, -1); - if (ret && ret !=3D -ENODEV) - nvkm_error(subdev, "failed to lower fan speed: %d\n", ret); + int err =3D nvkm_therm_cstate(therm, pstate->fanspeed, -1); + + if (err && err !=3D -ENODEV) + nvkm_error(subdev, "failed to lower fan speed: %d\n", err); } =20 return ret; --=20 2.55.0