nouveau_abi16_ioctl_notifierobj_alloc() passes the userspace-controlled
info->size to nvkm_mm_head() as both size_max and size_min without a lower
bound. A zero size satisfies the allocator's "e - s < size_min" gate
(size_min == 0 makes the unsigned comparison inert) and yields a
zero-length node, after which
args.limit = ntfy->node->offset + ntfy->node->length - 1;
underflows (offset 0, length 0 -> 0xffffffff) into an oversized ~4 GiB DMA
window. The dma object constructor only rejects start > limit, so the
validly ordered [base, base + 0xffffffff] range passes and is programmed
into the GPU DMA context. The ioctl is DRM_RENDER_ALLOW, so any render
node client can trigger this on pre-Fermi hardware.
Reject a zero-size request before allocating anything.
Fixes: ebb945a94bba ("drm/nouveau: port all engines to new engine module
format")
Reported-by: Yuhao Jiang <[email protected]>
Assisted-by: Claude:claude-opus-5
Cc: [email protected]
Signed-off-by: Zhenhao Wan <[email protected]>
---
drivers/gpu/drm/nouveau/nouveau_abi16.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c
b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index 291203121f0c..8d139bbb2934 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -660,6 +660,10 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
if (unlikely(device->info.family >= NV_DEVICE_INFO_V0_FERMI))
return nouveau_abi16_put(abi16, -EINVAL);
+ /* zero size yields a zero-length node, underflowing args.limit */
+ if (unlikely(!info->size))
+ return nouveau_abi16_put(abi16, -EINVAL);
+
chan = nouveau_abi16_chan(abi16, info->channel);
if (!chan)
return nouveau_abi16_put(abi16, -ENOENT);
---
base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
change-id: 20260813-nouveau-abi16-notifierobj-zero-size-5d3888d36b57
Best regards,
--
Zhenhao Wan <[email protected]>
