Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] The patch fixes a NULL pointer dereference for `gr` in `nouveau_abi16_ioctl_getparam()`, but misses an identical vulnerability in `nouveau_abi16_ioctl_get_zcull_info()` within the same file. -- --- Patch [2]: [PATCH 2/2] drm/nouveau: prevent NULL deref of gr in GETPARAM_GRAPH_UNITS --- commit 368f46fbd7701fc98a09aa941af876abf6e518b8 Author: Zhenhao Wan <[email protected]> drm/nouveau: prevent NULL deref of gr in GETPARAM_GRAPH_UNITS This patch prevents a NULL pointer dereference in nouveau_abi16_ioctl_getparam() when an unprivileged client requests NOUVEAU_GETPARAM_GRAPH_UNITS. If the graphics engine is absent, gr is NULL, which previously oopsed the kernel. > diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c > b/drivers/gpu/drm/nouveau/nouveau_abi16.c > index 291203121f0c2..dd3f8d386377f 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_abi16.c > +++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c > @@ -306,7 +306,7 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS) > getparam->value = 1; > break; > case NOUVEAU_GETPARAM_GRAPH_UNITS: > - getparam->value = nvkm_gr_units(gr); > + getparam->value = gr ? nvkm_gr_units(gr) : 0; > break; > case NOUVEAU_GETPARAM_EXEC_PUSH_MAX: { > int ib_max = getparam_dma_ib_max(device); [Severity: High] This is a pre-existing issue, but does a similar NULL pointer dereference vulnerability exist slightly further down in the same file? If the graphics engine is absent (making gr == NULL), could an unprivileged client calling DRM_IOCTL_NOUVEAU_GET_ZCULL_INFO trigger a kernel oops here? drivers/gpu/drm/nouveau/nouveau_abi16.c:nouveau_abi16_ioctl_get_zcull_info() { ... struct nvkm_gr *gr = nvxx_gr(drm); struct drm_nouveau_get_zcull_info *out = data; if (gr->has_zcull_info) { ... } Should nouveau_abi16_ioctl_get_zcull_info() also check if gr is valid before dereferencing it? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/20260812-nouveau-nvkm-absent-subdev-null-deref-v1-0-7e057f6ae...@gmail.com?part=2
