[PATCH 0/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM and GET_ZCULL_INFO ioctls

[PATCH 0/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM and GET_ZCULL_INFO ioctls

[Jim Cromie]

When Nouveau initialization is incomplete (e.g. firmware microcode fails
to load or graphics engine initialization aborts early), userspace display
servers (GNOME/Mesa) probing device capabilities trigger fatal kernel NULL
pointer dereferences in the Nouveau ioctl handlers.

This 2-patch series fixes two distinct NULL pointer crash paths:

1. drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl
   - Prevents NULL dereference of gr, gr->func, and nvkm_device->func in
     nouveau_abi16_ioctl_getparam(). Returns -ENODEV cleanly.

2. drm/nouveau: Fix NULL pointer dereference in GET_ZCULL_INFO ioctl
   - Checks that gr is non-NULL before inspecting gr->has_zcull_info at
     offset 0xf0 in nouveau_abi16_ioctl_get_zcull_info().

Both bugs were reproduced and verified fixed on GA107 (NVIDIA GeForce
RTX 3050 Mobile) running 7.2-rc7 under GNOME Wayland desktop initialization.

Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
---
Jim Cromie (2):
      drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl
      drm/nouveau: Fix NULL pointer dereference in GET_ZCULL_INFO ioctl

 drivers/gpu/drm/nouveau/nouveau_abi16.c | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)
---
base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
change-id: 20260815-null-fixes-5e9e86666a5d

Best regards,
-- 
Jim Cromie <jim.cromie@gmail.com>

[PATCH 1/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl

[Jim Cromie]

When hardware or firmware initialization fails, the graphics engine
(gr) or device functions may remain NULL. Attempting to access these
during the GETPARAM ioctl (e.g., NOUVEAU_GETPARAM_GRAPH_UNITS) results
in a kernel NULL pointer dereference, causing a crash when userspace
(GNOME/Mesa) attempts to probe the device.

Add safety checks for 'gr', 'gr->func', and 'nvkm_device->func' in the
ioctl handler. Return -ENODEV to signal the missing hardware state to
userspace, and use NV_ERROR_ONCE to provide diagnostic proof in the
kernel log without risking a console flood.

RFC:

These crashes may not be repeatable, they happened while I was trying
to build nouveau as a builtin module, with binary blobs in the kernel
image, on a laptop with an encrypted disk.  Gemini tells me this won't
work, so I punted.

Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
---
 drivers/gpu/drm/nouveau/nouveau_abi16.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index 291203121f0c..c9270c5b0fac 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -306,7 +306,12 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
 		getparam->value = 1;
 		break;
 	case NOUVEAU_GETPARAM_GRAPH_UNITS:
-		getparam->value = nvkm_gr_units(gr);
+		if (gr && gr->func) {
+			getparam->value = nvkm_gr_units(gr);
+		} else {
+			NV_ERROR_ONCE(drm, "GETPARAM_GRAPH_UNITS: no gr engine or func\n");
+			return -ENODEV;
+		}
 		break;
 	case NOUVEAU_GETPARAM_EXEC_PUSH_MAX: {
 		int ib_max = getparam_dma_ib_max(device);
@@ -315,11 +320,23 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
 		break;
 	}
 	case NOUVEAU_GETPARAM_VRAM_BAR_SIZE:
-		getparam->value = nvkm_device->func->resource_size(nvkm_device, NVKM_BAR1_FB);
+		if (nvkm_device && nvkm_device->func && nvkm_device->func->resource_size) {
+			getparam->value =
+				nvkm_device->func->resource_size(nvkm_device, NVKM_BAR1_FB);
+		} else {
+			NV_ERROR_ONCE(drm, "GETPARAM_VRAM_BAR_SIZE: no device func\n");
+			return -ENODEV;
+		}
 		break;
 	case NOUVEAU_GETPARAM_VRAM_USED: {
-		struct ttm_resource_manager *vram_mgr = ttm_manager_type(&drm->ttm.bdev, TTM_PL_VRAM);
-		getparam->value = (u64)ttm_resource_manager_usage(vram_mgr);
+		struct ttm_resource_manager *vram_mgr =
+			ttm_manager_type(&drm->ttm.bdev, TTM_PL_VRAM);
+		if (vram_mgr) {
+			getparam->value = (u64)ttm_resource_manager_usage(vram_mgr);
+		} else {
+			NV_ERROR_ONCE(drm, "GETPARAM_VRAM_USED: no vram mgr\n");
+			return -ENODEV;
+		}
 		break;
 	}
 	case NOUVEAU_GETPARAM_HAS_VMA_TILEMODE:

-- 
2.55.0

Re: [PATCH 1/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl

[lyude]

On Sat, 2026-08-15 at 11:30 -0600, Jim Cromie wrote:
> When hardware or firmware initialization fails, the graphics engine
> (gr) or device functions may remain NULL. Attempting to access these
> during the GETPARAM ioctl (e.g., NOUVEAU_GETPARAM_GRAPH_UNITS)
> results
> in a kernel NULL pointer dereference, causing a crash when userspace
> (GNOME/Mesa) attempts to probe the device.
> 
> Add safety checks for 'gr', 'gr->func', and 'nvkm_device->func' in
> the
> ioctl handler. Return -ENODEV to signal the missing hardware state to
> userspace, and use NV_ERROR_ONCE to provide diagnostic proof in the
> kernel log without risking a console flood.
> 
> RFC:
> 
> These crashes may not be repeatable, they happened while I was trying
> to build nouveau as a builtin module, with binary blobs in the kernel
> image, on a laptop with an encrypted disk.  Gemini tells me this
> won't
> work, so I punted.

"Gemini tells me this won't work, so I punted."

I'm sorry, what exactly do you mean here? And could you clarify what
LLMs were used for in writing this series? Code generation, analysis,
etc.?

> 
> Signed-off-by: Jim Cromie <jim.cromie@gmail.com>

Re: [PATCH 1/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl

[jim.cromie]

On Thu, Sep 17, 2026 at 2:26 PM <lyude@redhat.com> wrote:
>
> On Sat, 2026-08-15 at 11:30 -0600, Jim Cromie wrote:
> > When hardware or firmware initialization fails, the graphics engine
> > (gr) or device functions may remain NULL. Attempting to access these
> > during the GETPARAM ioctl (e.g., NOUVEAU_GETPARAM_GRAPH_UNITS)
> > results
> > in a kernel NULL pointer dereference, causing a crash when userspace
> > (GNOME/Mesa) attempts to probe the device.
> >
> > Add safety checks for 'gr', 'gr->func', and 'nvkm_device->func' in
> > the
> > ioctl handler. Return -ENODEV to signal the missing hardware state to
> > userspace, and use NV_ERROR_ONCE to provide diagnostic proof in the
> > kernel log without risking a console flood.
> >
> > RFC:
> >
> > These crashes may not be repeatable, they happened while I was trying
> > to build nouveau as a builtin module, with binary blobs in the kernel
> > image, on a laptop with an encrypted disk.  Gemini tells me this
> > won't
> > work, so I punted.
>
> "Gemini tells me this won't work, so I punted."
>
> I'm sorry, what exactly do you mean here? And could you clarify what
> LLMs were used for in writing this series? Code generation, analysis,
> etc.?

Gemini CLI v0.50.0 - or earlier, at that time.

these were drive-by patches I did while testing a patchset on HW.
The bootlogs showed a null ptr splat
I threw the logs to gemini, it tracked down the bug.
the null ptr b4 deref was rather obvious.

at time of writing there was also some FW churn going on,
and it felt un-repeatable wo screwing with fwupd, which I wasnt gonna do.
Plus the test scenario felt like it gonna fall apart.

Since then Ive been merging it into builds for HW installs,
I recently forgot to merge them, and one occurred immediately

Sep 16 22:53:28 frodo kernel: Linux version
7.3.0-rc3-rhx-00051-g3078971ab959 (jimc@frodo) (gcc (GCC) 16.2.1
20260819 (Red Hat 16.2.1-2), GNU ld version 2.46.1-1.fc44) #>
Sep 16 22:53:28 frodo kernel: Command line:
BOOT_IMAGE=(hd0,gpt2)/vmlinuz-7.3.0-rc3-rhx-00051-g3078971ab959
root=UUID=66f47421-b9ff-49ca-9257-0216463436c2 ro rootflags=s>
Sep 16 22:53:28 frodo kernel: BIOS-provided physical RAM map:
...
Sep 16 22:54:53 frodo kernel: BUG: kernel NULL pointer dereference,
address: 00000000000000f0
Sep 16 22:54:53 frodo kernel: #PF: supervisor read access in kernel mode
Sep 16 22:54:53 frodo kernel: #PF: error_code(0x0000) - not-present page
Sep 16 22:54:53 frodo kernel: PGD 0 P4D 0
Sep 16 22:54:53 frodo kernel: Oops: Oops: 0000 [#3] SMP NOPTI
Sep 16 22:54:53 frodo kernel: CPU: 2 UID: 60579 PID: 2445 Comm:
gnome-shell Tainted: G      D
7.3.0-rc3-rhx-00051-g3078971ab959 #10 PREEMPT(lazy)
Sep 16 22:54:53 frodo kernel: Tainted: [D]=DIE
Sep 16 22:54:53 frodo kernel: Hardware name: ASUSTeK COMPUTER INC.
ASUS TUF Gaming A17 FA706QE_TUF706QE/FA706QE, BIOS FA706QE.311
11/06/2025
Sep 16 22:54:53 frodo kernel: RIP:
0010:nouveau_abi16_ioctl_get_zcull_info+0x17/0xa0 [nouveau]
Sep 16 22:54:53 frodo kernel: Code: 00 00 00 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 8b 47 40 48 8b
00 48 8b 80 70 02 00 00 <80> b8>
Sep 16 22:54:53 frodo kernel: RSP: 0018:ffffd36e025dbbb0 EFLAGS: 00010202
Sep 16 22:54:53 frodo kernel: RAX: 0000000000000000 RBX:
0000000000000020 RCX: 0000000000000020
Sep 16 22:54:53 frodo kernel: RDX: ffff8c547be52600 RSI:
ffffd36e025dbc50 RDI: ffff8c545440b800
Sep 16 22:54:53 frodo kernel: RBP: ffff8c547be52600 R08:
ffffd36e025dbc50 R09: ffffd36e025dbc50
Sep 16 22:54:53 frodo kernel: R10: 0000000000000030 R11:
ffff8c5454600098 R12: ffff8c545440b800
Sep 16 22:54:53 frodo kernel: R13: ffffffffc31569e0 R14:
ffffd36e025dbc50 R15: 0000000080306453
Sep 16 22:54:53 frodo kernel: FS:  00007fa46fa77880(0000)
GS:ffff8c576ab7a000(0000) knlGS:0000000000000000
Sep 16 22:54:53 frodo kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Sep 16 22:54:53 frodo kernel: CR2: 00000000000000f0 CR3:
000000011df78000 CR4: 0000000000f50ef0
Sep 16 22:54:53 frodo kernel: PKRU: 55555554
Sep 16 22:54:53 frodo kernel: Call Trace:
Sep 16 22:54:53 frodo kernel:  <TASK>
Sep 16 22:54:53 frodo kernel:  drm_ioctl_kernel+0xae/0x100
Sep 16 22:54:53 frodo kernel:  drm_ioctl+0x2e0/0x560
Sep 16 22:54:53 frodo kernel:  ?
__pfx_nouveau_abi16_ioctl_get_zcull_info+0x10/0x10 [nouveau]
Sep 16 22:54:53 frodo kernel:  nouveau_drm_ioctl+0x58/0xc0 [nouveau]
Sep 16 22:54:53 frodo kernel:  __x64_sys_ioctl+0xb9/0x100
Sep 16 22:54:53 frodo kernel:  ? do_syscall_64+0xfa/0x470
Sep 16 22:54:53 frodo kernel:  do_syscall_64+0xbe/0x470

if youd like, I can trim that part of the commit - msg
or just edit out the noise.

>
> >
> > Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
>

[PATCH 2/2] drm/nouveau: Fix NULL pointer dereference in GET_ZCULL_INFO ioctl

[Jim Cromie]

When graphics engine firmware fails to load or initialization aborts
early, nvxx_gr(drm) returns NULL. Calling DRM_IOCTL_NOUVEAU_GET_ZCULL_INFO
causes nouveau_abi16_ioctl_get_zcull_info() to dereference gr at offset
0xf0 without checking for NULL, triggering a kernel page fault.

Validate that gr is non-NULL before inspecting gr->has_zcull_info.

Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
---
Aug 14 09:21:52 frodo kernel: BUG: kernel NULL pointer dereference, address: 00000000000000f0
Aug 14 09:21:52 frodo kernel: #PF: error_code(0x0000) - not-present page
Aug 14 09:21:52 frodo kernel: Oops: Oops: 0000 [#1] SMP NOPTI
Aug 14 09:21:52 frodo kernel: RIP: 0010:nouveau_abi16_ioctl_get_zcull_info+0x17/0xa0 [nouveau]
Aug 14 09:21:52 frodo kernel: Code: 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 8b 47 40 48 8b 00 48 8b 80 70 02 00 00 <80> b8 f0 00 00 00 00 74 72 8b 90 c0 00 00 00 89 16 8b 90 c4 00 00
Aug 14 09:21:52 frodo kernel: Call Trace:
Aug 14 09:21:52 frodo kernel:  <TASK>
Aug 14 09:21:52 frodo kernel:  drm_ioctl_kernel+0xae/0x100
Aug 14 09:21:52 frodo kernel:  drm_ioctl+0x2e0/0x560
Aug 14 09:21:52 frodo kernel:  ? __pfx_nouveau_abi16_ioctl_get_zcull_info+0x10/0x10 [nouveau]
Aug 14 09:21:52 frodo kernel:  nouveau_drm_ioctl+0x58/0xc0 [nouveau]
Aug 14 09:21:52 frodo kernel:  __x64_sys_ioctl+0xb9/0x100
Aug 14 09:21:52 frodo kernel:  do_syscall_64+0xe2/0x560
Aug 14 09:21:52 frodo kernel:  entry_SYSCALL_64_after_hwframe+0x76/0x7e
Aug 14 09:21:52 frodo kernel:  </TASK>
---
 drivers/gpu/drm/nouveau/nouveau_abi16.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index c9270c5b0fac..f1026a716ff7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -357,7 +357,7 @@ nouveau_abi16_ioctl_get_zcull_info(ABI16_IOCTL_ARGS)
 	struct nvkm_gr *gr = nvxx_gr(drm);
 	struct drm_nouveau_get_zcull_info *out = data;
 
-	if (gr->has_zcull_info) {
+	if (gr && gr->has_zcull_info) {
 		const struct nvkm_gr_zcull_info *i = &gr->zcull_info;
 
 		out->width_align_pixels = i->width_align_pixels;

-- 
2.55.0