linux-kernel - Re: [PATCH] drm: nouveau: fifo: ga100: fix null pointer dereferences

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2cbb1df8-bb1c-4bae-8be0-c2ce2c7fa6fc@kernel.org>
Date: Sat, 9 Aug 2025 13:57:56 +0200
From: Danilo Krummrich <dakr@...nel.org>
To: Akhilesh Patil <akhilesh@...iitb.ac.in>
Cc: lyude@...hat.com, airlied@...il.com, simona@...ll.ch, bskeggs@...hat.com,
 kherbst@...hat.com, dri-devel@...ts.freedesktop.org,
 nouveau@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
 akhileshpatilvnit@...il.com, skhan@...uxfoundation.org
Subject: Re: [PATCH] drm: nouveau: fifo: ga100: fix null pointer dereferences

Hi Akhilesh,

On 8/9/25 10:00 AM, Akhilesh Patil wrote:
> Fix potential NULL pointer dereference in ga100_fifo_nonstall_allow()
> and ga100_fifo_nonstall_block() when nvkm_runl_get() returns NULL.
> Fix CVE-476 as reported by coverity tool (CID: 1660771)
> 
> Fixes: 55e1a5996085 ("drm/nouveau/fifo/ga100-: add per-runlist nonstall intr handling")
> Addresses-Coverity-ID: 1660771
> Signed-off-by: Akhilesh Patil <akhilesh@...iitb.ac.in>

Thanks for the patch.

> ---
>   drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c | 8 ++++++--
>   1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c
> index e74493a4569e..a441fb602f28 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c
> @@ -520,7 +520,9 @@ ga100_fifo_nonstall_block(struct nvkm_event *event, int type, int index)
>   	struct nvkm_fifo *fifo = container_of(event, typeof(*fifo), nonstall.event);
>   	struct nvkm_runl *runl = nvkm_runl_get(fifo, index, 0);
>   
> -	nvkm_inth_block(&runl->nonstall.inth);
> +	WARN_ON(!runl);

There's two potential cases here. Either nvkm_runl_get() may expectedly return
NULL in this context, or nvkm_runl_get() returning NULL would be a bug.

In the former case we should gracefully handle it, i.e. no WARN_ON() etc. In the
latter case, there is no need to check, otherwise we'd need to check every
pointer for NULL all the time.

In this case it should be the latter, so the code should be correct as is.

> +	if (runl)
> +		nvkm_inth_block(&runl->nonstall.inth);
>   }
>   
>   static void
> @@ -529,7 +531,9 @@ ga100_fifo_nonstall_allow(struct nvkm_event *event, int type, int index)
>   	struct nvkm_fifo *fifo = container_of(event, typeof(*fifo), nonstall.event);
>   	struct nvkm_runl *runl = nvkm_runl_get(fifo, index, 0);
>   
> -	nvkm_inth_allow(&runl->nonstall.inth);
> +	WARN_ON(!runl);
> +	if (runl)
> +		nvkm_inth_allow(&runl->nonstall.inth);
>   }
>   
>   const struct nvkm_event_func