Reviewed-by: Lyude Paul <[email protected]>
Will push to drm-misc-next in a moment
On Wed, 2026-08-12 at 23:00 +0800, Zhenhao Wan wrote:
> The NV50 and GF100 software-class vblank methods nv50_sw_chan_mthd()
> and gf100_sw_chan_mthd() evaluate "data < device->disp-
> >vblank.index_nr"
> to validate the requested vblank head before allowing its notifier.
>
> On a headless card the display subdevice is absent:
> nvkm_subdev_disable()
> (strap-driven from devinit) and the -ENODEV path of the
> NVKM_LAYOUT_ONCE
> device constructor both leave device->disp == NULL while the device
> continues to probe and still registers a render node (DRIVER_RENDER).
> An
> unprivileged client holding a /dev/dri/renderD* fd can then create a
> software channel and push method 0x0408 (NV50) / 0x040c (GF100),
> which
> dereferences the NULL device->disp and oopses the kernel.
>
> The channel constructors nv50_sw_chan_new() and gf100_sw_chan_new()
> already tolerate an absent display ("for (i = 0; disp && ...)"), so
> no
> vblank notifier is ever registered on such a card and the method
> handlers
> are the only path that assumes disp is present. Guard the dereference
> with the same disp NULL test the constructors already use.
>
> Reported-by: Yuhao Jiang <[email protected]>
> Assisted-by: Claude:claude-opus-5
> Cc: [email protected]
> Signed-off-by: Zhenhao Wan <[email protected]>
> ---
> drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c | 2 +-
> drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c
> b/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c
> index 0171cdf6f639..4cf8cd120c76 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/engine/sw/gf100.c
> @@ -72,7 +72,7 @@ gf100_sw_chan_mthd(struct nvkm_sw_chan *base, int
> subc, u32 mthd, u32 data)
> chan->vblank.value = data;
> return true;
> case 0x040c:
> - if (data < device->disp->vblank.index_nr) {
> + if (device->disp && data < device->disp-
> >vblank.index_nr) {
> nvkm_event_ntfy_allow(&chan-
> >vblank.notify[data]);
> return true;
> }
> diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c
> b/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c
> index 0cfb1eaae6de..b202e11238a5 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/engine/sw/nv50.c
> @@ -69,7 +69,7 @@ nv50_sw_chan_mthd(struct nvkm_sw_chan *base, int
> subc, u32 mthd, u32 data)
> case 0x0400: chan->vblank.offset = data; return true;
> case 0x0404: chan->vblank.value = data; return true;
> case 0x0408:
> - if (data < device->disp->vblank.index_nr) {
> + if (device->disp && data < device->disp-
> >vblank.index_nr) {
> nvkm_event_ntfy_allow(&chan-
> >vblank.notify[data]);
> return true;
> }
