Re: [PATCH v2 1/4] drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update

[lyude]

This patch looks fine to me, but but if this was posted by Dan
Carpenter originally would you mind switching the authorship over to
their name?

On Sun, 2026-07-12 at 14:36 +0200, Francesco Magazzu wrote:
> If the requested pstate id is not present in the state list (or the
> list is empty, e.g. broken/missing perf tables), the
> list_for_each_entry
> cursor runs off the end of the list and the subsequent
> pstate->pstate != req check dereferences the list head cast to a
> struct nvkm_pstate, which is an out-of-bounds read.
> 
> Track whether the entry was actually found instead of inspecting the
> cursor after the loop.
> 
> Fixes: 7c8565220697 ("drm/nouveau/clk: implement power state and
> engine clock control in core")
> Signed-off-by: Francesco Magazzu <postadelmaga@xxxxxxxxx>
> ---
> Note: essentially the same fix was posted by Dan Carpenter in 2022
> and
> never picked up; the bug is still present in drm-misc-next.  Credit
> for
> spotting it goes to him.
> Link: https://lore.kernel.org/dri-devel/YvSkKAdk8Pe0g2K9@kili/
> 
>  drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
> b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
> index 572e63846..42f3709e0 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
> @@ -479,13 +479,17 @@ nvkm_clk_ustate_update(struct nvkm_clk *clk,
> int req)
>  		return -ENOSYS;
>  
>  	if (req != -1 && req != -2) {
> +		bool found = false;
> +
>  		list_for_each_entry(pstate, &clk->states, head) {
> -			if (pstate->pstate == req)
> +			if (pstate->pstate == req) {
> +				found = true;
>  				break;
> +			}
>  			i++;
>  		}
>  
> -		if (pstate->pstate != req)
> +		if (!found)
>  			return -EINVAL;
>  		req = i;
>  	}