If the requested pstate id is not present in the state list (or the list is empty, e.g. broken/missing perf tables), the list_for_each_entry cursor runs off the end of the list and the subsequent pstate->pstate != req check dereferences the list head cast to a struct nvkm_pstate, which is an out-of-bounds read.
Track whether the entry was actually found instead of inspecting the cursor after the loop. Co-Authored-By: Claude Fable 5 <[email protected]> Signed-off-by: Francesco Magazzu <[email protected]> --- drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c index 572e63846..42f3709e0 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c @@ -479,13 +479,17 @@ nvkm_clk_ustate_update(struct nvkm_clk *clk, int req) return -ENOSYS; if (req != -1 && req != -2) { + bool found = false; + list_for_each_entry(pstate, &clk->states, head) { - if (pstate->pstate == req) + if (pstate->pstate == req) { + found = true; break; + } i++; } - if (pstate->pstate != req) + if (!found) return -EINVAL; req = i; } base-commit: a284476db2653ae893f46cbea408eb412db54eb0 -- 2.55.0
