[PATCH v2 0/4] drm/nouveau: fix list cursor use after loop in the clk pstate paths

[Francesco Magazzu]

This series deals with the three places in the nouveau clk pstate code
where the list_for_each_entry() cursor is used after the loop, plus one
unrelated fix.  They are exactly the three sites Dan Carpenter listed in
2022; his patch for the first one was never applied and the bug is still
present in drm-misc-next.

Link: https://lore.kernel.org/dri-devel/YvSkKAdk8Pe0g2K9@kili/

Only patch 1 fixes a bug that can actually be triggered:
nvkm_clk_ustate_update() takes an arbitrary pstate id from the user and
never checks that a matching entry exists, so if it does not the cursor
ends up pointing at the list head and the code reads past it.  It carries
a Fixes: tag and the credit for spotting it goes to Dan.

Patches 2 and 3 fix the same pattern in nvkm_pstate_prog() and
nvkm_control_mthd_pstate_attr(), but neither is triggerable as the code
stands: the callers of nvkm_pstate_prog() clamp the index against
clk->state_nr first, and nvkm_control_mthd_pstate_attr() already rejects
args->v0.state >= clk->state_nr before the loop.  Both are hardening, not
bug fixes, and they carry no Fixes: tag on purpose.  The point is to stop
the two functions from being correct only by virtue of what their callers
do.

Patch 4 is unrelated and is a real bug, though a modest one:
nvkm_cstate_prog() overwrites the reclock status in 'ret' with the status
of the voltage/fan restore calls it makes afterwards.  The only consumer of
the return value is an error message in nvkm_pstate_work(), so the
observable effect is that a failing reclock is never reported in dmesg.

Compile-tested only.  All the affected paths are reachable only by root,
through the 'pstate' debugfs file, so I could not exercise them in any
other way.

v2: v1 (2 patches) was sent on 2026-07-11 with a mail client that mangled
the patch text, so it did not apply; it is resent here with git send-email.
This version also adds the two remaining sites from Dan's list, and the
Fixes: tags to the two real fixes.

Link to v1:
https://lore.kernel.org/nouveau/CAHwn+vnw=DD=j7umFVdcr8-F6yUz=iM+3yfA+HcHKXJwpNrHRA@xxxxxxxxxxxxxx/

Francesco Magazzu (4):
  drm/nouveau/clk: fix list cursor use after loop in
    nvkm_clk_ustate_update
  drm/nouveau/clk: don't use the pstate cursor after the loop
  drm/nouveau/device: don't use the pstate cursor after the loop
  drm/nouveau/clk: don't clobber reclock status when restoring volt/fan

 .../gpu/drm/nouveau/nvkm/engine/device/ctrl.c |  8 ++++-
 .../gpu/drm/nouveau/nvkm/subdev/clk/base.c    | 32 +++++++++++++------
 2 files changed, 29 insertions(+), 11 deletions(-)


base-commit: a284476db2653ae893f46cbea408eb412db54eb0
-- 
2.55.0