From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 25DF43AA1BB for ; Sun, 12 Jul 2026 12:37:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783859861; cv=none; b=S26vf6FpXWLwBd7DcAAjSRwtIlTqFlN+C+CKrvvk5IX6ZxH0z7sQfXiZ7v4EVL6bws+rsLa2IVs24eo/s1kaLgIWT74HG/0jEB+IcGano91rucTwkYQngBHG6Q096bDGrzEEMJXxEnKUva6LtTwM3Z1dJyXqeKD5QVvHamPg1iE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783859861; c=relaxed/simple; bh=FQTU3SNvcssT6eHKr33e8BEqhU4FBZVWtQtLycfAJa4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hgNMznoxjh6eNOZVtwCu73QyP7pdLINyKVVY1MGkW+MpVX8ADxeTarSW5nMWemRVgPEWArckbgKKEHxonI3ZO+II5vHvyCiL09HwKv3q0AEOF53Vy3i0RHhu2ksxeQ7qSI3q2TkA+hGjeOmIH9G3lENFK35xt1wmncCm9GlLzhM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=gASzP1Sh; arc=none smtp.client-ip=209.85.128.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="gASzP1Sh" Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-493c52cde9eso21401345e9.3 for ; Sun, 12 Jul 2026 05:37:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783859858; x=1784464658; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=CJi+7sCg+GNZFhEJVD2Hmu/wR2anVVL7EeD+/Q0E5aU=; b=gASzP1ShbcJV8SzBdu6O32oX6Cepxab1YCGtq99bGgkoxcYnEe1gsf5NWkM3EHARto K3tdmmBjRw2SE2iki0iMtoLTj4p2D5lVGhd8ki92Dp4vYNWMEcwsSAhb2z/+uOh0kM2v WSYSFmpNsY2lEB08MjF0HNXbhJNoGriL6I6fgNZdX2T0lO7si+/PfERCtVLaJCY/EiCt O2PYpKCdHTE+e1g/wpIQFxQNMu/vu2Atb3JWECznXlZg+RyKF1XOsB6HlbcX/fAgX5FL lSOAJK1MYsNtAs8VoRwSi+SiAl0UEMW12BnwqrSmADrmN/Ho2pZJUhZJ3YRaNI3DW+2C u+RQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783859858; x=1784464658; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=CJi+7sCg+GNZFhEJVD2Hmu/wR2anVVL7EeD+/Q0E5aU=; b=OpxRYGjaa4KukROA3NdGCn4B1Xpk382zASzbx2+mb4WrKAkH1AmVYSQtac1Nf1oPmg peGEdfFiho1Z8UtEWpKLrO3ShA6lvJ4k8EleuWT9ABxa/eALecc7B1XnVdmr10f/8psn riO/HcTAJ87oamuolifg3/0+h1l4pc8fnIDO99Mz3qRPWl7hnFHLdLUWUqmE28ENvDuN lmrqBFoUVuLu4LKACOB1+5IuLB/qo5CkLKAGqSUTZyOZjTDiavzCx6adVNwtsv/1qDrW Cfj870GEwqYNJqHvgS5ZprcgUwfYOa2pE7W0L5qGCd5iBnDK5B7BkSJ5a/FHwMgaDbP6 h+sQ== X-Forwarded-Encrypted: i=1; AHgh+Rq9Twk+piCA0beQC3nojGmGJj3zJrdRwTYGSFiQYBUnP/MSxynK2JEGy/nqS6ayUGcnE8K2iNqmIwyerT8=@vger.kernel.org X-Gm-Message-State: AOJu0YytELG2z4d7mCYD4MOdPJM94aZYQavZlXdQb5CwovSmAtFPtZIg BQ0JNQcuvDzGF073bIn0UmqWJkAQzIREPeVSi4ec7G453l1nAuNW62bk X-Gm-Gg: AfdE7cmCm2MxAChFowZiJMCenja1WjecWZrR/dNu5bI/sVudGjT66H3MR5QqH0FO8a7 YK6x01TirXoovzq7NSosOeHVMkc3TtiSfWezyBLRkHY1b/wKdWf+f2xCcQ/lAt4VGO9nC+kE66B Bfp6XQLmHHFWVRlEXBLgJ/o6Th1XxIzTwNuM1fPMB5zqrRAXm6nyR5W2Xe72kQCjJR334X64YKS JZA5//UwZ4/w0qFjkOGARpWcd09L4xiAut2WbdmCY4mQVbEn8Kp57XQ5glVcMNzPS4EPPqq1Hat lbtZHhnSRwDLvKXmAxLPPpHS2lKD5gV1z994n626HIoTSno64aopiUbAGTy8/e0Q8/n6BKHmuE7 YamxOSNdbIQgncYs2JDZtFvtcp0MlWsnfga8u/w1WCsmhGFba1F46AVWkuGyGGztTfiB2jK4G98 kG/9CAFQrikZ5/xmw= X-Received: by 2002:a05:600c:6d48:b0:490:9588:bdb6 with SMTP id 5b1f17b1804b1-493f88389c0mr40261455e9.33.1783859858299; Sun, 12 Jul 2026 05:37:38 -0700 (PDT) Received: from fra-x8664 ([2a01:e11:8000:43b0:96d6:566b:35c:7b8c]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-493eb6f3c42sm280280485e9.1.2026.07.12.05.37.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 05:37:37 -0700 (PDT) From: Francesco Magazzu To: Lyude Paul , Danilo Krummrich Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Dan Carpenter , Karol Herbst Subject: [PATCH v2 3/4] drm/nouveau/device: don't use the pstate cursor after the loop Date: Sun, 12 Jul 2026 14:36:15 +0200 Message-ID: <20260712123616.1180830-4-postadelmaga@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260712123616.1180830-1-postadelmaga@gmail.com> References: <20260712123616.1180830-1-postadelmaga@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit nvkm_control_mthd_pstate_attr() looks up the pstate at the index supplied by userspace by walking clk->states, and then keeps using the list_for_each_entry cursor after the loop. This is not triggerable today: the function already rejects args->v0.state >= clk->state_nr before the loop, and clk->state_nr is kept in sync with the number of entries on clk->states, so the lookup always breaks on a real entry. Should the loop ever run to completion, the cursor would point at the list head rather than at a pstate, and the pstate->base.domain[] read and the walk of pstate->list that follow would read past it. Rather than leave that trap in place, track whether the entry was found and return -EINVAL if it was not, like the other lookup failures in this function. No functional change. Signed-off-by: Francesco Magazzu --- drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c index f2e9a0626..28702741a 100644 --- a/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c +++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c @@ -74,6 +74,7 @@ nvkm_control_mthd_pstate_attr(struct nvkm_control *ctrl, void *data, u32 size) const struct nvkm_domain *domain; struct nvkm_pstate *pstate; struct nvkm_cstate *cstate; + bool found = false; int i = 0, j = -1; u32 lo, hi; int ret = -ENOSYS; @@ -104,10 +105,15 @@ nvkm_control_mthd_pstate_attr(struct nvkm_control *ctrl, void *data, u32 size) if (args->v0.state != NVIF_CONTROL_PSTATE_ATTR_V0_STATE_CURRENT) { list_for_each_entry(pstate, &clk->states, head) { - if (i++ == args->v0.state) + if (i++ == args->v0.state) { + found = true; break; + } } + if (!found) + return -EINVAL; + lo = pstate->base.domain[domain->name]; hi = lo; list_for_each_entry(cstate, &pstate->list, head) { -- 2.55.0