[PATCH 0/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM and GET_ZCULL_INFO ioctls

[PATCH 0/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM and GET_ZCULL_INFO ioctls

[Jim Cromie]

When Nouveau initialization is incomplete (e.g. firmware microcode fails
to load or graphics engine initialization aborts early), userspace display
servers (GNOME/Mesa) probing device capabilities trigger fatal kernel NULL
pointer dereferences in the Nouveau ioctl handlers.

This 2-patch series fixes two distinct NULL pointer crash paths:

1. drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl
   - Prevents NULL dereference of gr, gr->func, and nvkm_device->func in
     nouveau_abi16_ioctl_getparam(). Returns -ENODEV cleanly.

2. drm/nouveau: Fix NULL pointer dereference in GET_ZCULL_INFO ioctl
   - Checks that gr is non-NULL before inspecting gr->has_zcull_info at
     offset 0xf0 in nouveau_abi16_ioctl_get_zcull_info().

Both bugs were reproduced and verified fixed on GA107 (NVIDIA GeForce
RTX 3050 Mobile) running 7.2-rc7 under GNOME Wayland desktop initialization.

Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
---
Jim Cromie (2):
      drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl
      drm/nouveau: Fix NULL pointer dereference in GET_ZCULL_INFO ioctl

 drivers/gpu/drm/nouveau/nouveau_abi16.c | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)
---
base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
change-id: 20260815-null-fixes-5e9e86666a5d

Best regards,
-- 
Jim Cromie <jim.cromie@gmail.com>

[PATCH 1/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl

[Jim Cromie]

When hardware or firmware initialization fails, the graphics engine
(gr) or device functions may remain NULL. Attempting to access these
during the GETPARAM ioctl (e.g., NOUVEAU_GETPARAM_GRAPH_UNITS) results
in a kernel NULL pointer dereference, causing a crash when userspace
(GNOME/Mesa) attempts to probe the device.

Add safety checks for 'gr', 'gr->func', and 'nvkm_device->func' in the
ioctl handler. Return -ENODEV to signal the missing hardware state to
userspace, and use NV_ERROR_ONCE to provide diagnostic proof in the
kernel log without risking a console flood.

RFC:

These crashes may not be repeatable, they happened while I was trying
to build nouveau as a builtin module, with binary blobs in the kernel
image, on a laptop with an encrypted disk.  Gemini tells me this won't
work, so I punted.

Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
---
 drivers/gpu/drm/nouveau/nouveau_abi16.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index 291203121f0c..c9270c5b0fac 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -306,7 +306,12 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
 		getparam->value = 1;
 		break;
 	case NOUVEAU_GETPARAM_GRAPH_UNITS:
-		getparam->value = nvkm_gr_units(gr);
+		if (gr && gr->func) {
+			getparam->value = nvkm_gr_units(gr);
+		} else {
+			NV_ERROR_ONCE(drm, "GETPARAM_GRAPH_UNITS: no gr engine or func\n");
+			return -ENODEV;
+		}
 		break;
 	case NOUVEAU_GETPARAM_EXEC_PUSH_MAX: {
 		int ib_max = getparam_dma_ib_max(device);
@@ -315,11 +320,23 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
 		break;
 	}
 	case NOUVEAU_GETPARAM_VRAM_BAR_SIZE:
-		getparam->value = nvkm_device->func->resource_size(nvkm_device, NVKM_BAR1_FB);
+		if (nvkm_device && nvkm_device->func && nvkm_device->func->resource_size) {
+			getparam->value =
+				nvkm_device->func->resource_size(nvkm_device, NVKM_BAR1_FB);
+		} else {
+			NV_ERROR_ONCE(drm, "GETPARAM_VRAM_BAR_SIZE: no device func\n");
+			return -ENODEV;
+		}
 		break;
 	case NOUVEAU_GETPARAM_VRAM_USED: {
-		struct ttm_resource_manager *vram_mgr = ttm_manager_type(&drm->ttm.bdev, TTM_PL_VRAM);
-		getparam->value = (u64)ttm_resource_manager_usage(vram_mgr);
+		struct ttm_resource_manager *vram_mgr =
+			ttm_manager_type(&drm->ttm.bdev, TTM_PL_VRAM);
+		if (vram_mgr) {
+			getparam->value = (u64)ttm_resource_manager_usage(vram_mgr);
+		} else {
+			NV_ERROR_ONCE(drm, "GETPARAM_VRAM_USED: no vram mgr\n");
+			return -ENODEV;
+		}
 		break;
 	}
 	case NOUVEAU_GETPARAM_HAS_VMA_TILEMODE:

-- 
2.55.0

[PATCH 2/2] drm/nouveau: Fix NULL pointer dereference in GET_ZCULL_INFO ioctl

[Jim Cromie]

When graphics engine firmware fails to load or initialization aborts
early, nvxx_gr(drm) returns NULL. Calling DRM_IOCTL_NOUVEAU_GET_ZCULL_INFO
causes nouveau_abi16_ioctl_get_zcull_info() to dereference gr at offset
0xf0 without checking for NULL, triggering a kernel page fault.

Validate that gr is non-NULL before inspecting gr->has_zcull_info.

Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
---
Aug 14 09:21:52 frodo kernel: BUG: kernel NULL pointer dereference, address: 00000000000000f0
Aug 14 09:21:52 frodo kernel: #PF: error_code(0x0000) - not-present page
Aug 14 09:21:52 frodo kernel: Oops: Oops: 0000 [#1] SMP NOPTI
Aug 14 09:21:52 frodo kernel: RIP: 0010:nouveau_abi16_ioctl_get_zcull_info+0x17/0xa0 [nouveau]
Aug 14 09:21:52 frodo kernel: Code: 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 8b 47 40 48 8b 00 48 8b 80 70 02 00 00 <80> b8 f0 00 00 00 00 74 72 8b 90 c0 00 00 00 89 16 8b 90 c4 00 00
Aug 14 09:21:52 frodo kernel: Call Trace:
Aug 14 09:21:52 frodo kernel:  <TASK>
Aug 14 09:21:52 frodo kernel:  drm_ioctl_kernel+0xae/0x100
Aug 14 09:21:52 frodo kernel:  drm_ioctl+0x2e0/0x560
Aug 14 09:21:52 frodo kernel:  ? __pfx_nouveau_abi16_ioctl_get_zcull_info+0x10/0x10 [nouveau]
Aug 14 09:21:52 frodo kernel:  nouveau_drm_ioctl+0x58/0xc0 [nouveau]
Aug 14 09:21:52 frodo kernel:  __x64_sys_ioctl+0xb9/0x100
Aug 14 09:21:52 frodo kernel:  do_syscall_64+0xe2/0x560
Aug 14 09:21:52 frodo kernel:  entry_SYSCALL_64_after_hwframe+0x76/0x7e
Aug 14 09:21:52 frodo kernel:  </TASK>
---
 drivers/gpu/drm/nouveau/nouveau_abi16.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index c9270c5b0fac..f1026a716ff7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -357,7 +357,7 @@ nouveau_abi16_ioctl_get_zcull_info(ABI16_IOCTL_ARGS)
 	struct nvkm_gr *gr = nvxx_gr(drm);
 	struct drm_nouveau_get_zcull_info *out = data;
 
-	if (gr->has_zcull_info) {
+	if (gr && gr->has_zcull_info) {
 		const struct nvkm_gr_zcull_info *i = &gr->zcull_info;
 
 		out->width_align_pixels = i->width_align_pixels;

-- 
2.55.0

Re: [PATCH 1/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] The patch fixes a NULL pointer dereference in the `GETPARAM` ioctl when the graphics engine (`gr`) fails to initialize but misses an identical issue in `nouveau_abi16_ioctl_get_zcull_info`.
--

--- Patch [1]: [PATCH 1/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl ---
commit 6569813c05cdc1cf39cfd469b6745e81e7cad86d
Author: Jim Cromie <jim.cromie@gmail.com>

drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl

This patch adds safety checks for the graphics engine and device functions
in the GETPARAM ioctl handler. It returns -ENODEV to signal missing
hardware state to userspace, preventing a kernel NULL pointer dereference
when initialization fails.

> diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
> index 291203121f0c2..c9270c5b0fac8 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
> @@ -306,7 +306,12 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
>  		getparam->value = 1;
>  		break;
>  	case NOUVEAU_GETPARAM_GRAPH_UNITS:
> -		getparam->value = nvkm_gr_units(gr);
> +		if (gr && gr->func) {
> +			getparam->value = nvkm_gr_units(gr);
> +		} else {
> +			NV_ERROR_ONCE(drm, "GETPARAM_GRAPH_UNITS: no gr engine or func\n");
> +			return -ENODEV;
> +		}
>  		break;

[Severity: Critical]
This is a pre-existing issue, but while you are fixing the NULL pointer
dereference of the gr pointer here, is there a similar vulnerability
in the adjacent nouveau_abi16_ioctl_get_zcull_info() function?

If the graphics engine fails to initialize and gr is NULL, as addressed by
this patch, it looks like an unprivileged userspace process could still
trigger an Oops by calling the DRM_IOCTL_NOUVEAU_GET_ZCULL_INFO ioctl,
which only requires DRM_RENDER_ALLOW.

Looking at the nouveau_abi16_ioctl_get_zcull_info() function in
drivers/gpu/drm/nouveau/nouveau_abi16.c, the gr pointer is unconditionally
dereferenced:

int
nouveau_abi16_ioctl_get_zcull_info(ABI16_IOCTL_ARGS)
{
	struct nouveau_drm *drm = nouveau_drm(dev);
	struct nvkm_gr *gr = nvxx_gr(drm);
	struct drm_nouveau_get_zcull_info *out = data;

	if (gr->has_zcull_info) {
		const struct nvkm_gr_zcull_info *i = &gr->zcull_info;
		...

Would it make sense to add a similar check for gr being NULL before
dereferencing gr->has_zcull_info?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260815-null-fixes-v1-0-0df9dda951fb@gmail.com?part=1