linux/drivers/gpu/drm
Maarten Lankhorst e4604d8fe8 drm/nouveau: fix NULL ptr dereference from nv50_disp_intr()
Op 23-03-13 12:47, Peter Hurley schreef:
> On Tue, 2013-03-19 at 11:13 -0400, Peter Hurley wrote:
>> On vanilla 3.9.0-rc3, I get this 100% repeatable oops after login when
>> the user X session is coming up:
> Perhaps I wasn't clear that this happens on every boot and is a
> regression from 3.8
>
> I'd be happy to help resolve this but time is of the essence; it would
> be a shame to have to revert all of this for 3.9

Well it broke on my system too, so it was easy to fix.

I didn't even need gdm to trigger it!

>8----
This fixes regression caused by 1d7c71a3e2 (drm/nouveau/disp: port vblank handling to event interface),

which causes a oops in the following way:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000001
IP: [<0000000000000001>] 0x0
PGD 0
Oops: 0010 [#1] PREEMPT SMP
Modules linked in: ip6table_filter ip6_tables ebtable_nat ebtables ...<snip>...
CPU 3
Pid: 0, comm: swapper/3 Not tainted 3.9.0-rc3-xeon #rc3 Dell Inc. Precision WorkStation T5400  /0RW203
RIP: 0010:[<0000000000000001>]  [<0000000000000001>] 0x0
RSP: 0018:ffff8802afcc3d80  EFLAGS: 00010087
RAX: ffff88029f6e5808 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000096 RSI: 0000000000000001 RDI: ffff88029f6e5808
RBP: ffff8802afcc3dc8 R08: 0000000000000000 R09: 0000000000000004
R10: 000000000000002c R11: ffff88029e559a98 R12: ffff8802a376cb78
R13: ffff88029f6e57e0 R14: ffff88029f6e57f8 R15: ffff88029f6e5808
FS:  0000000000000000(0000) GS:ffff8802afcc0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000001 CR3: 000000029fa67000 CR4: 00000000000007e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper/3 (pid: 0, threadinfo ffff8802a355e000, task ffff8802a3535c40)
Stack:
 ffffffffa0159d8a 0000000000000082 ffff88029f6e5820 0000000000000001
 ffff88029f71aa00 0000000000000000 0000000000000000 0000000004000000
 0000000004000000 ffff8802afcc3e38 ffffffffa01843b5 ffff8802afcc3df8
Call Trace:
 <IRQ>
 [<ffffffffa0159d8a>] ? nouveau_event_trigger+0xaa/0xe0 [nouveau]
 [<ffffffffa01843b5>] nv50_disp_intr+0xc5/0x200 [nouveau]
 [<ffffffff816fbacc>] ? _raw_spin_unlock_irqrestore+0x2c/0x50
 [<ffffffff816ff98d>] ? notifier_call_chain+0x4d/0x70
 [<ffffffffa017a105>] nouveau_mc_intr+0xb5/0x110 [nouveau]
 [<ffffffffa01d45ff>] nouveau_irq_handler+0x6f/0x80 [nouveau]
 [<ffffffff810eec95>] handle_irq_event_percpu+0x75/0x260
 [<ffffffff810eeec8>] handle_irq_event+0x48/0x70
 [<ffffffff810f205a>] handle_fasteoi_irq+0x5a/0x100
 [<ffffffff810182f2>] handle_irq+0x22/0x40
 [<ffffffff8170561a>] do_IRQ+0x5a/0xd0
 [<ffffffff816fc2ad>] common_interrupt+0x6d/0x6d
 <EOI>
 [<ffffffff810449b6>] ? native_safe_halt+0x6/0x10
 [<ffffffff8101ea1d>] default_idle+0x3d/0x170
 [<ffffffff8101f736>] cpu_idle+0x116/0x130
 [<ffffffff816e2a06>] start_secondary+0x251/0x258
Code:  Bad RIP value.
RIP  [<0000000000000001>] 0x0
 RSP <ffff8802afcc3d80>
CR2: 0000000000000001
---[ end trace 907323cb8ce6f301 ]---

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2013-03-29 13:45:04 +10:00
..
ast Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 2013-02-25 16:46:44 -08:00
cirrus Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 2013-02-25 16:46:44 -08:00
exynos drm/exynos: convert to idr_alloc() 2013-02-27 19:10:15 -08:00
gma500 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-02-26 20:16:07 -08:00
i2c drm/i2c: nxp-tda998x (v3) 2013-02-19 17:57:44 -05:00
i810
i915 drm/i915: convert to idr_alloc() 2013-02-27 19:10:16 -08:00
mga
mgag200 Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 2013-02-25 16:46:44 -08:00
nouveau drm/nouveau: fix NULL ptr dereference from nv50_disp_intr() 2013-03-29 13:45:04 +10:00
omapdrm Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-02-26 20:16:07 -08:00
r128
radeon Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 2013-02-25 16:46:44 -08:00
savage
shmobile drm/shmobile: use drm_modeset_lock_all 2013-01-20 22:16:51 +01:00
sis drm/sis: convert to idr_alloc() 2013-02-27 19:10:16 -08:00
tdfx
tegra Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 2013-02-25 16:46:44 -08:00
tilcdc drm/tilcdc: only build on arm 2013-02-26 09:54:48 +10:00
ttm Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-02-26 20:16:07 -08:00
udl Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-02-26 20:16:07 -08:00
via drm/via: convert to idr_alloc() 2013-02-27 19:10:16 -08:00
vmwgfx drm/vmwgfx: convert to idr_alloc() 2013-02-27 19:10:16 -08:00
ati_pcigart.c
drm_agpsupport.c
drm_auth.c
drm_buffer.c
drm_bufs.c
drm_cache.c
drm_context.c drm: convert to idr_alloc() 2013-02-27 19:10:15 -08:00
drm_crtc_helper.c drm: don't hold crtc mutexes for connector ->detect callbacks 2013-01-20 22:17:15 +01:00
drm_crtc.c drm: convert to idr_alloc() 2013-02-27 19:10:15 -08:00
drm_debugfs.c
drm_dma.c
drm_dp_helper.c
drm_drv.c drm: don't use idr_remove_all() 2013-02-27 19:10:13 -08:00
drm_edid_load.c
drm_edid.c drm: Add HDMI infoframe helpers 2013-02-22 08:20:10 +01:00
drm_encoder_slave.c drm: i2c encoder helper wrappers 2013-02-17 17:55:42 -05:00
drm_fb_cma_helper.c Merge branch 'tilcdc-next' of git://people.freedesktop.org/~robclark/linux into drm-next 2013-02-21 09:31:47 +10:00
drm_fb_helper.c drm/fb-helper: don't sleep for screen unblank when an oopps is in progress 2013-02-14 00:08:33 +01:00
drm_fops.c drm: revamp locking around fb creation/destruction 2013-01-20 22:16:58 +01:00
drm_gem_cma_helper.c drm/cma: add debugfs helpers 2013-02-17 17:55:42 -05:00
drm_gem.c drm: convert to idr_alloc() 2013-02-27 19:10:15 -08:00
drm_global.c
drm_hashtab.c hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
drm_info.c
drm_ioc32.c
drm_ioctl.c
drm_irq.c drm: small fix in drm_send_vblank_event() 2013-02-17 17:55:42 -05:00
drm_lock.c
drm_memory.c
drm_mm.c Merge branch 'drm-kms-locking' of git://people.freedesktop.org/~danvet/drm-intel into drm-next 2013-01-21 07:44:58 +10:00
drm_modes.c drm_modes: add of_videomode helpers 2013-01-24 09:04:14 +01:00
drm_pci.c drm/pci: define drm_pcie_get_speed_cap_mask() only when CONFIG_PCI=y 2013-02-15 10:15:19 +10:00
drm_platform.c
drm_prime.c drm: add prime helpers 2013-02-08 13:39:08 +10:00
drm_proc.c
drm_scatter.c
drm_stub.c drm: convert to idr_alloc() 2013-02-27 19:10:15 -08:00
drm_sysfs.c drm: remove legacy drm_connector_property fxns 2012-11-30 10:30:48 -06:00
drm_trace_points.c
drm_trace.h
drm_usb.c drm/usb: bind driver to correct device 2013-02-07 12:37:41 +10:00
drm_vm.c
Kconfig drm: Add HDMI infoframe helpers 2013-02-22 08:20:10 +01:00
Makefile Merge branch 'tilcdc-next' of git://people.freedesktop.org/~robclark/linux into drm-next 2013-02-21 09:31:47 +10:00
README.drm

************************************************************
* For the very latest on DRI development, please see:      *
*     http://dri.freedesktop.org/                          *
************************************************************

The Direct Rendering Manager (drm) is a device-independent kernel-level
device driver that provides support for the XFree86 Direct Rendering
Infrastructure (DRI).

The DRM supports the Direct Rendering Infrastructure (DRI) in four major
ways:

    1. The DRM provides synchronized access to the graphics hardware via
       the use of an optimized two-tiered lock.

    2. The DRM enforces the DRI security policy for access to the graphics
       hardware by only allowing authenticated X11 clients access to
       restricted regions of memory.

    3. The DRM provides a generic DMA engine, complete with multiple
       queues and the ability to detect the need for an OpenGL context
       switch.

    4. The DRM is extensible via the use of small device-specific modules
       that rely extensively on the API exported by the DRM module.


Documentation on the DRI is available from:
    http://dri.freedesktop.org/wiki/Documentation
    http://sourceforge.net/project/showfiles.php?group_id=387
    http://dri.sourceforge.net/doc/

For specific information about kernel-level support, see:

    The Direct Rendering Manager, Kernel Support for the Direct Rendering
    Infrastructure
    http://dri.sourceforge.net/doc/drm_low_level.html

    Hardware Locking for the Direct Rendering Infrastructure
    http://dri.sourceforge.net/doc/hardware_locking_low_level.html

    A Security Analysis of the Direct Rendering Infrastructure
    http://dri.sourceforge.net/doc/security_low_level.html