On Fri Oct 9, 2026 at 7:44 PM CEST, Jim Cromie via B4 Relay wrote:
> From: Jim Cromie <[email protected]>
>
> When hardware or firmware initialization fails, the graphics engine
> (gr) or device functions may remain NULL. Attempting to access these
> during the GETPARAM ioctl (e.g., NOUVEAU_GETPARAM_GRAPH_UNITS) results
> in a kernel NULL pointer dereference, causing a crash when userspace
> (GNOME/Mesa) attempts to probe the device.
>
> Add safety checks for 'gr', 'gr->func', and 'nvkm_device->func' in the
> ioctl handler. Return -ENODEV to signal the missing hardware state to
> userspace, and use NV_ERROR_ONCE to provide diagnostic proof in the
> kernel log without risking a console flood.
>
> NOTE:
>
> I encountered these crashes while booting unrelated code (in
> dynamic-debug) on real HW. There was also some fwupd updates around
> this time, so it could all be transient/unreproducible. But it did
> happen, and could happen again in unforseen circumstances.
>
> @Capitain_Jack tested the error path in v1 by deleting the FW
>
> Signed-off-by: Jim Cromie <[email protected]>
> Tested-by: Daniel Campos Ramos <[email protected]>
Do they need to be separate patches? Do we need a Fixes: tag? Why not CC stable?
> ---
> drivers/gpu/drm/nouveau/nouveau_abi16.c | 22 ++++++++++++++++++++--
> 1 file changed, 20 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c
> b/drivers/gpu/drm/nouveau/nouveau_abi16.c
> index 4542d5f4ded8..3f130cd4fbcd 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
> @@ -306,6 +306,11 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
> getparam->value = 1;
> break;
> case NOUVEAU_GETPARAM_GRAPH_UNITS:
> + if (!gr || !gr->func) {
> + NV_ERROR_ONCE(drm, "GETPARAM_GRAPH_UNITS: no gr engine
> or func\n");
> + return -ENODEV;
> + }
> +
> getparam->value = nvkm_gr_units(gr);
> break;
> case NOUVEAU_GETPARAM_EXEC_PUSH_MAX: {
> @@ -315,10 +320,23 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
> break;
> }
> case NOUVEAU_GETPARAM_VRAM_BAR_SIZE:
> - getparam->value = nvkm_device->func->resource_size(nvkm_device,
> NVKM_BAR1_FB);
> + if (!nvkm_device || !nvkm_device->func ||
> !nvkm_device->func->resource_size) {
How can any of those ever be NULL?
> + NV_ERROR_ONCE(drm, "GETPARAM_VRAM_BAR_SIZE: no device
> func\n");
> + return -ENODEV;
> + }
> +
> + getparam->value =
> + nvkm_device->func->resource_size(nvkm_device,
> NVKM_BAR1_FB);
> break;
> case NOUVEAU_GETPARAM_VRAM_USED: {
> - struct ttm_resource_manager *vram_mgr =
> ttm_manager_type(&drm->ttm.bdev, TTM_PL_VRAM);
> + struct ttm_resource_manager *vram_mgr =
> + ttm_manager_type(&drm->ttm.bdev, TTM_PL_VRAM);
> +
> + if (!vram_mgr) {
Same here, how can this ever be NULL?
> + NV_ERROR_ONCE(drm, "GETPARAM_VRAM_USED: no vram mgr\n");
> + return -ENODEV;
> + }
> +
> getparam->value = (u64)ttm_resource_manager_usage(vram_mgr);
> break;
> }
>
> --
> 2.56.0
