1. 26 4月, 2013 17 次提交
  2. 29 3月, 2013 2 次提交
    • M
      drm/nouveau: fix NULL ptr dereference from nv50_disp_intr() · e4604d8f
      Maarten Lankhorst 提交于
      Op 23-03-13 12:47, Peter Hurley schreef:
      > On Tue, 2013-03-19 at 11:13 -0400, Peter Hurley wrote:
      >> On vanilla 3.9.0-rc3, I get this 100% repeatable oops after login when
      >> the user X session is coming up:
      > Perhaps I wasn't clear that this happens on every boot and is a
      > regression from 3.8
      >
      > I'd be happy to help resolve this but time is of the essence; it would
      > be a shame to have to revert all of this for 3.9
      
      Well it broke on my system too, so it was easy to fix.
      
      I didn't even need gdm to trigger it!
      
      >8----
      This fixes regression caused by 1d7c71a3 (drm/nouveau/disp: port vblank handling to event interface),
      
      which causes a oops in the following way:
      
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000001
      IP: [<0000000000000001>] 0x0
      PGD 0
      Oops: 0010 [#1] PREEMPT SMP
      Modules linked in: ip6table_filter ip6_tables ebtable_nat ebtables ...<snip>...
      CPU 3
      Pid: 0, comm: swapper/3 Not tainted 3.9.0-rc3-xeon #rc3 Dell Inc. Precision WorkStation T5400  /0RW203
      RIP: 0010:[<0000000000000001>]  [<0000000000000001>] 0x0
      RSP: 0018:ffff8802afcc3d80  EFLAGS: 00010087
      RAX: ffff88029f6e5808 RBX: 0000000000000001 RCX: 0000000000000000
      RDX: 0000000000000096 RSI: 0000000000000001 RDI: ffff88029f6e5808
      RBP: ffff8802afcc3dc8 R08: 0000000000000000 R09: 0000000000000004
      R10: 000000000000002c R11: ffff88029e559a98 R12: ffff8802a376cb78
      R13: ffff88029f6e57e0 R14: ffff88029f6e57f8 R15: ffff88029f6e5808
      FS:  0000000000000000(0000) GS:ffff8802afcc0000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      CR2: 0000000000000001 CR3: 000000029fa67000 CR4: 00000000000007e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process swapper/3 (pid: 0, threadinfo ffff8802a355e000, task ffff8802a3535c40)
      Stack:
       ffffffffa0159d8a 0000000000000082 ffff88029f6e5820 0000000000000001
       ffff88029f71aa00 0000000000000000 0000000000000000 0000000004000000
       0000000004000000 ffff8802afcc3e38 ffffffffa01843b5 ffff8802afcc3df8
      Call Trace:
       <IRQ>
       [<ffffffffa0159d8a>] ? nouveau_event_trigger+0xaa/0xe0 [nouveau]
       [<ffffffffa01843b5>] nv50_disp_intr+0xc5/0x200 [nouveau]
       [<ffffffff816fbacc>] ? _raw_spin_unlock_irqrestore+0x2c/0x50
       [<ffffffff816ff98d>] ? notifier_call_chain+0x4d/0x70
       [<ffffffffa017a105>] nouveau_mc_intr+0xb5/0x110 [nouveau]
       [<ffffffffa01d45ff>] nouveau_irq_handler+0x6f/0x80 [nouveau]
       [<ffffffff810eec95>] handle_irq_event_percpu+0x75/0x260
       [<ffffffff810eeec8>] handle_irq_event+0x48/0x70
       [<ffffffff810f205a>] handle_fasteoi_irq+0x5a/0x100
       [<ffffffff810182f2>] handle_irq+0x22/0x40
       [<ffffffff8170561a>] do_IRQ+0x5a/0xd0
       [<ffffffff816fc2ad>] common_interrupt+0x6d/0x6d
       <EOI>
       [<ffffffff810449b6>] ? native_safe_halt+0x6/0x10
       [<ffffffff8101ea1d>] default_idle+0x3d/0x170
       [<ffffffff8101f736>] cpu_idle+0x116/0x130
       [<ffffffff816e2a06>] start_secondary+0x251/0x258
      Code:  Bad RIP value.
      RIP  [<0000000000000001>] 0x0
       RSP <ffff8802afcc3d80>
      CR2: 0000000000000001
      ---[ end trace 907323cb8ce6f301 ]---
      Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      e4604d8f
    • M
      drm/nouveau: fix handling empty channel list in ioctl's · b43decd2
      Maarten Lankhorst 提交于
      If there are no channels, chan would never end up being NULL,
      and so the null pointer check would fail.
      
      Solve this by initializing chan to NULL, and iterating over temp instead.
      
      Fixes oops when running intel-gpu-tools/tests/kms_flip, which attempts to
      do some intel ioctl's on a nouveau device.
      Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
      Cc: stable@vger.kernel.org [3.7+]
      Signed-off-by: NBen Skeggs <bskeggs@redhat.com>
      b43decd2
  3. 19 3月, 2013 2 次提交
  4. 18 3月, 2013 11 次提交
  5. 11 3月, 2013 4 次提交
  6. 04 3月, 2013 4 次提交