From nobody Tue Sep 29 04:12:44 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0CC4B46EC69 for ; Wed, 12 Aug 2026 15:00:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786546850; cv=none; b=r+u2aeAIYdx1T4BbgwWfQ4vzwOtnrqeWf9K8fTbOHIj2r0ZZVTF7w82k4ta1DP3fIm3yit7LmGnuIXXjNgoQ6EKQWHMC62+bWDCJa6ajMeqVexARwp8Ywz2AIG3WN9Dmqzg7nYqArpue+U8F3npR9rKElEwKa2TiNBWo2pT44FE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786546850; c=relaxed/simple; bh=U4T7yVA0PCbP5g0s2yLY6Rg/fJ0eJtWweG0p/5LOj4Q=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=OFTMSD3eilJlY3hTkdQiRH/iZlgGlWAxDSlejGx1V19YqS/esfpaWgjESIzQCW2TSE21KCjfkkK5tPFbPGAxRPpR/Z8YzNm9fubXw2r4pcFJ2+9NlZR3BCmc1WC595cNdFp/o/kIEq0Wt2BGeuwppzy+Vfueh58jEzC0qQfFxW4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=hNEueG9B; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="hNEueG9B" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-38511175ad3so972106a91.2 for ; Wed, 12 Aug 2026 08:00:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786546837; x=1787151637; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Q5RKCcCs+aO4MrLdOnYHMwBF2RezT4AlJ4Gp/mR+XLo=; b=hNEueG9BFf8R/eAZqHfqgecpRryS5yzK8+vl4IT9oBQQnry0vjEILRIXuA3C1W4G6K 4LiuVFrZdyIJuf/KwFhDNlT+eYjHbUp+CpIiLr8DZW9c9KcImfAkjVepNblyRmhaFTqd L3miW0fvYxpGx8sxVZ1ShK2gtCtdCzxJew19YbCVpM0vLujvvToeUwBzWZM0M0DvOX3b IM7b4ht6kqxF4i/PkzORK6T9TnxUVD1vEjgK+Wo28QtiuFr6Qu1mII8LDUfmsqusf9DP FWeBZ2ext6Ri0gtE7GD+FaSnVEJX0+V6PLrGlqJFiKbJYgVwkuevx0MuAK5I/FOiMYWO w2ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786546837; x=1787151637; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Q5RKCcCs+aO4MrLdOnYHMwBF2RezT4AlJ4Gp/mR+XLo=; b=fv1FpRp8Hwur5EOo7UfZjES8+xKSfua2ELFO7rdlUoXC+Iofyv8O8H3ie7ekBkJ7Y8 epHCqmGOoWyVtr2z48VbrdB6+tcz0zu43eUrAtyiKHTddBlSxGVrhcQt/ExTt68RVjuk QFNH5+6NHM1TBheXQQ96xTGo+0hBwwhV1ah7cxWkRqPvKmNmlnCB+Q8VS2nv4YwakX8i mkROMPHtzEWdatKwyYaIpKB1NPStVZKL31mFrZFjPesonOzQz7AT5s3+IZWwBO7NuNQe 6yirifrvn4YJsThccy1wW7idgBGDAHkohj4rLjWYvdXhVQw63y8QOK4wDU+eBO2gIYMh aM4w== X-Forwarded-Encrypted: i=1; AHgh+RrbTC8F0j17USh4/Pz7gEle+8SnVOgPLEVUD0VCm5kMByhKeG0pytBkb/qwTkKR6nsWwhJ22NV2XCDd8EU=@vger.kernel.org X-Gm-Message-State: AOJu0YwC4HvbJgIW/+GFzJNgtqvje/Rflea1P02XjS6zPFyvfp83p/iN 0mMciyTt7/da6xvxkwL6iwmchWaYjKJEHxhnasQKSVZOcnY2Ss8xIFcf X-Gm-Gg: AR+sD133yVYh+cwDY7xzaKPTUBMlgzB4SgbpJQjM1pC2MLhyHPolb2Cztcj6wlesufH 3p2w81tHSkxSjflfY3IMHbujB9xxx+eXBc9qJ9BG6IrQMql2axtNBlQPabwzCHxP94D4Aixk6u4 aillUuA9asMlpEnC0dA+B1x850bL9ogV6d/7NzPdRm3itt+GY85NFh5E5q3cFyk4vGEpYtExyoU etMlsq5uxS/xT9Xv7GXaSzZQeiEjiR2UV9KLoFlrir/hBPAEVZUlT+ywsrWAmmWn6K8721AiCiv 2ht6HqAQ22buqrzM2uLtFX+McVabMjqYCjEVKqM0hEwZpPdtQjN85Na3dOrXUo1aoogua/2yPUO 9DJzrRGqV1T+TAJNSB3UsY0fP7xPKyjUjtKzoR+bHmG4ATnmw6YB3CpB9EEE3fq4YXhTXu7HdKH 2AeUXOR9WuRc/y0QyYh16Auvd+21xAyiMzeuzpOfjMzcHnI8Q09a2HfqnQCxxq X-Received: by 2002:a17:90b:2d87:b0:38e:1497:af5b with SMTP id 98e67ed59e1d1-393013c41e8mr6639072a91.1.1786546836771; Wed, 12 Aug 2026 08:00:36 -0700 (PDT) Received: from LAPTOP-N3B6U5LC.localdomain ([117.147.100.52]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-392f935f73csm3896491a91.6.2026.08.12.08.00.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Aug 2026 08:00:36 -0700 (PDT) From: Zhenhao Wan Date: Wed, 12 Aug 2026 23:00:04 +0800 Subject: [PATCH 1/2] drm/nouveau/sw: prevent NULL deref of disp in vblank methods Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260812-nouveau-nvkm-absent-subdev-null-deref-v1-1-7e057f6aeba0@gmail.com> References: <20260812-nouveau-nvkm-absent-subdev-null-deref-v1-0-7e057f6aeba0@gmail.com> In-Reply-To: <20260812-nouveau-nvkm-absent-subdev-null-deref-v1-0-7e057f6aeba0@gmail.com> To: Lyude Paul , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Yuhao Jiang , stable@vger.kernel.org, Zhenhao Wan X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786546828; l=2686; i=whi4ed0g@gmail.com; h=from:subject:message-id; bh=U4T7yVA0PCbP5g0s2yLY6Rg/fJ0eJtWweG0p/5LOj4Q=; b=zuoq23EqGDpiTQ22kZ6ODTRR2vhXOyPyC1C+c7ujp9yvu7qEc12Nu3mhBQN/oi2bH0Mkqjldp cfH5yZjZk6/CGDGFIQxyquHlnS8uQjUtZ8Pu9QRDOQ4/mxFg8b8kqGN X-Developer-Key: i=whi4ed0g@gmail.com; a=ed25519; pk=zRTKlstE0LmilshGwJsFYEVjiT6RiXMBXK8Og6VmuVQ= The NV50 and GF100 software-class vblank methods nv50_sw_chan_mthd() and gf100_sw_chan_mthd() evaluate "data < device->disp->vblank.index_nr" to validate the requested vblank head before allowing its notifier. On a headless card the display subdevice is absent: nvkm_subdev_disable() (strap-driven from devinit) and the -ENODEV path of the NVKM_LAYOUT_ONCE device constructor both leave device->disp =3D=3D NULL while the device continues to probe and still registers a render node (DRIVER_RENDER). An unprivileged client holding a /dev/dri/renderD* fd can then create a software channel and push method 0x0408 (NV50) / 0x040c (GF100), which dereferences the NULL device->disp and oopses the kernel. The channel constructors nv50_sw_chan_new() and gf100_sw_chan_new() already tolerate an absent display ("for (i =3D 0; disp && ...)"), so no vblank notifier is ever registered on such a card and the method handlers are the only path that assumes disp is present. Guard the dereference with the same disp NULL test the constructors already use. Reported-by: Yuhao Jiang Assisted-by: Claude:claude-opus-5 Cc: stable@vger.kernel.org Signed-off-by: Zhenhao Wan --- drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c b/drivers/gpu/d= rm/nouveau/nvkm/engine/sw/gf100.c index 0171cdf6f639..4cf8cd120c76 100644 --- a/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c +++ b/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c @@ -72,7 +72,7 @@ gf100_sw_chan_mthd(struct nvkm_sw_chan *base, int subc, u= 32 mthd, u32 data) chan->vblank.value =3D data; return true; case 0x040c: - if (data < device->disp->vblank.index_nr) { + if (device->disp && data < device->disp->vblank.index_nr) { nvkm_event_ntfy_allow(&chan->vblank.notify[data]); return true; } diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c b/drivers/gpu/dr= m/nouveau/nvkm/engine/sw/nv50.c index 0cfb1eaae6de..b202e11238a5 100644 --- a/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c +++ b/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c @@ -69,7 +69,7 @@ nv50_sw_chan_mthd(struct nvkm_sw_chan *base, int subc, u3= 2 mthd, u32 data) case 0x0400: chan->vblank.offset =3D data; return true; case 0x0404: chan->vblank.value =3D data; return true; case 0x0408: - if (data < device->disp->vblank.index_nr) { + if (device->disp && data < device->disp->vblank.index_nr) { nvkm_event_ntfy_allow(&chan->vblank.notify[data]); return true; } --=20 2.34.1 From nobody Tue Sep 29 04:12:44 2026 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B522F4749C8 for ; Wed, 12 Aug 2026 15:00:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786546853; cv=none; b=aKCUbZv/Po0ky7nsHpi/dJaHmhIJGRf5XjvgpRkN4RzwTahBVQ61Hk0YXURYwSeHOvXRcf6zR0R/3Lqe3/pj0T5OujWhqS5SarrhVNFEcm4WaIlGVG/mBNaa9Vx2dyKdUx8In5fCl4CtatqKFrfQT/1HyWjnD9P8u8rSsIrVyD4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786546853; c=relaxed/simple; bh=DHIfdikRkZ3mKShlh/+V7tgkqvRSlEckIAj2mwx7osQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=KC2INdrDJk2m8phGwZjjkreIBXMCFdqjem8AzYQVJSPyCOtupeZYiHx+hKFZ9lH2Aq5mjaHTM3HOUNy6Hr5XwTMom0ovgx/AvbaQJn1yHAUvgSeOgu3UKYWXq0ktJlqd/QUAF7uyh17mSpNsN87Ha51n94eSZTa6n3YbY7rcopg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=DCx51Aij; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="DCx51Aij" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-38dcbade417so1249159a91.1 for ; Wed, 12 Aug 2026 08:00:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786546842; x=1787151642; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=gMOizgIP9BJQteM6A8h6tNJgWMELd3MPmjUznwQtZHY=; b=DCx51AijNjNrBVKXBrN/3lItroBwd/0OwR30xPUd0FwzXYNZWbP7SHn1G/Wxzxcjyu mztfeW8ZJ99H3ukQsMnYYhvGkmUPguUr3or4uhCkdSP8ji+nUfOu+Z+W+GzLccB1bhXD p0vGHt65yLsO3rNYf2E/JaMZphV7AFUPMqNeBlY1PFcJ44iKpBC9WVdDmy562Wm4Y5/c yyxnd5QnEqHM7+WSn8PPwQL1shzTGQBRz/pmJRVbCJtV54XxV9lojqaI9RBZG3dBMt5s 8ZWvF0PYFcKwH0T9OeHiLg2RGLaoowRKk5gmmDr2ZVB2R+btBlvgGTApWlzedijPQVR5 NBag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786546842; x=1787151642; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=gMOizgIP9BJQteM6A8h6tNJgWMELd3MPmjUznwQtZHY=; b=qgdi7fNdYNShjR4v3OAjRYWLaZ2SrWJFJ/fR70TqZBzq8951StFfdsuEy+ydKRMuz/ FjjpbKctc8lzzei2a8hiSvZreu1b5qUwYgsxu/Gf9L3kisRcqiVpbuCt6fHQtsf0XjGg bA3Y86Le6ATKWhl8aVm+PloznOBGbsuM06uQMV3GyKVEdpareTzlPaqfWqpqOPy5V4Bi EjTj5xJFhF7PK/hsCNZf/r2O3354uoflMMi0pmf819BLKuZ27ewBKpIs0gVUGiwocjui u6oFmL68Ord4zOvtU+rO/CvZ8hhwA7WDDkyRW5Ikrxfe+x2ZkjhDA1+aaEGE1vUax8fN tjMw== X-Forwarded-Encrypted: i=1; AHgh+Rpw5ywmG7V87k9KuZxeFTDY1UQmJI6QGswtTSLMnt+8Q3dPoOYzfeCnKHJsTWng8RLX+DzxujRUT6VUQi4=@vger.kernel.org X-Gm-Message-State: AOJu0YxgC2I9DlR6XJLw446Q5DzJqPBNeb6fJDDN3+F1nkAamfIiggHM clmB/DSXz2fLnyW6pgE0wY2rqLUCsrKQpv0+sbV4ok0Oi4zajqVtlStM X-Gm-Gg: AR+sD13OkjnqRMJwyNz9ZvFUiNSXy9VF2aVaGlI8eUDaZcz/+9SCxvNpITih8hEGaMp 95ktwDIrsXFdnDwUvx+tMCNgVyhjoo/ZCgSSdX1EtrGqEtIm6SrGQKcKJdZFVAEzgW6WRKO6xkY yRGTIrS9KAnxxpX1JG8aqrQyZdOSLBD2C9gRyYkNPmhOox577il7+1R/fGZRX/US42CNZdTrvdy 2NiLh2YN/X0KcFPddU/telQYzbHgQj1XNji5h6EURC+MYgpMYyD9Mj0YGIcm/DKRMWdfrgycWQx PWGxouHbSUdlHszWncgTco07WcykHdO7pHB0Gzq3OZAdM698pmb8x0/6vbocWpFhiYBdOqCsWyl nqa7uZTo66v4l/RLJhVUy4rt++y18DEIwIPVrlaClAz+gT0xPDmjwWsCPJ/tHZzmYbqJ4MOVdsa H4WaKcsAnHy02lpTMLiO9vSBtjnbmiIC9OYD7hha04NnMZ9qDnuYbCHIwWbJM= X-Received: by 2002:a17:90a:dfce:b0:38e:c7b0:84ad with SMTP id 98e67ed59e1d1-39300fe8cb7mr6781997a91.0.1786546841182; Wed, 12 Aug 2026 08:00:41 -0700 (PDT) Received: from LAPTOP-N3B6U5LC.localdomain ([117.147.100.52]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-392f935f73csm3896491a91.6.2026.08.12.08.00.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Aug 2026 08:00:40 -0700 (PDT) From: Zhenhao Wan Date: Wed, 12 Aug 2026 23:00:05 +0800 Subject: [PATCH 2/2] drm/nouveau: prevent NULL deref of gr in GETPARAM_GRAPH_UNITS Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260812-nouveau-nvkm-absent-subdev-null-deref-v1-2-7e057f6aeba0@gmail.com> References: <20260812-nouveau-nvkm-absent-subdev-null-deref-v1-0-7e057f6aeba0@gmail.com> In-Reply-To: <20260812-nouveau-nvkm-absent-subdev-null-deref-v1-0-7e057f6aeba0@gmail.com> To: Lyude Paul , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Yuhao Jiang , stable@vger.kernel.org, Zhenhao Wan X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786546828; l=1659; i=whi4ed0g@gmail.com; h=from:subject:message-id; bh=DHIfdikRkZ3mKShlh/+V7tgkqvRSlEckIAj2mwx7osQ=; b=HXxJzWcsyd2sKVHR1T+erLcdLCL/gkjA+9ra5ROLCdEp3ElbPtmAtHX0Jsk42Eej69Bbe3s1z JWrY3tlQYitDwdc3sM1wMfPD79z2pvggbmWqZhaxh2KZjHZR0tFAaXe X-Developer-Key: i=whi4ed0g@gmail.com; a=ed25519; pk=zRTKlstE0LmilshGwJsFYEVjiT6RiXMBXK8Og6VmuVQ= nouveau_abi16_ioctl_getparam() fetches the graphics engine with gr =3D nvxx_gr(drm) (i.e. drm->nvkm->gr) and, for the NOUVEAU_GETPARAM_GRAPH_UNITS parameter, passes it straight to nvkm_gr_units(), which dereferences gr->func with no NULL check. When graphics-engine construction returns -ENODEV, NVKM treats it as an optional absent engine: the NVKM_LAYOUT_ONCE device constructor deletes the subdevice, leaves device->gr =3D=3D NULL and continues probing, and Nouveau still registers a render node. An unprivileged client holding a /dev/dri/renderD* fd can then issue DRM_IOCTL_NOUVEAU_GETPARAM with NOUVEAU_GETPARAM_GRAPH_UNITS and oops the kernel on the NULL gr. Report 0 units when gr is absent. This matches nvkm_gr_units() itself, which already returns 0 when the engine exposes no units callback. Reported-by: Yuhao Jiang Assisted-by: Claude:claude-opus-5 Cc: stable@vger.kernel.org Signed-off-by: Zhenhao Wan --- drivers/gpu/drm/nouveau/nouveau_abi16.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouv= eau/nouveau_abi16.c index 291203121f0c..dd3f8d386377 100644 --- a/drivers/gpu/drm/nouveau/nouveau_abi16.c +++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c @@ -306,7 +306,7 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS) getparam->value =3D 1; break; case NOUVEAU_GETPARAM_GRAPH_UNITS: - getparam->value =3D nvkm_gr_units(gr); + getparam->value =3D gr ? nvkm_gr_units(gr) : 0; break; case NOUVEAU_GETPARAM_EXEC_PUSH_MAX: { int ib_max =3D getparam_dma_ib_max(device); --=20 2.34.1