The NV50 and GF100 software-class vblank methods nv50_sw_chan_mthd()
and gf100_sw_chan_mthd() evaluate "data < device->disp->vblank.index_nr"
to validate the requested vblank head before allowing its notifier.
On a headless card the display subdevice is absent: nvkm_subdev_disable()
(strap-driven from devinit) and the -ENODEV path of the NVKM_LAYOUT_ONCE
device constructor both leave device->disp == NULL while the device
continues to probe and still registers a render node (DRIVER_RENDER). An
unprivileged client holding a /dev/dri/renderD* fd can then create a
software channel and push method 0x0408 (NV50) / 0x040c (GF100), which
dereferences the NULL device->disp and oopses the kernel.
The channel constructors nv50_sw_chan_new() and gf100_sw_chan_new()
already tolerate an absent display ("for (i = 0; disp && ...)"), so no
vblank notifier is ever registered on such a card and the method handlers
are the only path that assumes disp is present. Guard the dereference
with the same disp NULL test the constructors already use.
Fixes: 79ca27706a03 ("drm/nouveau/core: rework event interface")
Reported-by: Yuhao Jiang <[email protected]>
Assisted-by: LLM
Reviewed-by: Lyude Paul <[email protected]>
Signed-off-by: Zhenhao Wan <[email protected]>
---
Changes in v2:
- Add the Fixes: tag Lyude asked for. 79ca27706a03 replaced the NULL-safe
per-channel vblank.nr_event bound (0 when there is no display) with a
direct disp->vblank.index_nr dereference.
- Drop Cc: stable and spell Assisted-by: as LLM, matching how Lyude
applied patch 2/2.
- Pick up Lyude's Reviewed-by.
- Patch 2/2 of v1 ("drm/nouveau: prevent NULL deref of gr in
GETPARAM_GRAPH_UNITS") is unchanged and already applied to
drm-misc-next as f569473c1393, so it is not resent.
- Link to v1:
https://patch.msgid.link/20260812-nouveau-nvkm-absent-subdev-null-deref-v1-0-7e057f6ae...@gmail.com
To: Lyude Paul <[email protected]>
To: Danilo Krummrich <[email protected]>
To: Maarten Lankhorst <[email protected]>
To: Maxime Ripard <[email protected]>
To: Thomas Zimmermann <[email protected]>
To: David Airlie <[email protected]>
To: Simona Vetter <[email protected]>
To: Ben Skeggs <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
---
drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c
b/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c
index 0171cdf6f639..4cf8cd120c76 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c
@@ -72,7 +72,7 @@ gf100_sw_chan_mthd(struct nvkm_sw_chan *base, int subc, u32
mthd, u32 data)
chan->vblank.value = data;
return true;
case 0x040c:
- if (data < device->disp->vblank.index_nr) {
+ if (device->disp && data < device->disp->vblank.index_nr) {
nvkm_event_ntfy_allow(&chan->vblank.notify[data]);
return true;
}
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c
b/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c
index 0cfb1eaae6de..b202e11238a5 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c
@@ -69,7 +69,7 @@ nv50_sw_chan_mthd(struct nvkm_sw_chan *base, int subc, u32
mthd, u32 data)
case 0x0400: chan->vblank.offset = data; return true;
case 0x0404: chan->vblank.value = data; return true;
case 0x0408:
- if (data < device->disp->vblank.index_nr) {
+ if (device->disp && data < device->disp->vblank.index_nr) {
nvkm_event_ntfy_allow(&chan->vblank.notify[data]);
return true;
}
---
base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
change-id: 20260812-nouveau-nvkm-absent-subdev-null-deref-f52db5c24408
Best regards,
--
Zhenhao Wan <[email protected]>
