Bug 25012

Summary:	BUG: i915 causes NULL pointer dereference in 2.6.37-rc5-git4
Product:	Drivers	Reporter:	Maciej Rutecki (maciej.rutecki)
Component:	Video(DRI - Intel)	Assignee:	drivers_video-dri-intel (drivers_video-dri-intel)
Status:	CLOSED CODE_FIX
Severity:	normal	CC:	florian, jussuf, maciej.rutecki, rjw
Priority:	P1
Hardware:	All
OS:	Linux
Kernel Version:	2.6.37-rc5-git4	Subsystem:
Regression:	Yes	Bisected commit-id:
Bug Depends on:
Bug Blocks:	21782
Attachments:	kernel configuration for 2.6.37-rc6-git5 Add properties after initing connector

Description Maciej Rutecki 2010-12-16 20:48:13 UTC

Subject    : BUG: i915 causes NULL pointer dereference in 2.6.37-rc5-git4
Submitter  : Tõnu Raitviir <jussuf@linux.ee>
Date       : 2010-12-15 12:48
Message-ID : alpine.DEB.2.00.1012151238570.4797@jbbyvx.ohzcpyho.rr
References : http://www.spinics.net/lists/dri-devel/msg06282.html

This entry is being used for tracking a regression from 2.6.36. Please don't
close it until the problem is fixed in the mainline.

Comment 1 Tõnu Raitviir 2010-12-20 22:04:04 UTC

Created attachment 41082 [details]
kernel configuration for 2.6.37-rc6-git5

Comment 2 Tõnu Raitviir 2010-12-20 22:05:48 UTC

Bug still present in 2.6.37-rc6-git5.

[   43.926123] BUG: unable to handle kernel NULL pointer dereference at 00000000000003fc
[   43.926225] IP: [<ffffffff811e33ec>] idr_pre_get+0x5b/0x6f
[   43.926291] PGD 79631067 PUD 78fd3067 PMD 0 
[   43.926382] Oops: 0000 [#1] SMP 
[   43.926455] last sysfs file: /sys/devices/pci0000:00/0000:00:02.0/i2c-4/uevent
[   43.926518] CPU 0 
[   43.926539] Modules linked in: i915(+) drm_kms_helper drm i2c_algo_bit video output hwmon_vid lirc_imon(C) rc_dib0700_rc5 mt2060 snd_hda_codec_hdmi snd_hda_codec_realtek ir_lirc_codec lirc_dev ir_sony_decoder rc_imon_pad dvb_usb_dib0700 dib7000p dib0090 dib7000m imon snd_hda_intel ir_jvc_decoder dib0070 ir_rc6_decoder snd_hda_codec snd_hwdep dvb_usb dib8000 ir_rc5_decoder snd_pcm ir_nec_decoder dvb_core dib3000mc dibx000_common i2c_i801 intel_agp snd_seq_midi intel_gtt ir_core snd_rawmidi snd_seq_midi_event tpm_tis snd_seq snd_timer shpchp tpm tpm_bios snd_seq_device pci_hotplug pcspkr snd soundcore serio_raw snd_page_alloc raid10 raid456 async_pq async_xor xor async_memcpy async_raid6_recov raid6_pq async_tx raid0 multipath linear firewire_ohci usbhid hid firewire_core crc_itu_t sg atl1 pata_jmicron [last unloaded: scsi_wait_scan]
[   43.928000] 
[   43.928000] Pid: 1493, comm: modprobe Tainted: G         C  2.6.37-rc6-git5 #2 P5E-VM HDMI/P5E-VM HDMI
[   43.928000] RIP: 0010:[<ffffffff811e33ec>]  [<ffffffff811e33ec>] idr_pre_get+0x5b/0x6f
[   43.928000] RSP: 0018:ffff880079f799a8  EFLAGS: 00010202
[   43.928000] RAX: ffff880079db4d10 RBX: 00000000000003e8 RCX: 0000000000000000
[   43.928000] RDX: 00000000b0b0b0b0 RSI: 00000000000000d0 RDI: 00000000000003e8
[   43.928000] RBP: ffff880079f799c8 R08: 0000000000000004 R09: 0000000000000004
[   43.928000] R10: ffff880000000004 R11: ffff8800379fdda0 R12: 00000000000080d0
[   43.928000] R13: 0000000000000400 R14: 00000000b0b0b0b0 R15: ffff880079f799f4
[   43.928000] FS:  00007f37e7efa700(0000) GS:ffff88007f400000(0000) knlGS:0000000000000000
[   43.928000] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   43.928000] CR2: 00000000000003fc CR3: 000000007a7af000 CR4: 00000000000406f0
[   43.928000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   43.928000] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[   43.928000] Process modprobe (pid: 1493, threadinfo ffff880079f78000, task ffff880079e7db00)
[   43.928000] Stack:
[   43.928000]  ffff880078fcba30 00000000000003c8 00000000000003e8 00000000b0b0b0b0
[   43.928000]  ffff880079f79a28 ffffffffa02ae7c6 ffff880079f79a37 0000000000000001
[   43.928000]  ffff880079f79a18 0000000000000246 0000000000000000 0000000000000000
[   43.928000] Call Trace:
[   43.928000]  [<ffffffffa02ae7c6>] drm_mode_object_get+0x3d/0xa3 [drm]
[   43.928000]  [<ffffffffa02b07ce>] drm_property_create+0x5e/0xc4 [drm]
[   43.928000]  [<ffffffffa0307f82>] intel_sdvo_dvi_init+0x152/0x1b6 [i915]
[   43.928000]  [<ffffffffa03082dd>] intel_sdvo_init+0x2f7/0x6a2 [i915]
[   43.928000]  [<ffffffffa02ffd6b>] intel_modeset_init+0x8ec/0xc71 [i915]
[   43.928000]  [<ffffffffa02eb613>] i915_driver_load+0xc6c/0xd98 [i915]
[   43.928000]  [<ffffffff811e481b>] ? kobj_bcast_filter+0x0/0x4b
[   43.928000]  [<ffffffffa02abd4b>] drm_get_pci_dev+0x163/0x268 [drm]
[   43.928000]  [<ffffffffa031152d>] i915_pci_probe+0x10/0x12f [i915]
[   43.928000]  [<ffffffff811f9f97>] local_pci_probe+0x48/0x91
[   43.928000]  [<ffffffff811fad12>] pci_device_probe+0x60/0x8f
[   43.928000]  [<ffffffff81276d5d>] ? driver_sysfs_add+0x6b/0x90
[   43.928000]  [<ffffffff81276eb0>] driver_probe_device+0xb2/0x14c
[   43.928000]  [<ffffffff81276fa2>] __driver_attach+0x58/0x7c
[   43.928000]  [<ffffffff81276f4a>] ? __driver_attach+0x0/0x7c
[   43.928000]  [<ffffffff812764cc>] bus_for_each_dev+0x4e/0x83
[   43.928000]  [<ffffffff81276cf0>] driver_attach+0x19/0x1b
[   43.928000]  [<ffffffff8127694e>] bus_add_driver+0xb1/0x1ff
[   43.928000]  [<ffffffff8127727d>] driver_register+0x99/0x10a
[   43.928000]  [<ffffffff811faf62>] __pci_register_driver+0x53/0xc3
[   43.928000]  [<ffffffffa02abe84>] drm_pci_init+0x34/0x9a [drm]
[   43.928000]  [<ffffffffa0329000>] ? i915_init+0x0/0x96 [i915]
[   43.928000]  [<ffffffffa02a56dd>] drm_init+0x5d/0x61 [drm]
[   43.928000]  [<ffffffffa0329094>] i915_init+0x94/0x96 [i915]
[   43.928000]  [<ffffffff81000210>] do_one_initcall+0x7a/0x129
[   43.928000]  [<ffffffff8105ef8c>] sys_init_module+0x9c/0x1dc
[   43.928000]  [<ffffffff8100293b>] system_call_fastpath+0x16/0x1b
[   43.928000] Code: 48 85 c0 75 04 31 c0 eb 2d 4c 89 ef e8 ce bd 1f 00 48 8b 53 08 48 89 c6 49 89 56 08 4c 89 ef 4c 89 73 08 ff 43 14 e8 ec bd 1f 00 <83> 7b 14 0b 76 bd b8 01 00 00 00 5b 41 5c 41 5d 41 5e c9 c3 55 
[   43.928000] RIP  [<ffffffff811e33ec>] idr_pre_get+0x5b/0x6f
[   43.928000]  RSP <ffff880079f799a8>
[   43.928000] CR2: 00000000000003fc
[   43.932099] ---[ end trace c496d647dfcf8bbb ]---

Comment 3 Tõnu Raitviir 2010-12-23 01:43:49 UTC

I took some time and bisected this.

da79de97d254145dcb7c08c978b1093eac15ec9c is the first bad commit
commit da79de97d254145dcb7c08c978b1093eac15ec9c
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Mon Nov 22 11:12:46 2010 +0000

    drm/i915/sdvo: Only enable HDMI encodings only if the commandset is supported
    
    As we conflated intel_sdvo->is_hdmi with both having HDMI support on the
    ADD along with having HDMI support on the monitor, we would attempt to
    use HDMI encodings even if the interface did not support those commands.
    
    Reported-by: Simon Farnsworth <simon.farnsworth@onelan.co.uk>
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Tested-by: Simon Farnsworth <simon.farnsworth@onelan.co.uk>
    Reviewed-by: Simon Farnsworth <simon.farnsworth@onelan.co.uk>

:040000 040000 b864162f8bece19363513c1d364ec30a79b9370c 817fdc728426121cec20bb49b2bf6008f1566f9b M	drivers

2.6.37-rc7 minus this commit works fine.
That's on Asus P5E-VM HDMI motherboard (G35 chipset) with only HDMI output connected. Display is a Philips TV which so far has worked with 1920x1080 mode and audio over HDMI.

Comment 4 Chris Wilson 2010-12-23 09:45:59 UTC

Created attachment 41502 [details]
Add properties after initing connector

Ah, the bug is obvious in hindsight. Thanks for the bisection.

Comment 5 Rafael J. Wysocki 2010-12-23 10:25:55 UTC

First-Bad-Commit : da79de97d254145dcb7c08c978b1093eac15ec9c
Handled-By : Chris Wilson <chris@chris-wilson.co.uk>
Patch : https://bugzilla.kernel.org/attachment.cgi?id=41502

Comment 6 Tõnu Raitviir 2010-12-30 12:02:19 UTC

The patch works.

Comment 7 Rafael J. Wysocki 2010-12-30 22:39:49 UTC

Fixed by commit f797d22 drm/i915/sdvo: Add hdmi connector properties after initing the connector .