[PATCH] drm/nouveau: avoid null deref on bad arguments to nouveau_vma_getmap

[Ilia Mirkin]

The code expects non-VRAM mem nodes to have a pages list. If that's not
set, it will do a null deref down the line. Warn on that condition and
return an error.

See https://bugs.freedesktop.org/show_bug.cgi?id=64774

Reported-by: Pasi Kärkkäinen <pasik at iki.fi>
Tested-by: Pasi Kärkkäinen <pasik at iki.fi>
Signed-off-by: Ilia Mirkin <imirkin at alum.mit.edu>
Cc: <stable at vger.kernel.org> # 3.8+
---

I don't exactly understand what's going on, but this is just a
straightforward way to avoid a null deref that you see happens in the
bug. I haven't figured out the root cause of this, but it's getting
well into the "I have no idea how TTM works" space. However this seems
like a bit of defensive programming -- nouveau_vm_map_sg will pass
node->pages as a list down, which will be dereferenced by
nvc0_vm_map_sg. Perhaps the other arguments should make that
dereferencing not happen, but it definitely was happening here, as you
can see in the bug.

Ben/Maarten, I'll let you judge whether this check is appropriate,
since like I hope I was able to convey above, I'm just not really sure :)

 drivers/gpu/drm/nouveau/nouveau_bo.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index cdc3282..191145d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -963,6 +963,12 @@ nouveau_vma_getmap(struct nouveau_channel *chan, struct nouveau_bo *nvbo,
 	struct nouveau_mem *node = mem->mm_node;
 	int ret;
 
+	/* If we ever get here for a non-vram mem node that doesn't
+	 * have pages, we will end up doing a null deref in
+	 * nouveau_vm_map_sg. */
+	if (WARN_ON(mem->mem_type != TTM_PL_VRAM && !node->pages))
+		return -EINVAL;
+
 	ret = nouveau_vm_get(nv_client(chan->cli)->vm, mem->num_pages <<
 			     PAGE_SHIFT, node->page_shift,
 			     NV_MEM_ACCESS_RW, vma);
-- 
1.8.1.5