drm/nouveau: validate required NET_img regions

[PATCH] drm/nouveau: validate required NET_img regions

Posted by Slavin Liu 1 week, 4 days ago

The NET_img parser can finish without all FECS and GPCCS regions.
Reject missing required regions before computing their data addresses,
and release the firmware on both validation and ACR loading failures.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: c4bdac754ca0 ("drm/nouveau/gr/ga102: initial support")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
---
 drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c
index 2b51f1d0c281..bfd1e00537b8 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c
@@ -317,6 +317,11 @@ ga102_gr_load(struct gf100_gr *gr, int ver, const struct gf100_gr_fwif *fwif)
 		}
 	}
 
+	if (!fecs_inst || !fecs_data || !gpccs_inst || !gpccs_data) {
+		ret = -EINVAL;
+		goto out_firmware;
+	}
+
 	ret = nvkm_acr_lsfw_load_bl_sig_net(subdev, &gr->fecs.falcon, NVKM_ACR_LSF_FECS,
 					    "gr/fecs_", ver, fwif->fecs,
 					    fw->data + fecs_inst->data_offset,
@@ -324,7 +329,7 @@ ga102_gr_load(struct gf100_gr *gr, int ver, const struct gf100_gr_fwif *fwif)
 					    fw->data + fecs_data->data_offset,
 						       fecs_data->data_size);
 	if (ret)
-		return ret;
+		goto out_firmware;
 
 	ret = nvkm_acr_lsfw_load_bl_sig_net(subdev, &gr->gpccs.falcon, NVKM_ACR_LSF_GPCCS,
 					    "gr/gpccs_", ver, fwif->gpccs,
@@ -333,12 +338,13 @@ ga102_gr_load(struct gf100_gr *gr, int ver, const struct gf100_gr_fwif *fwif)
 					    fw->data + gpccs_data->data_offset,
 						       gpccs_data->data_size);
 	if (ret)
-		return ret;
+		goto out_firmware;
 
 	gr->firmware = true;
 
+ out_firmware:
 	nvkm_firmware_put(fw);
-	return 0;
+	return ret;
 }
 
 static const struct gf100_gr_fwif

Re: [PATCH] drm/nouveau: validate required NET_img regions

Posted by lyude@redhat.com 1 week, 3 days ago

Hi. What bug are you fixing here?

On Sun, 2026-09-13 at 20:52 +0800, Slavin Liu wrote:
> The NET_img parser can finish without all FECS and GPCCS regions.
> Reject missing required regions before computing their data
> addresses,
> and release the firmware on both validation and ACR loading failures.
> 
> Detected by static analysis and reviewed with AI-assisted source
> auditing.
> 
> Fixes: c4bdac754ca0 ("drm/nouveau/gr/ga102: initial support")
> Assisted-by: LLM
> Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
> ---
>  drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c
> b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c
> index 2b51f1d0c281..bfd1e00537b8 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ga102.c
> @@ -317,6 +317,11 @@ ga102_gr_load(struct gf100_gr *gr, int ver,
> const struct gf100_gr_fwif *fwif)
>  		}
>  	}
>  
> +	if (!fecs_inst || !fecs_data || !gpccs_inst || !gpccs_data)
> {
> +		ret = -EINVAL;
> +		goto out_firmware;
> +	}
> +
>  	ret = nvkm_acr_lsfw_load_bl_sig_net(subdev, &gr-
> >fecs.falcon, NVKM_ACR_LSF_FECS,
>  					    "gr/fecs_", ver, fwif-
> >fecs,
>  					    fw->data + fecs_inst-
> >data_offset,
> @@ -324,7 +329,7 @@ ga102_gr_load(struct gf100_gr *gr, int ver, const
> struct gf100_gr_fwif *fwif)
>  					    fw->data + fecs_data-
> >data_offset,
>  						       fecs_data-
> >data_size);
>  	if (ret)
> -		return ret;
> +		goto out_firmware;
>  
>  	ret = nvkm_acr_lsfw_load_bl_sig_net(subdev, &gr-
> >gpccs.falcon, NVKM_ACR_LSF_GPCCS,
>  					    "gr/gpccs_", ver, fwif-
> >gpccs,
> @@ -333,12 +338,13 @@ ga102_gr_load(struct gf100_gr *gr, int ver,
> const struct gf100_gr_fwif *fwif)
>  					    fw->data + gpccs_data-
> >data_offset,
>  						       gpccs_data-
> >data_size);
>  	if (ret)
> -		return ret;
> +		goto out_firmware;
>  
>  	gr->firmware = true;
>  
> + out_firmware:
>  	nvkm_firmware_put(fw);
> -	return 0;
> +	return ret;
>  }
>  
>  static const struct gf100_gr_fwif