Re: [PATCH 2/2] drm/nouveau: prevent NULL deref of gr in GETPARAM_GRAPH_UNITS

[lyude@redhat.com]

Reviewed-by: Lyude Paul <lyude@redhat.com>

Since this kind of relies on driver initialization having already
failed (which I'm sure breaks many other things we haven't found yet)
I'm going to push this to drm-misc-next

On Wed, 2026-08-12 at 23:00 +0800, Zhenhao Wan wrote:
> nouveau_abi16_ioctl_getparam() fetches the graphics engine with
> gr = nvxx_gr(drm) (i.e. drm->nvkm->gr) and, for the
> NOUVEAU_GETPARAM_GRAPH_UNITS parameter, passes it straight to
> nvkm_gr_units(), which dereferences gr->func with no NULL check.
> 
> When graphics-engine construction returns -ENODEV, NVKM treats it as
> an
> optional absent engine: the NVKM_LAYOUT_ONCE device constructor
> deletes
> the subdevice, leaves device->gr == NULL and continues probing, and
> Nouveau still registers a render node. An unprivileged client holding
> a
> /dev/dri/renderD* fd can then issue DRM_IOCTL_NOUVEAU_GETPARAM with
> NOUVEAU_GETPARAM_GRAPH_UNITS and oops the kernel on the NULL gr.
> 
> Report 0 units when gr is absent. This matches nvkm_gr_units()
> itself,
> which already returns 0 when the engine exposes no units callback.
> 
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Assisted-by: Claude:claude-opus-5
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
> ---
>  drivers/gpu/drm/nouveau/nouveau_abi16.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c
> b/drivers/gpu/drm/nouveau/nouveau_abi16.c
> index 291203121f0c..dd3f8d386377 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
> @@ -306,7 +306,7 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
>  		getparam->value = 1;
>  		break;
>  	case NOUVEAU_GETPARAM_GRAPH_UNITS:
> -		getparam->value = nvkm_gr_units(gr);
> +		getparam->value = gr ? nvkm_gr_units(gr) : 0;
>  		break;
>  	case NOUVEAU_GETPARAM_EXEC_PUSH_MAX: {
>  		int ib_max = getparam_dma_ib_max(device);