linux/drivers
Maarten Lankhorst e4604d8fe8 drm/nouveau: fix NULL ptr dereference from nv50_disp_intr()
Op 23-03-13 12:47, Peter Hurley schreef:
> On Tue, 2013-03-19 at 11:13 -0400, Peter Hurley wrote:
>> On vanilla 3.9.0-rc3, I get this 100% repeatable oops after login when
>> the user X session is coming up:
> Perhaps I wasn't clear that this happens on every boot and is a
> regression from 3.8
>
> I'd be happy to help resolve this but time is of the essence; it would
> be a shame to have to revert all of this for 3.9

Well it broke on my system too, so it was easy to fix.

I didn't even need gdm to trigger it!

>8----
This fixes regression caused by 1d7c71a3e2 (drm/nouveau/disp: port vblank handling to event interface),

which causes a oops in the following way:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000001
IP: [<0000000000000001>] 0x0
PGD 0
Oops: 0010 [#1] PREEMPT SMP
Modules linked in: ip6table_filter ip6_tables ebtable_nat ebtables ...<snip>...
CPU 3
Pid: 0, comm: swapper/3 Not tainted 3.9.0-rc3-xeon #rc3 Dell Inc. Precision WorkStation T5400  /0RW203
RIP: 0010:[<0000000000000001>]  [<0000000000000001>] 0x0
RSP: 0018:ffff8802afcc3d80  EFLAGS: 00010087
RAX: ffff88029f6e5808 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000096 RSI: 0000000000000001 RDI: ffff88029f6e5808
RBP: ffff8802afcc3dc8 R08: 0000000000000000 R09: 0000000000000004
R10: 000000000000002c R11: ffff88029e559a98 R12: ffff8802a376cb78
R13: ffff88029f6e57e0 R14: ffff88029f6e57f8 R15: ffff88029f6e5808
FS:  0000000000000000(0000) GS:ffff8802afcc0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000001 CR3: 000000029fa67000 CR4: 00000000000007e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper/3 (pid: 0, threadinfo ffff8802a355e000, task ffff8802a3535c40)
Stack:
 ffffffffa0159d8a 0000000000000082 ffff88029f6e5820 0000000000000001
 ffff88029f71aa00 0000000000000000 0000000000000000 0000000004000000
 0000000004000000 ffff8802afcc3e38 ffffffffa01843b5 ffff8802afcc3df8
Call Trace:
 <IRQ>
 [<ffffffffa0159d8a>] ? nouveau_event_trigger+0xaa/0xe0 [nouveau]
 [<ffffffffa01843b5>] nv50_disp_intr+0xc5/0x200 [nouveau]
 [<ffffffff816fbacc>] ? _raw_spin_unlock_irqrestore+0x2c/0x50
 [<ffffffff816ff98d>] ? notifier_call_chain+0x4d/0x70
 [<ffffffffa017a105>] nouveau_mc_intr+0xb5/0x110 [nouveau]
 [<ffffffffa01d45ff>] nouveau_irq_handler+0x6f/0x80 [nouveau]
 [<ffffffff810eec95>] handle_irq_event_percpu+0x75/0x260
 [<ffffffff810eeec8>] handle_irq_event+0x48/0x70
 [<ffffffff810f205a>] handle_fasteoi_irq+0x5a/0x100
 [<ffffffff810182f2>] handle_irq+0x22/0x40
 [<ffffffff8170561a>] do_IRQ+0x5a/0xd0
 [<ffffffff816fc2ad>] common_interrupt+0x6d/0x6d
 <EOI>
 [<ffffffff810449b6>] ? native_safe_halt+0x6/0x10
 [<ffffffff8101ea1d>] default_idle+0x3d/0x170
 [<ffffffff8101f736>] cpu_idle+0x116/0x130
 [<ffffffff816e2a06>] start_secondary+0x251/0x258
Code:  Bad RIP value.
RIP  [<0000000000000001>] 0x0
 RSP <ffff8802afcc3d80>
CR2: 0000000000000001
---[ end trace 907323cb8ce6f301 ]---

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-03-29 13:45:04 +10:00
..
accessibility
acpi x86, ACPI, mm: Revert movablemem_map support 2013-03-02 09:34:39 -08:00
amba Merge branch 'for-linus' of git://git.linaro.org/people/rmk/linux-arm 2013-03-03 11:54:39 -08:00
ata 1) apply, and then revert, the sysfs export of ATA host controller number. 2013-02-24 17:32:15 -08:00
atm hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
auxdisplay
base CHROMIUM: dma-buf: restore args on failure of dma_buf_mmap 2013-02-27 15:14:02 +05:30
bcma Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless 2013-02-14 14:23:33 -05:00
block Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client 2013-02-28 17:43:09 -08:00
bluetooth Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2013-02-21 17:40:58 -08:00
bus
cdrom
char drivers/char/misc.c:misc_register(): do not loop on misc_list unconditionally 2013-02-27 19:10:21 -08:00
clk hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
clocksource ImgTec Meta architecture changes for v3.9-rc1 2013-03-03 12:06:09 -08:00
connector net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
cpufreq ACPI and power management fixes for 3.9-rc1 2013-02-25 21:25:17 -08:00
cpuidle arm-soc: soc-specific updates 2013-02-21 15:27:22 -08:00
crypto Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2013-02-25 15:56:15 -08:00
dca dca: convert to idr_alloc() 2013-02-27 19:10:15 -08:00
devfreq
dio
dma Merge branch 'next' of git://git.infradead.org/users/vkoul/slave-dma 2013-03-03 10:20:22 -08:00
edac Merge branch 'linux_next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-edac 2013-02-28 20:42:33 -08:00
eisa
extcon Char/Misc driver patches for 3.9-rc1 2013-02-21 13:57:13 -08:00
firewire firewire: convert to idr_alloc() 2013-02-27 19:10:15 -08:00
firmware Merge branch 'x86-efi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2013-02-27 16:17:42 -08:00
gpio gpio: convert to idr_alloc() 2013-02-27 19:10:15 -08:00
gpu drm/nouveau: fix NULL ptr dereference from nv50_disp_intr() 2013-03-29 13:45:04 +10:00
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-02-26 20:16:07 -08:00
hsi hsi: fix kernel-doc warnings 2013-03-01 13:39:00 -08:00
hv Drivers: hv: vmbus: Use the new infrastructure for delivering VMBUS interrupts 2013-02-27 10:15:53 -08:00
hwmon ACPI and power management updates for 3.9-rc1 2013-02-20 11:26:56 -08:00
hwspinlock
i2c idr: remove MAX_IDR_MASK and move left MAX_IDR_* into idr.c 2013-02-27 19:10:20 -08:00
ide Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-02-26 20:16:07 -08:00
idle Merge branch 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2013-02-22 19:25:09 -08:00
iio Staging tree update for 3.9-rc1 2013-02-21 12:11:44 -08:00
infiniband hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2013-03-03 12:58:43 -08:00
iommu Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-02-26 20:16:07 -08:00
ipack Char/Misc driver patches for 3.9-rc1 2013-02-21 13:57:13 -08:00
irqchip ImgTec Meta architecture changes for v3.9-rc1 2013-03-03 12:06:09 -08:00
isdn hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
leds Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds 2013-02-26 09:29:02 -08:00
lguest All trivial, thanks to the stuff which didn't quite make it time. 2013-02-26 14:49:12 -08:00
macintosh Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc 2013-02-23 17:09:55 -08:00
mailbox
md dm cache: add cleaner policy 2013-03-01 22:45:52 +00:00
media arm-soc: late OMAP changes 2013-02-28 20:00:40 -08:00
memory
memstick memstick: move the dereference below the NULL test 2013-02-27 19:10:23 -08:00
message
mfd mfd: convert to idr_alloc() 2013-02-27 19:10:17 -08:00
misc KGDB/KDB fixes and cleanups 2013-03-02 08:31:39 -08:00
mmc Merge branches 'devel-stable', 'fixes' and 'mmci' into for-linus 2013-03-03 00:32:50 +00:00
mtd Fairly unexciting MTD merge for 3.9: 2013-03-02 16:33:54 -08:00
net Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2013-03-02 07:44:16 -08:00
nfc Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem 2013-02-18 13:47:13 -05:00
ntb
nubus
of Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2013-02-21 17:40:58 -08:00
oprofile oprofilefs: add missing ->i_mutex locking in object creation 2013-02-22 23:31:38 -05:00
parisc Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-02-26 20:16:07 -08:00
parport Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2013-02-21 17:54:03 -08:00
pci hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
pcmcia Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2013-02-21 17:40:58 -08:00
pinctrl arm-soc: device tree conversions 2013-02-21 15:38:49 -08:00
platform Merge branch 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86 2013-03-03 10:16:19 -08:00
pnp Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-02-26 20:16:07 -08:00
power power: convert to idr_alloc() 2013-02-27 19:10:18 -08:00
pps drivers/pps/clients/pps-gpio.c: use devm_kzalloc 2013-02-27 19:10:23 -08:00
ps3
ptp
pwm pwm: Changes for v3.9-rc1 2013-02-26 09:34:29 -08:00
rapidio
regulator Merge remote-tracking branch 'regulator/topic/tps65090' into regulator-next 2013-02-19 12:43:12 +00:00
remoteproc remoteproc: convert to idr_alloc() 2013-02-27 19:10:18 -08:00
rpmsg rpmsg: convert to idr_alloc() 2013-02-27 19:10:18 -08:00
rtc rtc: stmp3xxx: add wdt-accessor function 2013-03-01 12:40:36 +01:00
s390 qdio: remove unused parameters 2013-02-28 09:37:12 +01:00
sbus Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-02-26 20:16:07 -08:00
scsi SCSI for-linus on 20130301 2013-03-02 11:42:16 -08:00
sfi
sh
sn
spi arm-soc: soc-specific updates 2013-02-21 15:27:22 -08:00
ssb Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into mips-for-linux-next 2013-02-22 10:07:30 +01:00
staging Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-03-03 13:23:03 -08:00
target Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2013-03-02 11:43:27 -08:00
tc
thermal Fix mis-merge of intel_powerclamp.c resulting in compile error 2013-02-28 20:23:09 -08:00
tty Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-03-03 13:23:03 -08:00
uio uio: convert to idr_alloc() 2013-02-27 19:10:19 -08:00
usb USB patch revert for 3.9-rc1 2013-03-03 10:24:57 -08:00
uwb
vfio vfio: convert to idr_alloc() 2013-02-27 19:10:19 -08:00
vhost Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2013-02-26 11:42:23 -08:00
video backlight: add new lp8788 backlight driver 2013-02-27 19:10:09 -08:00
virt
virtio All trivial, thanks to the stuff which didn't quite make it time. 2013-02-26 14:49:12 -08:00
vlynq
vme vme: add missing put_device() after device_register() fails 2013-02-14 09:24:14 -08:00
w1 arm-soc: i.MX DT changes 2013-02-28 19:59:34 -08:00
watchdog watchdog: sp805_wdt depends on ARM 2013-03-01 12:56:26 +01:00
xen Bug-fixes: 2013-03-03 14:22:53 -08:00
zorro new helper: file_inode(file) 2013-02-22 23:31:31 -05:00
Kconfig Char/Misc driver patches for 3.9-rc1 2013-02-21 13:57:13 -08:00
Makefile Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc 2013-02-23 17:09:55 -08:00