Bah - sorry I keep doing this :), could you add a fixes tag for this and respin it before I push it?
On Fri, 2026-10-09 at 19:22 -0400, [email protected] wrote: > Reviewed-by: Lyude Paul <[email protected]> > > Will push to drm-misc-next in a moment > > On Wed, 2026-08-12 at 23:00 +0800, Zhenhao Wan wrote: > > The NV50 and GF100 software-class vblank methods > > nv50_sw_chan_mthd() > > and gf100_sw_chan_mthd() evaluate "data < device->disp- > > > vblank.index_nr" > > to validate the requested vblank head before allowing its notifier. > > > > On a headless card the display subdevice is absent: > > nvkm_subdev_disable() > > (strap-driven from devinit) and the -ENODEV path of the > > NVKM_LAYOUT_ONCE > > device constructor both leave device->disp == NULL while the device > > continues to probe and still registers a render node > > (DRIVER_RENDER). > > An > > unprivileged client holding a /dev/dri/renderD* fd can then create > > a > > software channel and push method 0x0408 (NV50) / 0x040c (GF100), > > which > > dereferences the NULL device->disp and oopses the kernel. > > > > The channel constructors nv50_sw_chan_new() and gf100_sw_chan_new() > > already tolerate an absent display ("for (i = 0; disp && ...)"), so > > no > > vblank notifier is ever registered on such a card and the method > > handlers > > are the only path that assumes disp is present. Guard the > > dereference > > with the same disp NULL test the constructors already use. > > > > Reported-by: Yuhao Jiang <[email protected]> > > Assisted-by: Claude:claude-opus-5 > > Cc: [email protected] > > Signed-off-by: Zhenhao Wan <[email protected]> > > --- > > drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c | 2 +- > > drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c | 2 +- > > 2 files changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c > > b/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c > > index 0171cdf6f639..4cf8cd120c76 100644 > > --- a/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c > > +++ b/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c > > @@ -72,7 +72,7 @@ gf100_sw_chan_mthd(struct nvkm_sw_chan *base, int > > subc, u32 mthd, u32 data) > > chan->vblank.value = data; > > return true; > > case 0x040c: > > - if (data < device->disp->vblank.index_nr) { > > + if (device->disp && data < device->disp- > > > vblank.index_nr) { > > nvkm_event_ntfy_allow(&chan- > > > vblank.notify[data]); > > return true; > > } > > diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c > > b/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c > > index 0cfb1eaae6de..b202e11238a5 100644 > > --- a/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c > > +++ b/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c > > @@ -69,7 +69,7 @@ nv50_sw_chan_mthd(struct nvkm_sw_chan *base, int > > subc, u32 mthd, u32 data) > > case 0x0400: chan->vblank.offset = data; return true; > > case 0x0404: chan->vblank.value = data; return true; > > case 0x0408: > > - if (data < device->disp->vblank.index_nr) { > > + if (device->disp && data < device->disp- > > > vblank.index_nr) { > > nvkm_event_ntfy_allow(&chan- > > > vblank.notify[data]); > > return true; > > }
