Re: [PATCH 1/2] drm/nouveau/sw: prevent NULL deref of disp in vblank methods

[lyude@redhat.com]

Bah - sorry I keep doing this :), could you add a fixes tag for this
and respin it before I push it?

On Fri, 2026-10-09 at 19:22 -0400, lyude@redhat.com wrote:
> Reviewed-by: Lyude Paul <lyude@redhat.com>
> 
> Will push to drm-misc-next in a moment
> 
> On Wed, 2026-08-12 at 23:00 +0800, Zhenhao Wan wrote:
> > The NV50 and GF100 software-class vblank methods
> > nv50_sw_chan_mthd()
> > and gf100_sw_chan_mthd() evaluate "data < device->disp-
> > > vblank.index_nr"
> > to validate the requested vblank head before allowing its notifier.
> > 
> > On a headless card the display subdevice is absent:
> > nvkm_subdev_disable()
> > (strap-driven from devinit) and the -ENODEV path of the
> > NVKM_LAYOUT_ONCE
> > device constructor both leave device->disp == NULL while the device
> > continues to probe and still registers a render node
> > (DRIVER_RENDER).
> > An
> > unprivileged client holding a /dev/dri/renderD* fd can then create
> > a
> > software channel and push method 0x0408 (NV50) / 0x040c (GF100),
> > which
> > dereferences the NULL device->disp and oopses the kernel.
> > 
> > The channel constructors nv50_sw_chan_new() and gf100_sw_chan_new()
> > already tolerate an absent display ("for (i = 0; disp && ...)"), so
> > no
> > vblank notifier is ever registered on such a card and the method
> > handlers
> > are the only path that assumes disp is present. Guard the
> > dereference
> > with the same disp NULL test the constructors already use.
> > 
> > Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> > Assisted-by: Claude:claude-opus-5
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
> > ---
> >  drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c | 2 +-
> >  drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c  | 2 +-
> >  2 files changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c
> > b/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c
> > index 0171cdf6f639..4cf8cd120c76 100644
> > --- a/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c
> > +++ b/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c
> > @@ -72,7 +72,7 @@ gf100_sw_chan_mthd(struct nvkm_sw_chan *base, int
> > subc, u32 mthd, u32 data)
> >  		chan->vblank.value = data;
> >  		return true;
> >  	case 0x040c:
> > -		if (data < device->disp->vblank.index_nr) {
> > +		if (device->disp && data < device->disp-
> > > vblank.index_nr) {
> >  			nvkm_event_ntfy_allow(&chan-
> > > vblank.notify[data]);
> >  			return true;
> >  		}
> > diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c
> > b/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c
> > index 0cfb1eaae6de..b202e11238a5 100644
> > --- a/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c
> > +++ b/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c
> > @@ -69,7 +69,7 @@ nv50_sw_chan_mthd(struct nvkm_sw_chan *base, int
> > subc, u32 mthd, u32 data)
> >  	case 0x0400: chan->vblank.offset = data; return true;
> >  	case 0x0404: chan->vblank.value  = data; return true;
> >  	case 0x0408:
> > -		if (data < device->disp->vblank.index_nr) {
> > +		if (device->disp && data < device->disp-
> > > vblank.index_nr) {
> >  			nvkm_event_ntfy_allow(&chan-
> > > vblank.notify[data]);
> >  			return true;
> >  		}