From nobody Tue Sep 29 02:02:56 2026 Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9DF264503E4 for ; Thu, 13 Aug 2026 13:14:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786626862; cv=none; b=NsSa74qaUqqLOZMA4L2U54EE+1pNc5X8Z5VlxV4fL6SNrx4UX6fKuADgmd00cA/tk5jc7WBSFKOwzvt/wc1aQfNRb8yDkTcR+ldtVIv16nrdvgt2QbZXwQVHZXioIwIXmPW+heoVwMt7L5ByZQfws8htnNAJypYyIP8GrbXQTdo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786626862; c=relaxed/simple; bh=f/7hmALYx1pUavsqR9dX4xDKx4SJ9Gehp6aIWoZk6lE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=EFKbbZNXSQf9Kbt0QOiPzqtT7sm2dZoscyBUSsW0jBFtcW9FGduA81Xc4qI9hg5j10K1d1ga/9FTawBl6JuyboKa7MupqhHqV5RSrNhB04XrJ56HmTFGoY3RO0micDb8/rpSVxZ8p9ZHtesJbVgeRfUijkJf+qDokBr/IonW1Bc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WwzLHAXA; arc=none smtp.client-ip=209.85.210.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WwzLHAXA" Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-84f3ab8750cso1876096b3a.0 for ; Thu, 13 Aug 2026 06:14:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786626861; x=1787231661; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=lMjx6F1TSzytJZWqY2HUhhf0vDBC3SrSTqRCJ5oQEAA=; b=WwzLHAXAr6YmM8AXF6Mt2kEGyyUFwR/TKLPO49cVUPGiqUgY30qy0pJ+lwh7sV31cj vjTQkEMkkGX86TYLqAMvFyq4S0x29uh3Ffa++PXfE/HzJLSq/ooQ1drzVmLw/Q1QMGgY g6PUIatO7rVVM+gUpAn2B0bpN+lfkPd+QEHCdtPWzfXLdVqdKkUx/rf9CdgNFS8KqGiM e7ZT1s+5/TIr1k3PDFrXJyHriHRAovIrjZrg4Mifp8SDY7wBHqrB17uIGmFgK+dkOLWg /2fNu5q7Nlt712g808AVsHs/kbCyz5tDP34Lj+L6HOCCovCcNl0gak8Rqt92pYDbtBIN 1+JA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786626861; x=1787231661; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=lMjx6F1TSzytJZWqY2HUhhf0vDBC3SrSTqRCJ5oQEAA=; b=gEw4+8GNiFq1WZLpH6dFgzAw5fOu6So3R5GKximl10UxfuDzQohjwvSjuq+dYonNjB hLFW/TclNsyAJQDFbfHMVh42sB4arCCxmAo7dB0E1Mi55PbkEU3qpAiN9Zs3F+c1YXo2 pnb5Kv5hgt/D4yozEoiV9JUZgcieMma3jzOJykJZwPuc8RQcQprevNEwgzuqunLX5bWp +HCBCdjLzjvcVUZAzMkhVoAfGu/NRyEs3Jzb6L0ny5pamKdwOXr9UI/o+atTbXalzq6l 5etcUSVS/X3McXku5hzvoAZF5efDOcTSUPk7mQCsznP0U2jDeUv+MVWcS8GI7kkFuEHu YD7w== X-Forwarded-Encrypted: i=1; AHgh+Rp6ngpouWANSdDI6BA7xa+VLiqscOhMqGylhGrUmBN4sHx6sZ1qMT4+u1nHzAktOyFRvWXkFNyP6QAUvUc=@vger.kernel.org X-Gm-Message-State: AOJu0YwSTNH7HNoc8UBzvsNDtY/HYb1HjaGDVj8NJ+3rQi+FocAr39jT Vf6KQeiPGJDyvTJNZkoeHQFkBa9Y8w/xEpN0exd8L81pKXYqiJLV8GJl X-Gm-Gg: AR+sD10lhFLG44mAzBGSLWI3BQP/r1xiIM7bfbDvu/dBtVRjpJ7BZIwz0HRlN34HF/Q 8+L8UJLbn0AeM1qFDZ7YShvKn0F31Fa4yR3/zKTMaHnRIPaPjqlctgejbT/H/LDHeNeCeXqmhAy JAfVMk7KZYaAJxegkM1YxAqA+UsTZiWgMU/WJLCTRJZR0T7yTnZU2dq69iLkpXKz+t647vo0hKI 9Jgc3l4ey11I9zHc3IkC0G4n5T/c7Fv6QG8KCRZXxOXkl/TpiguSzefe2xL+B78b1JaAPl43hkJ oPNPJGovZ592g5X5CeEz7tF4GTpfbFZhznqYV+HZi1CcJE5sX+NF9SyA1H4RjKxMINtXTbmb8Wf UU98TSHVU3Y5RpoQrSNtzHUt4e9kTzBbmXYQhkoPCZvuoeuhNo4LmisUmBBNgNUyJHkrPbxhUIL yN2pztwZFtPwjNMrUXDy3f808c937Ifej0AWPVuwXUv2KvRxRsmbNNErNhbAA= X-Received: by 2002:a05:6a00:124e:b0:84a:2fff:ced2 with SMTP id d2e1a72fcca58-84fc7694568mr5608723b3a.35.1786626860773; Thu, 13 Aug 2026 06:14:20 -0700 (PDT) Received: from LAPTOP-N3B6U5LC.localdomain ([117.147.100.52]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cbef6a4a4f5sm1084669a12.9.2026.08.13.06.14.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Aug 2026 06:14:20 -0700 (PDT) From: Zhenhao Wan Date: Thu, 13 Aug 2026 21:14:08 +0800 Subject: [PATCH] drm/nouveau: reject zero-size notifier object allocation Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260813-nouveau-abi16-notifierobj-zero-size-v1-1-20dee38077cb@gmail.com> X-B4-Tracking: v=1; b=H4sIAB/DfWoC/yXNQQ6DIBCF4auYWXcSkUhJr9J0ATLacQENiDEa7 95pXb18m/8dUCgzFXg0B2RauXCKAnVrYHi7OBFyEEPXdqa1SmNMdSVX0XlWRrTwyJSTn3GXwcI 7YR+0tTZo4/s7SOmTaeTt//J8XS7VzzQsvzSc5xcN0nxlhwAAAA== X-Change-ID: 20260813-nouveau-abi16-notifierobj-zero-size-5d3888d36b57 To: Lyude Paul , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Ben Skeggs Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Yuhao Jiang , stable@vger.kernel.org, Zhenhao Wan X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786626855; l=1998; i=whi4ed0g@gmail.com; h=from:subject:message-id; bh=f/7hmALYx1pUavsqR9dX4xDKx4SJ9Gehp6aIWoZk6lE=; b=JzBvG33pFgsgUZm3gcV+sluPbY85ddmYsDyvCdNM9M42adhFWTnHbKTyJhu8MgcNPFlyRhplW /1cni1BqMUkAfpVfdotWiTvDnbpRubL+xOM++Kx3OqwfdikGFXjDL70 X-Developer-Key: i=whi4ed0g@gmail.com; a=ed25519; pk=zRTKlstE0LmilshGwJsFYEVjiT6RiXMBXK8Og6VmuVQ= nouveau_abi16_ioctl_notifierobj_alloc() passes the userspace-controlled info->size to nvkm_mm_head() as both size_max and size_min without a lower bound. A zero size satisfies the allocator's "e - s < size_min" gate (size_min =3D=3D 0 makes the unsigned comparison inert) and yields a zero-length node, after which args.limit =3D ntfy->node->offset + ntfy->node->length - 1; underflows (offset 0, length 0 -> 0xffffffff) into an oversized ~4 GiB DMA window. The dma object constructor only rejects start > limit, so the validly ordered [base, base + 0xffffffff] range passes and is programmed into the GPU DMA context. The ioctl is DRM_RENDER_ALLOW, so any render node client can trigger this on pre-Fermi hardware. Reject a zero-size request before allocating anything. Fixes: ebb945a94bba ("drm/nouveau: port all engines to new engine module fo= rmat") Reported-by: Yuhao Jiang Assisted-by: Claude:claude-opus-5 Cc: stable@vger.kernel.org Signed-off-by: Zhenhao Wan Reviewed-by: Lyude Paul --- drivers/gpu/drm/nouveau/nouveau_abi16.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouv= eau/nouveau_abi16.c index 291203121f0c..8d139bbb2934 100644 --- a/drivers/gpu/drm/nouveau/nouveau_abi16.c +++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c @@ -660,6 +660,10 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS) if (unlikely(device->info.family >=3D NV_DEVICE_INFO_V0_FERMI)) return nouveau_abi16_put(abi16, -EINVAL); =20 + /* zero size yields a zero-length node, underflowing args.limit */ + if (unlikely(!info->size)) + return nouveau_abi16_put(abi16, -EINVAL); + chan =3D nouveau_abi16_chan(abi16, info->channel); if (!chan) return nouveau_abi16_put(abi16, -ENOENT); --- base-commit: db2ddb87143519e20a95aa36c60b36107b736a58 change-id: 20260813-nouveau-abi16-notifierobj-zero-size-5d3888d36b57 Best regards, -- =20 Zhenhao Wan