[PATCH] drm: nouveau: fifo: ga100: fix null pointer dereferences
Akhilesh Patil
akhilesh at ee.iitb.ac.in
Sat Aug 9 08:00:11 UTC 2025
Fix potential NULL pointer dereference in ga100_fifo_nonstall_allow()
and ga100_fifo_nonstall_block() when nvkm_runl_get() returns NULL.
Fix CVE-476 as reported by coverity tool (CID: 1660771)
Fixes: 55e1a5996085 ("drm/nouveau/fifo/ga100-: add per-runlist nonstall intr handling")
Addresses-Coverity-ID: 1660771
Signed-off-by: Akhilesh Patil <akhilesh at ee.iitb.ac.in>
---
drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c
index e74493a4569e..a441fb602f28 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c
@@ -520,7 +520,9 @@ ga100_fifo_nonstall_block(struct nvkm_event *event, int type, int index)
struct nvkm_fifo *fifo = container_of(event, typeof(*fifo), nonstall.event);
struct nvkm_runl *runl = nvkm_runl_get(fifo, index, 0);
- nvkm_inth_block(&runl->nonstall.inth);
+ WARN_ON(!runl);
+ if (runl)
+ nvkm_inth_block(&runl->nonstall.inth);
}
static void
@@ -529,7 +531,9 @@ ga100_fifo_nonstall_allow(struct nvkm_event *event, int type, int index)
struct nvkm_fifo *fifo = container_of(event, typeof(*fifo), nonstall.event);
struct nvkm_runl *runl = nvkm_runl_get(fifo, index, 0);
- nvkm_inth_allow(&runl->nonstall.inth);
+ WARN_ON(!runl);
+ if (runl)
+ nvkm_inth_allow(&runl->nonstall.inth);
}
const struct nvkm_event_func
--
2.34.1
More information about the dri-devel
mailing list