• Maarten Lankhorst's avatar
    drm/nouveau: fix NULL ptr dereference from nv50_disp_intr() · e4604d8f
    Maarten Lankhorst authored
    Op 23-03-13 12:47, Peter Hurley schreef:
    > On Tue, 2013-03-19 at 11:13 -0400, Peter Hurley wrote:
    >> On vanilla 3.9.0-rc3, I get this 100% repeatable oops after login when
    >> the user X session is coming up:
    > Perhaps I wasn't clear that this happens on every boot and is a
    > regression from 3.8
    >
    > I'd be happy to help resolve this but time is of the essence; it would
    > be a shame to have to revert all of this for 3.9
    
    Well it broke on my system too, so it was easy to fix.
    
    I didn't even need gdm to trigger it!
    
    >8----
    This fixes regression caused by 1d7c71a3 (drm/nouveau/disp: port vblank handling to event interface),
    
    which causes a oops in the following way:
    
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000001
    IP: [<0000000000000001>] 0x0
    PGD 0
    Oops: 0010 [#1] PREEMPT SMP
    Modules linked in: ip6table_filter ip6_tables ebtable_nat ebtables ...<snip>...
    CPU 3
    Pid: 0, comm: swapper/3 Not tainted 3.9.0-rc3-xeon #rc3 Dell Inc. Precision WorkStation T5400  /0RW203
    RIP: 0010:[<0000000000000001>]  [<0000000000000001>] 0x0
    RSP: 0018:ffff8802afcc3d80  EFLAGS: 00010087
    RAX: ffff88029f6e5808 RBX: 0000000000000001 RCX: 0000000000000000
    RDX: 0000000000000096 RSI: 0000000000000001 RDI: ffff88029f6e5808
    RBP: ffff8802afcc3dc8 R08: 0000000000000000 R09: 0000000000000004
    R10: 000000000000002c R11: ffff88029e559a98 R12: ffff8802a376cb78
    R13: ffff88029f6e57e0 R14: ffff88029f6e57f8 R15: ffff88029f6e5808
    FS:  0000000000000000(0000) GS:ffff8802afcc0000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    CR2: 0000000000000001 CR3: 000000029fa67000 CR4: 00000000000007e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process swapper/3 (pid: 0, threadinfo ffff8802a355e000, task ffff8802a3535c40)
    Stack:
     ffffffffa0159d8a 0000000000000082 ffff88029f6e5820 0000000000000001
     ffff88029f71aa00 0000000000000000 0000000000000000 0000000004000000
     0000000004000000 ffff8802afcc3e38 ffffffffa01843b5 ffff8802afcc3df8
    Call Trace:
     <IRQ>
     [<ffffffffa0159d8a>] ? nouveau_event_trigger+0xaa/0xe0 [nouveau]
     [<ffffffffa01843b5>] nv50_disp_intr+0xc5/0x200 [nouveau]
     [<ffffffff816fbacc>] ? _raw_spin_unlock_irqrestore+0x2c/0x50
     [<ffffffff816ff98d>] ? notifier_call_chain+0x4d/0x70
     [<ffffffffa017a105>] nouveau_mc_intr+0xb5/0x110 [nouveau]
     [<ffffffffa01d45ff>] nouveau_irq_handler+0x6f/0x80 [nouveau]
     [<ffffffff810eec95>] handle_irq_event_percpu+0x75/0x260
     [<ffffffff810eeec8>] handle_irq_event+0x48/0x70
     [<ffffffff810f205a>] handle_fasteoi_irq+0x5a/0x100
     [<ffffffff810182f2>] handle_irq+0x22/0x40
     [<ffffffff8170561a>] do_IRQ+0x5a/0xd0
     [<ffffffff816fc2ad>] common_interrupt+0x6d/0x6d
     <EOI>
     [<ffffffff810449b6>] ? native_safe_halt+0x6/0x10
     [<ffffffff8101ea1d>] default_idle+0x3d/0x170
     [<ffffffff8101f736>] cpu_idle+0x116/0x130
     [<ffffffff816e2a06>] start_secondary+0x251/0x258
    Code:  Bad RIP value.
    RIP  [<0000000000000001>] 0x0
     RSP <ffff8802afcc3d80>
    CR2: 0000000000000001
    ---[ end trace 907323cb8ce6f301 ]---
    Signed-off-by: default avatarMaarten Lankhorst <maarten.lankhorst@canonical.com>
    Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
    e4604d8f
nouveau_drm.c 20 KB