Re: [PATCH 2/2] drm/nouveau: prevent NULL deref of gr in GETPARAM_GRAPH_UNITS

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch fixes a NULL pointer dereference for `gr` in `nouveau_abi16_ioctl_getparam()`, but misses an identical vulnerability in `nouveau_abi16_ioctl_get_zcull_info()` within the same file.
--

--- Patch [2]: [PATCH 2/2] drm/nouveau: prevent NULL deref of gr in GETPARAM_GRAPH_UNITS ---
commit 368f46fbd7701fc98a09aa941af876abf6e518b8
Author: Zhenhao Wan <whi4ed0g@gmail.com>

drm/nouveau: prevent NULL deref of gr in GETPARAM_GRAPH_UNITS

This patch prevents a NULL pointer dereference in nouveau_abi16_ioctl_getparam()
when an unprivileged client requests NOUVEAU_GETPARAM_GRAPH_UNITS. If the
graphics engine is absent, gr is NULL, which previously oopsed the kernel.

> diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
> index 291203121f0c2..dd3f8d386377f 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
> @@ -306,7 +306,7 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
>  		getparam->value = 1;
>  		break;
>  	case NOUVEAU_GETPARAM_GRAPH_UNITS:
> -		getparam->value = nvkm_gr_units(gr);
> +		getparam->value = gr ? nvkm_gr_units(gr) : 0;
>  		break;
>  	case NOUVEAU_GETPARAM_EXEC_PUSH_MAX: {
>  		int ib_max = getparam_dma_ib_max(device);

[Severity: High]
This is a pre-existing issue, but does a similar NULL pointer dereference
vulnerability exist slightly further down in the same file?

If the graphics engine is absent (making gr == NULL), could an unprivileged
client calling DRM_IOCTL_NOUVEAU_GET_ZCULL_INFO trigger a kernel oops here?

drivers/gpu/drm/nouveau/nouveau_abi16.c:nouveau_abi16_ioctl_get_zcull_info() {
	...
	struct nvkm_gr *gr = nvxx_gr(drm);
	struct drm_nouveau_get_zcull_info *out = data;

	if (gr->has_zcull_info) {
	...
}

Should nouveau_abi16_ioctl_get_zcull_info() also check if gr is valid before
dereferencing it?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260812-nouveau-nvkm-absent-subdev-null-deref-v1-0-7e057f6aeba0@gmail.com?part=2