Re: [PATCH 1/2] drm/nouveau: Fix NULL pointer dereferences in GETPARAM ioctl

[jim . cromie]

On Thu, Sep 17, 2026 at 2:26 PM <lyude@xxxxxxxxxx> wrote:
>
> On Sat, 2026-08-15 at 11:30 -0600, Jim Cromie wrote:
> > When hardware or firmware initialization fails, the graphics engine
> > (gr) or device functions may remain NULL. Attempting to access these
> > during the GETPARAM ioctl (e.g., NOUVEAU_GETPARAM_GRAPH_UNITS)
> > results
> > in a kernel NULL pointer dereference, causing a crash when userspace
> > (GNOME/Mesa) attempts to probe the device.
> >
> > Add safety checks for 'gr', 'gr->func', and 'nvkm_device->func' in
> > the
> > ioctl handler. Return -ENODEV to signal the missing hardware state to
> > userspace, and use NV_ERROR_ONCE to provide diagnostic proof in the
> > kernel log without risking a console flood.
> >
> > RFC:
> >
> > These crashes may not be repeatable, they happened while I was trying
> > to build nouveau as a builtin module, with binary blobs in the kernel
> > image, on a laptop with an encrypted disk.  Gemini tells me this
> > won't
> > work, so I punted.
>
> "Gemini tells me this won't work, so I punted."
>
> I'm sorry, what exactly do you mean here? And could you clarify what
> LLMs were used for in writing this series? Code generation, analysis,
> etc.?

Gemini CLI v0.50.0 - or earlier, at that time.

these were drive-by patches I did while testing a patchset on HW.
The bootlogs showed a null ptr splat
I threw the logs to gemini, it tracked down the bug.
the null ptr b4 deref was rather obvious.

at time of writing there was also some FW churn going on,
and it felt un-repeatable wo screwing with fwupd, which I wasnt gonna do.
Plus the test scenario felt like it gonna fall apart.

Since then Ive been merging it into builds for HW installs,
I recently forgot to merge them, and one occurred immediately

Sep 16 22:53:28 frodo kernel: Linux version
7.3.0-rc3-rhx-00051-g3078971ab959 (jimc@frodo) (gcc (GCC) 16.2.1
20260819 (Red Hat 16.2.1-2), GNU ld version 2.46.1-1.fc44) #>
Sep 16 22:53:28 frodo kernel: Command line:
BOOT_IMAGE=(hd0,gpt2)/vmlinuz-7.3.0-rc3-rhx-00051-g3078971ab959
root=UUID=66f47421-b9ff-49ca-9257-0216463436c2 ro rootflags=s>
Sep 16 22:53:28 frodo kernel: BIOS-provided physical RAM map:
...
Sep 16 22:54:53 frodo kernel: BUG: kernel NULL pointer dereference,
address: 00000000000000f0
Sep 16 22:54:53 frodo kernel: #PF: supervisor read access in kernel mode
Sep 16 22:54:53 frodo kernel: #PF: error_code(0x0000) - not-present page
Sep 16 22:54:53 frodo kernel: PGD 0 P4D 0
Sep 16 22:54:53 frodo kernel: Oops: Oops: 0000 [#3] SMP NOPTI
Sep 16 22:54:53 frodo kernel: CPU: 2 UID: 60579 PID: 2445 Comm:
gnome-shell Tainted: G      D
7.3.0-rc3-rhx-00051-g3078971ab959 #10 PREEMPT(lazy)
Sep 16 22:54:53 frodo kernel: Tainted: [D]=DIE
Sep 16 22:54:53 frodo kernel: Hardware name: ASUSTeK COMPUTER INC.
ASUS TUF Gaming A17 FA706QE_TUF706QE/FA706QE, BIOS FA706QE.311
11/06/2025
Sep 16 22:54:53 frodo kernel: RIP:
0010:nouveau_abi16_ioctl_get_zcull_info+0x17/0xa0 [nouveau]
Sep 16 22:54:53 frodo kernel: Code: 00 00 00 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 8b 47 40 48 8b
00 48 8b 80 70 02 00 00 <80> b8>
Sep 16 22:54:53 frodo kernel: RSP: 0018:ffffd36e025dbbb0 EFLAGS: 00010202
Sep 16 22:54:53 frodo kernel: RAX: 0000000000000000 RBX:
0000000000000020 RCX: 0000000000000020
Sep 16 22:54:53 frodo kernel: RDX: ffff8c547be52600 RSI:
ffffd36e025dbc50 RDI: ffff8c545440b800
Sep 16 22:54:53 frodo kernel: RBP: ffff8c547be52600 R08:
ffffd36e025dbc50 R09: ffffd36e025dbc50
Sep 16 22:54:53 frodo kernel: R10: 0000000000000030 R11:
ffff8c5454600098 R12: ffff8c545440b800
Sep 16 22:54:53 frodo kernel: R13: ffffffffc31569e0 R14:
ffffd36e025dbc50 R15: 0000000080306453
Sep 16 22:54:53 frodo kernel: FS:  00007fa46fa77880(0000)
GS:ffff8c576ab7a000(0000) knlGS:0000000000000000
Sep 16 22:54:53 frodo kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Sep 16 22:54:53 frodo kernel: CR2: 00000000000000f0 CR3:
000000011df78000 CR4: 0000000000f50ef0
Sep 16 22:54:53 frodo kernel: PKRU: 55555554
Sep 16 22:54:53 frodo kernel: Call Trace:
Sep 16 22:54:53 frodo kernel:  <TASK>
Sep 16 22:54:53 frodo kernel:  drm_ioctl_kernel+0xae/0x100
Sep 16 22:54:53 frodo kernel:  drm_ioctl+0x2e0/0x560
Sep 16 22:54:53 frodo kernel:  ?
__pfx_nouveau_abi16_ioctl_get_zcull_info+0x10/0x10 [nouveau]
Sep 16 22:54:53 frodo kernel:  nouveau_drm_ioctl+0x58/0xc0 [nouveau]
Sep 16 22:54:53 frodo kernel:  __x64_sys_ioctl+0xb9/0x100
Sep 16 22:54:53 frodo kernel:  ? do_syscall_64+0xfa/0x470
Sep 16 22:54:53 frodo kernel:  do_syscall_64+0xbe/0x470

if youd like, I can trim that part of the commit - msg
or just edit out the noise.

>
> >
> > Signed-off-by: Jim Cromie <jim.cromie@xxxxxxxxx>
>