From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f44.google.com (mail-oo1-f44.google.com [209.85.161.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 31DC430149F for ; Sat, 15 Aug 2026 17:31:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786815064; cv=none; b=b7rNe5fYIX0idiWgRtTUyRi11ISxfZ4sSSBuHlRoisHMGYqb0odHLVyCbvVnXydOGYzHt1v2ErA+YZ6NMSaujKcv7LUn16MJjc9AnCAnxJGpVAJUgdlaA59lEnEJhUcaD4P80l0KNaMxrkMh/9S09r+6Y5im6ARrzVQjYnMborY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786815064; c=relaxed/simple; bh=tPxLL2CoSb3VmYmM9nMkXK7+/WPpCTFrGxjaNQhP7T0=; h=From:Subject:Date:Message-Id:MIME-Version:Content-Type:To:Cc; b=VZ3FlLp8Pq5fAIwIsR8Ih9NCDH42HUhBdygv5/Ch/sEgy7ajuLN9CcTVDi1svSho8naj5dHeGm7xtakZvZox/JX4ddNdrbmDbzwLWpX0/qkFnMysVMpJFTG4Psx5G1O/iekS61EuhjTI60JNVIXgvq1Fh1vSXBLCC2cifYStkRs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZvPQG829; arc=none smtp.client-ip=209.85.161.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZvPQG829" Received: by mail-oo1-f44.google.com with SMTP id 006d021491bc7-6b057877851so1431801eaf.0 for ; Sat, 15 Aug 2026 10:31:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786815062; x=1787419862; darn=vger.kernel.org; h=cc:to:content-transfer-encoding:content-type:mime-version :message-id:date:subject:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=BkvQvNk2oNgW6GeNnclUP07CB2P6+HO4+248oqvobEI=; b=ZvPQG829wm4cxbplIKbRVC4cAKfIyRUTCzCgQiPR3tKTxaAeN3EbyXcRuBs9u1NGJp 4AyedpRMjBeEewplHBa716xEjdb5hY7fACaeaSwswP0V+gmIt4lLBkSTFn/iezeenVvk qi9BdGGO04SN17dNR6Z/oo9TbnN6C6ZpGDvwItUrXlUq/msuJ1HCKBYTqib+dRSkOhPe SemOI4hn2/6yr9K+2X0xd8yOxEldZgeQ30TdsWf85fWf/NMxyRXwgQ73Lyb3t47FGt8z BHkencn10XLZWNUEtaJJ0xPlvHcQmz79vLd4p0F26+dTmcxe5sk92woQE8qvnNJcWO1p obyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786815062; x=1787419862; h=cc:to:content-transfer-encoding:content-type:mime-version :message-id:date:subject:from:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=BkvQvNk2oNgW6GeNnclUP07CB2P6+HO4+248oqvobEI=; b=WKkvkyCcC0+7XEyw3tixF2YbEFD6I7Gd2NBJ8vXoNaorgM9YRNVUnyT5A1uMaezMaT OMD3SRPPSwHiY3+t46CuFz2VpsoMg0EGq4cP7j7yjMzFZiut7g+993RUo3+3U+7ql4f+ c8IxT8SfaLuOnlQ/l+dfW6z/V2CNiMa149EHJP+LaWQChkEWSO6GCGb5DrAHLJaH6CZH C6x8T8NqOUIw0Dg7LJNLd5cvzLcvKnIItgADGTewiTGZpPqy/z5L/TB1YeURGgKUzEnG wanc2R+VOcDb2BKDfmOy2koZAvinqmWvfS0hkL3HbbRewSMIdIUUXnvwED9ChEzsu6ar Cz4A== X-Forwarded-Encrypted: i=1; AHgh+Rqw6l0HyzAobuBsKwQweAi3hhJVE77Udu0HFJT4HEeGiGAnVN9DsZQ4MB0bl3Zd3LDyWkoGk0T0oW1+iZA=@vger.kernel.org X-Gm-Message-State: AOJu0YzyaoK8mGRw5gwgYIv+8Izy9AUG4DjwxFAEUADRMBGcw/hpVqcW vpLSsvaaY9UvvZUvBtxtTs+fH/iGu6y8kufkTLNiAeBWM0Vrnkz8qjf9//74l6dk X-Gm-Gg: AR+sD117jKVAAQwMEQzGVEr5ZBD4cSdMvppVqfHCOluucCrGTOmx5K5CK51itu85X0D eEwC02KgaxuvH2hnx/kwCKZBM41Z7xuE399Mv7hYf0Fx/XcLaM71tnmWyvscEOQpoZgnyvYRU9f 8f9qL9KtKNbdXGVo1XrzQgziKMHcjs2KvFcSWijIBArQqIf99gOG5Feh8ZY7QKf1frZf60WznrS FQONPzybLulftTq3RONbjTqC0tGlK2LDExGLAoJEzI4/JJYxi/iIVEVuEoRmLlp/nfvC1MGDMGd C6DMz6lcXwTbcXa1R7DdX9JJktXCveET/g2HiiDutMSBDRiTOMGJ7ViVxYkO8cWSv1pA+0TlHWc 3knTfAZvycpAjvkMgx3XrF4eOCDQlHcAreG3a6BEUClary3yA1mkQz8k9ROcj3lAW0E+MNXcc1R mURE8B8G9sEQG4+aLr+YNJkUk+WTY6rauKdtk4pHcuW6rpkBwy0fHxdRoDEQbXprogVy2eGLhwN fW/UV2B2c41HDIIFlSet5HfMpKvEgiY7KZ9G58FHIQGPquH/UNJmXJe9RjaaPoKShcno+Dx3H02 SeIVDi8SJlXM/g== X-Received: by 2002:a05:6820:824:b0:6ae:33fb:4556 with SMTP id 006d021491bc7-6b0d613f35cmr12820634eaf.8.1786815061905; Sat, 15 Aug 2026 10:31:01 -0700 (PDT) Received: from [192.168.0.245] (c-98-38-17-99.hsd1.co.comcast.net. [98.38.17.99]) by smtp.googlemail.com with ESMTPSA id 46e09a7af769-7f3e86686c4sm4029328a34.23.2026.08.15.10.31.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 15 Aug 2026 10:31:01 -0700 (PDT) From: Jim Cromie Subject: [PATCH 0/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM and GET_ZCULL_INFO ioctls Date: Sat, 15 Aug 2026 11:30:51 -0600 Message-Id: <20260815-null-fixes-v1-0-0df9dda951fb@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-B4-Tracking: v=1; b=H4sIAAAAAAAC/6tWKk4tykwtVrJSqFYqSi3LLM7MzwNyDHUUlJIzE vPSU3UzU4B8JSMDIzMDC0NT3bzSnBzdtMyK1GJd01TLVAszIEg0TVECaigoSgVLANVHx9bWAgA SyjqrXAAAAA== X-Change-ID: 20260815-null-fixes-5e9e86666a5d To: Lyude Paul , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Jim Cromie X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786815060; l=1411; i=jim.cromie@gmail.com; s=20260203; h=from:subject:message-id; bh=tPxLL2CoSb3VmYmM9nMkXK7+/WPpCTFrGxjaNQhP7T0=; b=ow67/bAtMilaNqTNhXn9xssO8EWonROESywYsPc8eyHqPukYeVyCG6eQljyq13IoLA+1qIwJd 1XrwYYuHaGHB+joMnCmjldMvmwC6l/3grGgzowk9fT8r30auMBLOnr/ X-Developer-Key: i=jim.cromie@gmail.com; a=ed25519; pk=C6E5ODlPQo7ZBynATXH9wg7K6HxP0pIXyf4s38Qw0XE= When Nouveau initialization is incomplete (e.g. firmware microcode fails to load or graphics engine initialization aborts early), userspace display servers (GNOME/Mesa) probing device capabilities trigger fatal kernel NULL pointer dereferences in the Nouveau ioctl handlers. This 2-patch series fixes two distinct NULL pointer crash paths: 1. drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl - Prevents NULL dereference of gr, gr->func, and nvkm_device->func in nouveau_abi16_ioctl_getparam(). Returns -ENODEV cleanly. 2. drm/nouveau: Fix NULL pointer dereference in GET_ZCULL_INFO ioctl - Checks that gr is non-NULL before inspecting gr->has_zcull_info at offset 0xf0 in nouveau_abi16_ioctl_get_zcull_info(). Both bugs were reproduced and verified fixed on GA107 (NVIDIA GeForce RTX 3050 Mobile) running 7.2-rc7 under GNOME Wayland desktop initialization. Signed-off-by: Jim Cromie --- Jim Cromie (2): drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl drm/nouveau: Fix NULL pointer dereference in GET_ZCULL_INFO ioctl drivers/gpu/drm/nouveau/nouveau_abi16.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) --- base-commit: db2ddb87143519e20a95aa36c60b36107b736a58 change-id: 20260815-null-fixes-5e9e86666a5d Best regards, -- Jim Cromie