Re: [PATCH] drm/nouveau: reject zero-size notifier object allocation

Reviewed-by: Lyude Paul <[email protected]>

Will push to drm-misc-fixes in a moment

On Thu, 2026-08-13 at 21:14 +0800, Zhenhao Wan wrote:
> nouveau_abi16_ioctl_notifierobj_alloc() passes the userspace-
> controlled
> info->size to nvkm_mm_head() as both size_max and size_min without a
> lower
> bound.  A zero size satisfies the allocator's "e - s < size_min" gate
> (size_min == 0 makes the unsigned comparison inert) and yields a
> zero-length node, after which
> 
> 	args.limit = ntfy->node->offset + ntfy->node->length - 1;
> 
> underflows (offset 0, length 0 -> 0xffffffff) into an oversized ~4
> GiB DMA
> window.  The dma object constructor only rejects start > limit, so
> the
> validly ordered [base, base + 0xffffffff] range passes and is
> programmed
> into the GPU DMA context.  The ioctl is DRM_RENDER_ALLOW, so any
> render
> node client can trigger this on pre-Fermi hardware.
> 
> Reject a zero-size request before allocating anything.
> 
> Fixes: ebb945a94bba ("drm/nouveau: port all engines to new engine
> module format")
> Reported-by: Yuhao Jiang <[email protected]>
> Assisted-by: Claude:claude-opus-5
> Cc: [email protected]
> Signed-off-by: Zhenhao Wan <[email protected]>
> ---
>  drivers/gpu/drm/nouveau/nouveau_abi16.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c
> b/drivers/gpu/drm/nouveau/nouveau_abi16.c
> index 291203121f0c..8d139bbb2934 100644
> --- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
> +++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
> @@ -660,6 +660,10 @@
> nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
>  	if (unlikely(device->info.family >=
> NV_DEVICE_INFO_V0_FERMI))
>  		return nouveau_abi16_put(abi16, -EINVAL);
>  
> +	/* zero size yields a zero-length node, underflowing
> args.limit */
> +	if (unlikely(!info->size))
> +		return nouveau_abi16_put(abi16, -EINVAL);
> +
>  	chan = nouveau_abi16_chan(abi16, info->channel);
>  	if (!chan)
>  		return nouveau_abi16_put(abi16, -ENOENT);
> 
> ---
> base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
> change-id: 20260813-nouveau-abi16-notifierobj-zero-size-5d3888d36b57
> 
> Best regards,
> --  
> Zhenhao Wan <[email protected]>