On Fri, 2026-10-09 at 11:44 -0600, Jim Cromie via B4 Relay wrote: > From: Jim Cromie <[email protected]> > > When hardware or firmware initialization fails, the graphics engine > (gr) or device functions may remain NULL. Attempting to access these > during the GETPARAM ioctl (e.g., NOUVEAU_GETPARAM_GRAPH_UNITS) > results > in a kernel NULL pointer dereference, causing a crash when userspace > (GNOME/Mesa) attempts to probe the device. > > Add safety checks for 'gr', 'gr->func', and 'nvkm_device->func' in > the > ioctl handler. Return -ENODEV to signal the missing hardware state to > userspace, and use NV_ERROR_ONCE to provide diagnostic proof in the > kernel log without risking a console flood. > > NOTE: > > I encountered these crashes while booting unrelated code (in > dynamic-debug) on real HW. There was also some fwupd updates around > this time, so it could all be transient/unreproducible. But it did > happen, and could happen again in unforseen circumstances. > > @Capitain_Jack tested the error path in v1 by deleting the FW
I can just fix this up before pushing but JFYI - if you put comments below the --- that's down below, they will show up in the email but not the commit message. Either way - Reviewed-by: Lyude Paul <[email protected]> > > Signed-off-by: Jim Cromie <[email protected]> > Tested-by: Daniel Campos Ramos <[email protected]> > --- > drivers/gpu/drm/nouveau/nouveau_abi16.c | 22 ++++++++++++++++++++-- > 1 file changed, 20 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c > b/drivers/gpu/drm/nouveau/nouveau_abi16.c > index 4542d5f4ded8..3f130cd4fbcd 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_abi16.c > +++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c > @@ -306,6 +306,11 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS) > getparam->value = 1; > break; > case NOUVEAU_GETPARAM_GRAPH_UNITS: > + if (!gr || !gr->func) { > + NV_ERROR_ONCE(drm, "GETPARAM_GRAPH_UNITS: no > gr engine or func\n"); > + return -ENODEV; > + } > + > getparam->value = nvkm_gr_units(gr); > break; > case NOUVEAU_GETPARAM_EXEC_PUSH_MAX: { > @@ -315,10 +320,23 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS) > break; > } > case NOUVEAU_GETPARAM_VRAM_BAR_SIZE: > - getparam->value = nvkm_device->func- > >resource_size(nvkm_device, NVKM_BAR1_FB); > + if (!nvkm_device || !nvkm_device->func || > !nvkm_device->func->resource_size) { > + NV_ERROR_ONCE(drm, "GETPARAM_VRAM_BAR_SIZE: > no device func\n"); > + return -ENODEV; > + } > + > + getparam->value = > + nvkm_device->func- > >resource_size(nvkm_device, NVKM_BAR1_FB); > break; > case NOUVEAU_GETPARAM_VRAM_USED: { > - struct ttm_resource_manager *vram_mgr = > ttm_manager_type(&drm->ttm.bdev, TTM_PL_VRAM); > + struct ttm_resource_manager *vram_mgr = > + ttm_manager_type(&drm->ttm.bdev, > TTM_PL_VRAM); > + > + if (!vram_mgr) { > + NV_ERROR_ONCE(drm, "GETPARAM_VRAM_USED: no > vram mgr\n"); > + return -ENODEV; > + } > + > getparam->value = > (u64)ttm_resource_manager_usage(vram_mgr); > break; > }
