linux-kernel - 2.6.20-rc6-mm3 BUG in drm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-id: <20070203185407.GA5256@pool-70-109-243-148.wma.east.verizon.net>
Date:	Sat, 03 Feb 2007 13:54:17 -0500
From:	Eric Buddington <ebuddington@...izon.net>
To:	linux-kernel@...r.kernel.org
Subject: 2.6.20-rc6-mm3 BUG in drm_ioctl with Rage 128 card

While repeatedly recompiling and restarting xorg-server-1.1.1, I
managed to generate the following BUG. Kernel is 2.6.20-rc6-mm3, video card is

01:00.0 VGA compatible controller: ATI Technologies Inc Rage 128 Pro Ultra TF (prog-if 00 [VGA])

-Eric

----------------------------------
BUG: unable to handle kernel NULL pointer dereference at virtual address 0000000
0
 printing eip:
00000000
*pde = 18cdb067
*pte = 00000000
Oops: 0000 [#1]
last sysfs file: /devices/pci0000:00/0000:00:00.0/class
Modules linked in: ppp_synctty ppp_async crc_ccitt ppp_generic slhc r128 drm sof
tdog keyspan_pda usbserial sch_tbf raw1394 dv1394 ohci1394 ieee1394 snd_ice1712 
snd_ice17xx_ak4xxx snd_ak4xxx_adda snd_cs8427 snd_i2c snd_mpu401_uart snd_rawmid
i usbnet snd_intel8x0 snd_ac97_codec ac97_bus ipt_tos ipt_owner iptable_nat nf_c
onntrack_ipv4 ipt_MASQUERADE nf_nat nf_conntrack nfnetlink ipt_TOS iptable_filte
r iptable_mangle ip_tables x_tables 8139too sis900 sis5595 hwmon i2c_isa i2c_cor
e sis_agp agpgart ide_scsi
CPU:    0
EIP:    0060:[<00000000>]    Tainted: G   M   VLI
EFLAGS: 00013246   (2.6.20-rc6-mm3 #1)
EIP is at 0x0
eax: f7a3ec60   ebx: 00000000   ecx: f928eda0   edx: 00000000
esi: f7a3ec60   edi: c3c399e0   ebp: 00004000   esp: f355feb0
ds: 007b   es: 007b   fs: 00d8  gs: 0033  ss: 0068
Process X (pid: 30162, ti=f355e000 task=f7932030 task.ti=f355e000)
Stack: f9299ccc 00000800 000006d0 00000003 c1b36570 00000000 00000000 0040ee73 
       f928eda0 c3c399e0 00000000 f56d2800 f929928c bf94831c 00000000 f52bf1e0 
       00000000 f51c8860 f93e77bf f93f1800 c029926f 00000000 f93f1810 f56d2800 
Call Trace:
 [<f9299ccc>] agp_generic_insert_memory+0x5f/0x147 [agpgart]
 [<f929928c>] agp_bind_memory+0x53/0x64 [agpgart]
 [<f93e77bf>] drm_agp_bind+0x49/0x9f [drm]
 [<c029926f>] copy_to_user+0x2d/0x42
 [<f93e7845>] drm_agp_bind_ioctl+0x30/0x39 [drm]
 [<f93e7815>] drm_agp_bind_ioctl+0x0/0x39 [drm]
 [<f93e3f10>] drm_ioctl+0x14b/0x193 [drm]
 [<f93e3dc5>] drm_ioctl+0x0/0x193 [drm]
 [<c015b94a>] do_ioctl+0x3e/0x4d
 [<c015bb60>] vfs_ioctl+0x207/0x21e
 [<c015bbaa>] sys_ioctl+0x33/0x4d
 [<c0104b30>] sysenter_past_esp+0x5d/0x81
 =======================
Code:  Bad EIP value.
EIP: [<00000000>] 0x0 SS:ESP 0068:f355feb0
[drm:drm_release] *ERROR* Device busy: 1 0
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/