This series deals with the three places in the nouveau clk pstate code where the list_for_each_entry() cursor is used after the loop, plus one unrelated fix. They are exactly the three sites Dan Carpenter listed in 2022; his patch for the first one was never applied and the bug is still present in drm-misc-next.
Link: https://lore.kernel.org/dri-devel/YvSkKAdk8Pe0g2K9@kili/ Only patch 1 fixes a bug that can actually be triggered: nvkm_clk_ustate_update() takes an arbitrary pstate id from the user and never checks that a matching entry exists, so if it does not the cursor ends up pointing at the list head and the code reads past it. It carries a Fixes: tag and the credit for spotting it goes to Dan. Patches 2 and 3 fix the same pattern in nvkm_pstate_prog() and nvkm_control_mthd_pstate_attr(), but neither is triggerable as the code stands: the callers of nvkm_pstate_prog() clamp the index against clk->state_nr first, and nvkm_control_mthd_pstate_attr() already rejects args->v0.state >= clk->state_nr before the loop. Both are hardening, not bug fixes, and they carry no Fixes: tag on purpose. The point is to stop the two functions from being correct only by virtue of what their callers do. Patch 4 is unrelated and is a real bug, though a modest one: nvkm_cstate_prog() overwrites the reclock status in 'ret' with the status of the voltage/fan restore calls it makes afterwards. The only consumer of the return value is an error message in nvkm_pstate_work(), so the observable effect is that a failing reclock is never reported in dmesg. Compile-tested only. All the affected paths are reachable only by root, through the 'pstate' debugfs file, so I could not exercise them in any other way. v2: v1 (2 patches) was sent on 2026-07-11 with a mail client that mangled the patch text, so it did not apply; it is resent here with git send-email. This version also adds the two remaining sites from Dan's list, and the Fixes: tags to the two real fixes. Link to v1: https://lore.kernel.org/nouveau/CAHwn+vnw=DD=j7umFVdcr8-F6yUz=im+3yfa+hchkxjwpnr...@mail.gmail.com/ Francesco Magazzu (4): drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update drm/nouveau/clk: don't use the pstate cursor after the loop drm/nouveau/device: don't use the pstate cursor after the loop drm/nouveau/clk: don't clobber reclock status when restoring volt/fan .../gpu/drm/nouveau/nvkm/engine/device/ctrl.c | 8 ++++- .../gpu/drm/nouveau/nvkm/subdev/clk/base.c | 32 +++++++++++++------ 2 files changed, 29 insertions(+), 11 deletions(-) base-commit: a284476db2653ae893f46cbea408eb412db54eb0 -- 2.55.0
