From: Jim Cromie <jim.cromie@gmail.com>
To: Lyude Paul <lyude@redhat.com>, Danilo Krummrich <dakr@kernel.org>,
Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
Maxime Ripard <mripard@kernel.org>,
Thomas Zimmermann <tzimmermann@suse.de>,
David Airlie <airlied@gmail.com>, Simona Vetter <simona@ffwll.ch>
Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org,
linux-kernel@vger.kernel.org, Jim Cromie <jim.cromie@gmail.com>
Subject: [PATCH 0/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM and GET_ZCULL_INFO ioctls
Date: Sat, 15 Aug 2026 11:30:51 -0600 [thread overview]
Message-ID: <20260815-null-fixes-v1-0-0df9dda951fb@gmail.com> (raw)
When Nouveau initialization is incomplete (e.g. firmware microcode fails
to load or graphics engine initialization aborts early), userspace display
servers (GNOME/Mesa) probing device capabilities trigger fatal kernel NULL
pointer dereferences in the Nouveau ioctl handlers.
This 2-patch series fixes two distinct NULL pointer crash paths:
1. drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl
- Prevents NULL dereference of gr, gr->func, and nvkm_device->func in
nouveau_abi16_ioctl_getparam(). Returns -ENODEV cleanly.
2. drm/nouveau: Fix NULL pointer dereference in GET_ZCULL_INFO ioctl
- Checks that gr is non-NULL before inspecting gr->has_zcull_info at
offset 0xf0 in nouveau_abi16_ioctl_get_zcull_info().
Both bugs were reproduced and verified fixed on GA107 (NVIDIA GeForce
RTX 3050 Mobile) running 7.2-rc7 under GNOME Wayland desktop initialization.
Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
---
Jim Cromie (2):
drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl
drm/nouveau: Fix NULL pointer dereference in GET_ZCULL_INFO ioctl
drivers/gpu/drm/nouveau/nouveau_abi16.c | 27 ++++++++++++++++++++++-----
1 file changed, 22 insertions(+), 5 deletions(-)
---
base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
change-id: 20260815-null-fixes-5e9e86666a5d
Best regards,
--
Jim Cromie <jim.cromie@gmail.com>
next reply other threads:[~2026-08-15 17:31 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-15 17:30 Jim Cromie [this message]
2026-08-15 17:30 ` [PATCH 1/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl Jim Cromie
2026-08-15 17:40 ` sashiko-bot
2026-08-15 17:30 ` [PATCH 2/2] drm/nouveau: Fix NULL pointer dereference in GET_ZCULL_INFO ioctl Jim Cromie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260815-null-fixes-v1-0-0df9dda951fb@gmail.com \
--to=jim.cromie@gmail.com \
--cc=airlied@gmail.com \
--cc=dakr@kernel.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lyude@redhat.com \
--cc=maarten.lankhorst@linux.intel.com \
--cc=mripard@kernel.org \
--cc=nouveau@lists.freedesktop.org \
--cc=simona@ffwll.ch \
--cc=tzimmermann@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.