Re: [PATCH v2 3/3] nouveau: Fix NULL dereference in nvkm_gsp_gcx_ready()

[lyude]

On Fri, 2026-10-09 at 23:53 +0200, Danilo Krummrich wrote:
> On Fri Oct 9, 2026 at 7:44 PM CEST, Jim Cromie via B4 Relay wrote:
> > From: Jim Cromie <jim.cromie@xxxxxxxxx>
> > 
> > Commit cb4c7603678c ("drm/nouveau/gsp/r570: Add support for
> > INTERNAL_GCX_ENTRY_PREREQUISITE") hooked nvif_device_gcx_ready()
> > into
> > nouveau_pmops_runtime_suspend() to consult GSP before runtime
> > suspend.
> > 
> > On GPUs running without GSP-RM (e.g. Volta GV100, NvGspRm=0, or
> > missing
> > GSP firmware blobs), device->gsp is instantiated but gsp->rm
> > remains
> > NULL. nvkm_udevice_gcx_ready() checked "!gsp" instead of verifying
> > nvkm_gsp_rm(gsp), allowing non-RM instances to invoke
> > nvkm_gsp_gcx_ready(). nvkm_gsp_gcx_ready() then unconditionally
> > dereferenced gsp->rm->api, causing a kernel oops:
> > 
> >   RIP: 0010:nvkm_gsp_gcx_ready+0x10/0x30 [nouveau]
> >   Code: ... 48 8b 87 70 0e 00 00 <48> 8b 40 18 ...
> >   RAX: 0000000000000000 RDI: ffff8c9555fca000
> >   Call Trace:
> >    nvkm_udevice_mthd+0xa5/0x150 [nouveau]
> >    nvkm_ioctl+0xcc/0x1d0 [nouveau]
> >    nvif_object_mthd+0x110/0x1e0 [nouveau]
> >    nvif_device_gcx_ready+0x36/0x60 [nouveau]
> >    nouveau_pmops_runtime_suspend+0x39/0x140 [nouveau]
> > 
> > Instruction decode shows `mov rax, [rdi+0xe70]` loads gsp->rm
> > (0x0),
> > and `<48> 8b 40 18` (`mov rax, [rax+0x18]`) faults accessing rm-
> > >api.
> > 
> > Fix by:
> > 0. Checking !nvkm_gsp_rm(gsp) in nvkm_udevice_gcx_ready() so non-RM
> >    devices report GC6/GcOff ready and bypass the GSP call entirely.
> > 1. Guarding gsp and gsp->rm in nvkm_gsp_gcx_ready() before
> > inspecting
> >    gsp->rm->api->gsp->gcx_ready.
> > 
> > Fixes: cb4c7603678c ("drm/nouveau/gsp/r570: Add support for
> > INTERNAL_GCX_ENTRY_PREREQUISITE")
> > Signed-off-by: Jim Cromie <jim.cromie@xxxxxxxxx>
> 
> Isn't this fixed in commit 4d0e27041185 ("nouveau: check gsp->rm as
> well as gsp
> pointer before gcx ready") already?

(gonna hold off on pushing all 3 of these patches, you're right - I
completely forgot that we had already pushed a commit for this)