This patch looks fine to me, but but if this was posted by Dan
Carpenter originally would you mind switching the authorship over to
their name?
On Sun, 2026-07-12 at 14:36 +0200, Francesco Magazzu wrote:
> If the requested pstate id is not present in the state list (or the
> list is empty, e.g. broken/missing perf tables), the
> list_for_each_entry
> cursor runs off the end of the list and the subsequent
> pstate->pstate != req check dereferences the list head cast to a
> struct nvkm_pstate, which is an out-of-bounds read.
>
> Track whether the entry was actually found instead of inspecting the
> cursor after the loop.
>
> Fixes: 7c8565220697 ("drm/nouveau/clk: implement power state and
> engine clock control in core")
> Signed-off-by: Francesco Magazzu <[email protected]>
> ---
> Note: essentially the same fix was posted by Dan Carpenter in 2022
> and
> never picked up; the bug is still present in drm-misc-next. Credit
> for
> spotting it goes to him.
> Link: https://lore.kernel.org/dri-devel/YvSkKAdk8Pe0g2K9@kili/
>
> drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
> b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
> index 572e63846..42f3709e0 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
> @@ -479,13 +479,17 @@ nvkm_clk_ustate_update(struct nvkm_clk *clk,
> int req)
> return -ENOSYS;
>
> if (req != -1 && req != -2) {
> + bool found = false;
> +
> list_for_each_entry(pstate, &clk->states, head) {
> - if (pstate->pstate == req)
> + if (pstate->pstate == req) {
> + found = true;
> break;
> + }
> i++;
> }
>
> - if (pstate->pstate != req)
> + if (!found)
> return -EINVAL;
> req = i;
> }
