Crash in `nvidia_vma_access`

NVIDIA Open GPU Kernel Modules Version

595.58.03

Please confirm this issue does not happen with the proprietary driver (of the same version). This issue tracker is only for bugs specific to the open kernel driver.

• I confirm that this does not happen with the proprietary driver package.

Operating System and Version

Debian 13

Kernel Release

6.18.21

Please confirm you are running a stable release kernel (e.g. not a -rc). We do not accept bug reports for unreleased kernels.

• I am running on a stable kernel release.

Hardware: GPU

GPU 0: NVIDIA RTX A6000 (UUID: GPU-a8786325-872d-f33a-6b4a-afe9ff6a9783) GPU 1: NVIDIA RTX A6000 (UUID: GPU-9d07d567-97b1-7ded-dafc-9e49be4decbf) GPU 2: NVIDIA RTX A6000 (UUID: GPU-c3e4b380-e3d2-d25c-83eb-504308917eb1) GPU 3: NVIDIA RTX A6000 (UUID: GPU-e29202bb-289a-deb0-62ed-20390c094e3c) GPU 4: NVIDIA RTX A6000 (UUID: GPU-859eda35-2554-7da2-b14d-08f16680bd0d) GPU 5: NVIDIA RTX A6000 (UUID: GPU-9fca2b4f-5285-3b02-94ab-da819d836327) GPU 6: NVIDIA RTX A6000 (UUID: GPU-53e224c9-2606-01fd-98ae-ac0c6b9085ea) GPU 7: NVIDIA RTX A6000 (UUID: GPU-7105642b-8ea3-b3e1-a179-159cbe1de056)

Describe the bug

In driver version 595.58.03, nvidia_vma_access is guaranteed to crash with a NULL pointer dereference if ever called.

mmap_context is initialized to NULL and immediately dereferenced.

To Reproduce

Open /proc/PID/mem and read from an offset corresponding to an address backed by a GPU memory mapping.

Bug Incidence

Always

nvidia-bug-report.log.gz

nvidia-bug-report.log.gz

More Info

No response

Locate nvidia_vma_access in the open GPU kernel module source and inspect how mmap_context is initialized before dereference. Reproduce the crash by reading /proc/PID/mem at an address backed by a GPU memory mapping; done means that access no longer causes a NULL pointer dereference.