linux-kernel - Re: i865, drm_modeset_lock_all: BUG: unable to handle kernel NULL pointer dereference at 00000104

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160823091151.GE20834@nuc-i3427.alporthouse.com>
Date:   Tue, 23 Aug 2016 10:11:51 +0100
From:   Chris Wilson <chris@...is-wilson.co.uk>
To:     Meelis Roos <mroos@...ux.ee>
Cc:     Linux Kernel list <linux-kernel@...r.kernel.org>,
        dri-devel@...ts.freedesktop.org, intel-gfx@...ts.freedesktop.org
Subject: Re: i865, drm_modeset_lock_all: BUG: unable to handle kernel NULL
 pointer dereference at 00000104

On Tue, Aug 23, 2016 at 12:58:43PM +0300, Meelis Roos wrote:
> This on a P4 PC with 82865G chipset and onboard Intel graphics. 4.7.0 
> worked fine, current 4.8 git shows NULL pointer dereference as shown 
> below at the end of dmesg.
> 
> [   10.066261] BUG: unable to handle kernel NULL pointer dereference at 00000104
> [   10.066273] IP: [<c16054b4>] mutex_lock+0xa/0x15
> [   10.066287] *pde = 00000000 
> [   10.066295] Oops: 0002 [#1]
> [   10.066302] Modules linked in: i915(+) video i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm iTCO_wdt iTCO_vendor_support ppdev evdev snd_intel8x0 snd_ac97_codec ac97_bus psmouse snd_pcm snd_timer snd pcspkr uhci_hcd ehci_pci soundcore sr_mod ehci_hcd serio_raw i2c_i801 usbcore i2c_smbus cdrom lpc_ich mfd_core rng_core e100 mii floppy parport_pc parport acpi_cpufreq button processor usb_common eeprom lm85 hwmon_vid autofs4
> [   10.066378] CPU: 0 PID: 132 Comm: systemd-udevd Not tainted 4.8.0-rc3-00013-gef0e1ea #34
> [   10.066389] Hardware name: MicroLink                               /D865GLC                        , BIOS BF86510A.86A.0077.P25.0508040031 08/04/2005
> [   10.066401] task: f62db800 task.stack: f5970000
> [   10.066409] EIP: 0060:[<c16054b4>] EFLAGS: 00010286 CPU: 0
> [   10.066417] EIP is at mutex_lock+0xa/0x15
> [   10.066424] EAX: 00000104 EBX: 00000104 ECX: 00000000 EDX: 80000000
> [   10.066432] ESI: 00000000 EDI: 00000104 EBP: f5be8000 ESP: f5971b58
> [   10.066439]  DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068
> [   10.066446] CR0: 80050033 CR2: 00000104 CR3: 35945000 CR4: 000006d0
> [   10.066453] Stack:
> [   10.066459]  f503d740 f824dddf 00000000 f61170c0 f61170c0 f82371ae f850f40e 00000001
> [   10.066476]  f61170c0 f5971bcc f5be8000 f9c2d401 00000001 f8236fcc 00000001 00000000
> [   10.066491]  f5144014 f5be8104 00000008 f9c5267c 00000007 f61170c0 f5144400 f9c4ff00
> [   10.066507] Call Trace:
> [   10.066526]  [<f824dddf>] ? drm_modeset_lock_all+0x27/0xb3 [drm]
> [   10.066545]  [<f82371ae>] ? drm_encoder_cleanup+0x1a/0x132 [drm]
> [   10.066559]  [<f850f40e>] ? drm_atomic_helper_connector_reset+0x3f/0x5c [drm_kms_helper]
> [   10.066644]  [<f9c2d401>] ? intel_dvo_init+0x569/0x788 [i915]

Looks like an incorrect call to drm_encoder_cleanup() from the error
path. If we hit the error path we have never called drm_encoder_init.
Please try:

diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index 47bdf9dad0d3..b9e5a63a7c9e 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -554,7 +554,6 @@ void intel_dvo_init(struct drm_device *dev)
 		return;
 	}
 
-	drm_encoder_cleanup(&intel_encoder->base);
 	kfree(intel_dvo);
 	kfree(intel_connector);
 }

-- 
Chris Wilson, Intel Open Source Technology Centre