[PATCH] drm/nouveau: reject zero-size notifier object allocation

[PATCH] drm/nouveau: reject zero-size notifier object allocation

[Zhenhao Wan]

nouveau_abi16_ioctl_notifierobj_alloc() passes the userspace-controlled
info->size to nvkm_mm_head() as both size_max and size_min without a lower
bound.  A zero size satisfies the allocator's "e - s < size_min" gate
(size_min == 0 makes the unsigned comparison inert) and yields a
zero-length node, after which

	args.limit = ntfy->node->offset + ntfy->node->length - 1;

underflows (offset 0, length 0 -> 0xffffffff) into an oversized ~4 GiB DMA
window.  The dma object constructor only rejects start > limit, so the
validly ordered [base, base + 0xffffffff] range passes and is programmed
into the GPU DMA context.  The ioctl is DRM_RENDER_ALLOW, so any render
node client can trigger this on pre-Fermi hardware.

Reject a zero-size request before allocating anything.

Fixes: ebb945a94bba ("drm/nouveau: port all engines to new engine module format")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
---
 drivers/gpu/drm/nouveau/nouveau_abi16.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index 291203121f0c..8d139bbb2934 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -660,6 +660,10 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
 	if (unlikely(device->info.family >= NV_DEVICE_INFO_V0_FERMI))
 		return nouveau_abi16_put(abi16, -EINVAL);
 
+	/* zero size yields a zero-length node, underflowing args.limit */
+	if (unlikely(!info->size))
+		return nouveau_abi16_put(abi16, -EINVAL);
+
 	chan = nouveau_abi16_chan(abi16, info->channel);
 	if (!chan)
 		return nouveau_abi16_put(abi16, -ENOENT);

---
base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
change-id: 20260813-nouveau-abi16-notifierobj-zero-size-5d3888d36b57

Best regards,
--  
Zhenhao Wan <whi4ed0g@gmail.com>

Re: [PATCH] drm/nouveau: reject zero-size notifier object allocation

[lyude]

Reviewed-by: Lyude Paul <lyude@redhat.com>

Will push to drm-misc-fixes in a moment

On Thu, 2026-08-13 at 21:14 +0800, Zhenhao Wan wrote:
> nouveau_abi16_ioctl_notifierobj_alloc() passes the userspace-
> controlled
> info->size to nvkm_mm_head() as both size_max and size_min without a
> lower
> bound.  A zero size satisfies the allocator's "e - s < size_min" gate
> (size_min == 0 makes the unsigned comparison inert) and yields a
> zero-length node, after which
> 
> 	args.limit = ntfy->node->offset + ntfy->node->length - 1;
> 
> underflows (offset 0, length 0 -> 0xffffffff) into an oversized ~4
> GiB DMA
> window.  The dma object constructor only rejects start > limit, so
> the
> validly ordered [base, base + 0xffffffff] range passes and is
> programmed
> into the GPU DMA context.  The ioctl is DRM_RENDER_ALLOW, so any
> render
> node client can trigger this on pre-Fermi hardware.
> 
> Reject a zero-size request before allocating anything.
> 
> Fixes: ebb945a94bba ("drm/nouveau: port all engines to new engine
> module format")
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Assisted-by: Claude:claude-opus-5
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
> ---
>  drivers/gpu/drm/nouveau/nouveau_abi16.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c
> b/drivers/gpu/drm/nouveau/nouveau_abi16.c
> index 291203121f0c..8d139bbb2934 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
> @@ -660,6 +660,10 @@
> nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
>  	if (unlikely(device->info.family >=
> NV_DEVICE_INFO_V0_FERMI))
>  		return nouveau_abi16_put(abi16, -EINVAL);
>  
> +	/* zero size yields a zero-length node, underflowing
> args.limit */
> +	if (unlikely(!info->size))
> +		return nouveau_abi16_put(abi16, -EINVAL);
> +
>  	chan = nouveau_abi16_chan(abi16, info->channel);
>  	if (!chan)
>  		return nouveau_abi16_put(abi16, -ENOENT);
> 
> ---
> base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
> change-id: 20260813-nouveau-abi16-notifierobj-zero-size-5d3888d36b57
> 
> Best regards,
> --  
> Zhenhao Wan <whi4ed0g@gmail.com>