Reviewed-by: Lyude Paul <[email protected]> Since this kind of relies on driver initialization having already failed (which I'm sure breaks many other things we haven't found yet) I'm going to push this to drm-misc-next
On Wed, 2026-08-12 at 23:00 +0800, Zhenhao Wan wrote: > nouveau_abi16_ioctl_getparam() fetches the graphics engine with > gr = nvxx_gr(drm) (i.e. drm->nvkm->gr) and, for the > NOUVEAU_GETPARAM_GRAPH_UNITS parameter, passes it straight to > nvkm_gr_units(), which dereferences gr->func with no NULL check. > > When graphics-engine construction returns -ENODEV, NVKM treats it as > an > optional absent engine: the NVKM_LAYOUT_ONCE device constructor > deletes > the subdevice, leaves device->gr == NULL and continues probing, and > Nouveau still registers a render node. An unprivileged client holding > a > /dev/dri/renderD* fd can then issue DRM_IOCTL_NOUVEAU_GETPARAM with > NOUVEAU_GETPARAM_GRAPH_UNITS and oops the kernel on the NULL gr. > > Report 0 units when gr is absent. This matches nvkm_gr_units() > itself, > which already returns 0 when the engine exposes no units callback. > > Reported-by: Yuhao Jiang <[email protected]> > Assisted-by: Claude:claude-opus-5 > Cc: [email protected] > Signed-off-by: Zhenhao Wan <[email protected]> > --- > drivers/gpu/drm/nouveau/nouveau_abi16.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c > b/drivers/gpu/drm/nouveau/nouveau_abi16.c > index 291203121f0c..dd3f8d386377 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_abi16.c > +++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c > @@ -306,7 +306,7 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS) > getparam->value = 1; > break; > case NOUVEAU_GETPARAM_GRAPH_UNITS: > - getparam->value = nvkm_gr_units(gr); > + getparam->value = gr ? nvkm_gr_units(gr) : 0; > break; > case NOUVEAU_GETPARAM_EXEC_PUSH_MAX: { > int ib_max = getparam_dma_ib_max(device);
