linux-kernel - [BUG] drm/nouveau: NULL pointer dereference in nouveau_channel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Wed, 10 Oct 2012 18:40:22 +0200
From:	Ortwin Glück <odi@....ch>
To:	linux-kernel@...r.kernel.org, dri-devel@...ts.freedesktop.org
Subject: [BUG] drm/nouveau: NULL pointer dereference in nouveau_channel_new()

Hi,

Current nouveau code in Linus' tree oopses with noaccel. Didn't happen 
in 3.6. Full dmesg attached.

Ortwin

BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
Oct 10 18:05:49 localhost kernel: IP: [<ffffffff8144082e>] 
nouveau_channel_new+0x41e/0x670
Oct 10 18:05:49 localhost kernel: PGD 22ddd7067 PUD 22f76f067 PMD 0
Oct 10 18:05:49 localhost kernel: Oops: 0000 [#1] PREEMPT SMP
Oct 10 18:05:49 localhost kernel: Modules linked in:
Oct 10 18:05:49 localhost kernel: CPU 0
Oct 10 18:05:49 localhost kernel: Pid: 2723, comm: X Not tainted 
3.7.0-pre #1 Hewlett-Packard HP EliteBook 8540w/1521
Oct 10 18:05:49 localhost kernel: RIP: 0010:[<ffffffff8144082e>] 
[<ffffffff8144082e>] nouveau_channel_new+0x41e/0x670
Oct 10 18:05:49 localhost kernel: RSP: 0018:ffff88023026bc68  EFLAGS: 
00010202
Oct 10 18:05:49 localhost kernel: RAX: 0000000000000000 RBX: 
ffff88022ceeca80 RCX: 0000000000000088
Oct 10 18:05:49 localhost kernel: RDX: ffffc900127e408c RSI: 
ffffc900127e408c RDI: ffff88022ceeca80
Oct 10 18:05:49 localhost kernel: RBP: ffff88023026bce8 R08: 
000000000000ffff R09: 0000000000000000
Oct 10 18:05:49 localhost kernel: R10: 0000000000000010 R11: 
000000000000000f R12: 0000000000000000
Oct 10 18:05:49 localhost kernel: R13: ffff880231f36800 R14: 
ffff88022f68ca00 R15: ffff88022f68ca00
Oct 10 18:05:49 localhost kernel: FS:  00007f129a597880(0000) 
GS:ffff88023bc00000(0000) knlGS:0000000000000000
Oct 10 18:05:49 localhost kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 
0000000080050033
Oct 10 18:05:49 localhost kernel: CR2: 0000000000000018 CR3: 
00000002300a1000 CR4: 00000000000007f0
Oct 10 18:05:49 localhost kernel: DR0: 0000000000000000 DR1: 
0000000000000000 DR2: 0000000000000000
Oct 10 18:05:49 localhost kernel: DR3: 0000000000000000 DR6: 
00000000ffff0ff0 DR7: 0000000000000400
Oct 10 18:05:49 localhost kernel: Process X (pid: 2723, threadinfo 
ffff88023026a000, task ffff880231edbde0)
Oct 10 18:05:49 localhost kernel: Stack:
Oct 10 18:05:49 localhost kernel: ffff88023026bcb0 ffff88022f68ca00 
ffff88022f68caa8 ffff8802311be9c0
Oct 10 18:05:49 localhost kernel: d8000001d8000002 ffff88023026bc98 
0000200000000000 0000000000000000
Oct 10 18:05:49 localhost kernel: 000000ffffffffff ffff880231f9afa0 
ffffffffffffffff ffff8802323c0840
Oct 10 18:05:49 localhost kernel: Call Trace:
Oct 10 18:05:49 localhost kernel: [<ffffffff81448cbc>] 
nouveau_abi16_ioctl_channel_alloc+0x15c/0x360
Oct 10 18:05:49 localhost kernel: [<ffffffff813a9120>] drm_ioctl+0x2a0/0x4f0
Oct 10 18:05:49 localhost kernel: [<ffffffff81448b60>] ? 
nouveau_abi16_ioctl_setparam+0x10/0x10
Oct 10 18:05:49 localhost kernel: [<ffffffff81076be4>] ? 
__do_page_fault+0x1c4/0x490
Oct 10 18:05:49 localhost kernel: [<ffffffff81198eb7>] 
do_vfs_ioctl+0x97/0x4f0
Oct 10 18:05:49 localhost kernel: [<ffffffff81199367>] sys_ioctl+0x57/0x90
Oct 10 18:05:49 localhost kernel: [<ffffffff818635a2>] 
system_call_fastpath+0x16/0x1b
Oct 10 18:05:49 localhost kernel: Code: e2 02 48 89 df e8 d3 02 00 00 8b 
83 80 00 00 00 89 83 84 00 00 00 0f 1f 80 00 00 00 00 48 8b 43 08 48 89 
df 48 8b 80 f8 06 00 00 <ff> 50 18 41 89 c4 85 c0 0f 84 65 fd ff ff 0f 
1f 40 00 4c 89 ff
Oct 10 18:05:49 localhost kernel: RIP  [<ffffffff8144082e>] 
nouveau_channel_new+0x41e/0x670
Oct 10 18:05:49 localhost kernel: RSP <ffff88023026bc68>
Oct 10 18:05:49 localhost kernel: CR2: 0000000000000018
Oct 10 18:05:49 localhost kernel: ---[ end trace e23ae1067c361c88 ]---


View attachment "messages" of type "text/plain" (94523 bytes)