From 18a07a38c0973a8ee6c04db1a79f3736c84b4b71 Mon Sep 17 00:00:00 2001 From: nvme0n1p1 Date: Sun, 9 Aug 2026 21:30:10 +0800 Subject: [PATCH] nvidia-drm: fix NULL deref in revoke_modeset_permission on alloc failure When nv_drm_atomic_state_base_alloc() fails in nv_drm_revoke_modeset_permission() (e.g. under memory pressure), the error path jumps to the 'done' label where it unconditionally calls nv_drm_atomic_state_base_put(state) with state == NULL. The underlying drm_atomic_state_put()/drm_atomic_commit_put() performs kref_put on state->ref, dereferencing the NULL pointer and crashing the kernel. Guard the put() call with a NULL check. This is consistent with the other nv_drm_atomic_state_base_alloc() call sites in the driver (nvidia-drm-drv.c:999 and nvidia-drm-helper.c:104) which return early on allocation failure without calling put(). Reachable from nv_drm_postclose() (any process closing a DRM fd) and from the DRM_IOCTL_NVIDIA_REVOKE_PERMISSIONS ioctl, so a local user with access to /dev/dri/card* can trigger a kernel panic under OOM conditions. Confirmed by a real-world crash during global OOM on 2026-08-09. --- kernel-open/nvidia-drm/nvidia-drm-drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel-open/nvidia-drm/nvidia-drm-drv.c b/kernel-open/nvidia-drm/nvidia-drm-drv.c index 30e363cf16..2f7b67d557 100644 --- a/kernel-open/nvidia-drm/nvidia-drm-drv.c +++ b/kernel-open/nvidia-drm/nvidia-drm-drv.c @@ -1519,7 +1519,8 @@ static int nv_drm_revoke_modeset_permission(struct drm_device *dev, ret = drm_atomic_commit(state); done: - nv_drm_atomic_state_base_put(state); + if (state) + nv_drm_atomic_state_base_put(state); #if NV_DRM_MODESET_LOCK_ALL_END_ARGUMENT_COUNT == 3 DRM_MODESET_LOCK_ALL_END(dev, ctx, ret);