Bug 24312 - [i915] null pointer dereference on modprobe in intel_svdo_read_byte.clone.8
Summary: [i915] null pointer dereference on modprobe in intel_svdo_read_byte.clone.8
Status: CLOSED CODE_FIX
Alias: None
Product: Drivers
Classification: Unclassified
Component: Video(DRI - Intel) (show other bugs)
Hardware: All Linux
: P1 blocking
Assignee: drivers_video-dri-intel@kernel-bugs.osdl.org
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-12-05 01:55 UTC by Ben Gamari
Modified: 2012-08-29 14:34 UTC (History)
2 users (show)

See Also:
Kernel Version: 2.6.37-rc3
Subsystem:
Regression: No
Bisected commit-id:


Attachments
Check sdvo pin is valid (1.27 KB, patch)
2010-12-08 16:51 UTC, Chris Wilson
Details | Diff

Description Ben Gamari 2010-12-05 01:55:11 UTC
The i915 module in Natty's 2.6.37-rc3-7 (and perhaps others) kernel oopses with a null pointer dereference on boot on my i915GM-based Dell Latitude D610 as seen below,

[ 16.693732] i915 0000:00:02.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
[ 16.693741] i915 0000:00:02.0: setting latency timer to 64
[ 16.753618] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 16.753753] IP: [<c04ca13e>] i2c_transfer+0x1e/0xc0
[ 16.753851] *pde = 3f032067
[ 16.753940] Oops: 0000 [#1] SMP
[ 16.754060] last sysfs file: /sys/module/ssb/initstate
[ 16.754124] Modules linked in: i915(+) b43(+) snd_seq_device mac80211 drm_kms_helper drm sunrpc cfg80211 yenta_socket dell_laptop pcmcia_rsrc snd dcdbas psmouse
pcmcia_core i2c_algo_bit video shpchp soundcore serio_raw snd_page_alloc output lp parport tg3 ssb
[ 16.755116]
[ 16.755171] Pid: 341, comm: modprobe Not tainted 2.6.37-7-generic #19-Ubuntu 0U8082/Latitude D610
[ 16.755267] EIP: 0060:[<c04ca13e>] EFLAGS: 00010296 CPU: 0
[ 16.755331] EIP is at i2c_transfer+0x1e/0xc0
[ 16.755392] EAX: 00000000 EBX: ffffffa1 ECX: 00000002 EDX: f35b5c4c
[ 16.755458] ESI: f367b748 EDI: f35b5ccf EBP: f35b5c2c ESP: f35b5c14
[ 16.755524] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 16.755589] Process modprobe (pid: 341, ti=f35b4000 task=f358a5e0 task.ti=f35b4000)
[ 16.755675] Stack:
[ 16.755729] f3fd3e60 00000002 f35b5c4c f363d400 00000000 f35b5ccf f35b5c64 f8541ada
[ 16.756004] f363d40c 00000000 0000000e f3fd3c00 f363d400 00000000 00000038 00000001
[ 16.756004] f35b5c48 00010038 f8540001 f35b5ccf f35b5cdc f854549d f35b5ccf 00000014
[ 16.756004] Call Trace:
[ 16.756004] [<f8541ada>] ? intel_sdvo_read_byte.clone.8+0x4a/0x90 [i915]
[ 16.756004] [<f8540001>] ? intel_dp_set_m_n+0x201/0x480 [i915]
[ 16.756004] [<f854549d>] ? intel_sdvo_init+0x19d/0x5c0 [i915]
[ 16.756004] [<f853acc7>] ? intel_crt_init+0xe7/0x2f0 [i915]
[ 16.756004] [<f852d2ed>] ? intel_setup_outputs+0x37d/0x730 [i915]
[ 16.756004] [<f8539705>] ? intel_modeset_init+0x195/0x360 [i915]
[ 16.756004] [<f85120a1>] ? i915_load_modeset_init+0x131/0x200 [i915]
[ 16.756004] [<f8511720>] ? i915_vga_set_decode+0x0/0x30 [i915]
[ 16.756004] [<f851064f>] ? intel_detect_pch+0x2f/0x80 [i915]
[ 16.756004] [<f8513e84>] ? i915_driver_load+0x334/0x8e0 [i915]
[ 16.756004] [<f836e5c3>] ? drm_get_pci_dev+0x153/0x300 [drm]
[ 16.756004] [<c05fb20f>] ? _raw_spin_lock_irqsave+0x2f/0x50
[ 16.756004] [<f8551d72>] ? i915_pci_probe+0x12/0x14 [i915]
[ 16.756004] [<c038af37>] ? local_pci_probe+0x47/0xb0
[ 16.756004] [<c038c418>] ? pci_device_probe+0x68/0x90
[ 16.756004] [<c042763d>] ? really_probe+0x4d/0x150
[ 16.756004] [<c042fb9b>] ? pm_runtime_barrier+0x4b/0xb0
[ 16.756004] [<c04278dc>] ? driver_probe_device+0x3c/0x60
[ 16.756004] [<c0427981>] ? __driver_attach+0x81/0x90
[ 16.756004] [<c0427900>] ? __driver_attach+0x0/0x90
[ 16.756004] [<c0426968>] ? bus_for_each_dev+0x48/0x70
[ 16.756004] [<c04274ee>] ? driver_attach+0x1e/0x20
[ 16.756004] [<c0427900>] ? __driver_attach+0x0/0x90
[ 16.756004] [<c04270a1>] ? bus_add_driver+0xc1/0x2c0
[ 16.756004] [<c038bdc0>] ? pci_device_remove+0x0/0xf0
[ 16.756004] [<c0427bc6>] ? driver_register+0x66/0x110
[ 16.756004] [<c038b4d5>] ? __pci_register_driver+0x45/0xb0
[ 16.756004] [<f836e8d6>] ? drm_pci_init+0x96/0xc0 [drm]
[ 16.756004] [<f8366e24>] ? drm_init+0x54/0x70 [drm]
[ 16.756004] [<f857008f>] ? i915_init+0x8f/0x91 [i915]
[ 16.756004] [<c0101255>] ? do_one_initcall+0x35/0x170
[ 16.756004] [<f8570000>] ? i915_init+0x0/0x91 [i915]
[ 16.756004] [<c0101255>] ? do_one_initcall+0x35/0x170
[ 16.756004] [<f8570000>] ? i915_init+0x0/0x91 [i915]
[ 16.756004] [<c018903b>] ? sys_init_module+0x9b/0x1e0
[ 16.756004] [<c0226612>] ? sys_write+0x42/0x70
[ 16.756004] [<c05fb494>] ? syscall_call+0x7/0xb
[ 16.756004] Code: ff ff 5d c3 89 f6 8d bc 27 00 00 00 00 55 89 e5 57 56 53 83 ec 0c 3e 8d 74 26 00 bb a1 ff ff ff 89 c6 8b 40 0c 89 55 f0 89 4d ec <8b> 00 85 c0 74 6f 89 e0 25 00 e0 ff ff f7 40 14 ff ff ff ef 75
[ 16.756004] EIP: [<c04ca13e>] i2c_transfer+0x1e/0xc0 SS:ESP 0068:f35b5c14
[ 16.756004] CR2: 0000000000000000
[ 16.761639] ---[ end trace 53912a785b2ee2cb ]---
Comment 1 Ben Gamari 2010-12-05 02:00:21 UTC
This originated as Launchpad #684331 [1].

[1] https://bugs.launchpad.net/linux/+bug/684331
Comment 2 Ben Gamari 2010-12-05 02:01:45 UTC
Bisection results:


e957d7720a2797b31231616014b68f4f6203145e is the first bad commit
commit e957d7720a2797b31231616014b68f4f6203145e
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Sep 24 12:52:03 2010 +0100

    drm/i915/sdvo: Fix GMBUSification
    
    Besides a couple of bugs when writing more than a single byte along the
    GMBUS, SDVO was completely failing whilst trying to use GMBUS, so use
    bit banging instead.
    
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

:040000 040000 36ad24228580b9ba62c3a1c3c6b9f539aa912876 cca439fbc517e222592afb33aadce4417bf74a7c M	drivers
Comment 3 Chris Wilson 2010-12-08 16:51:49 UTC
Created attachment 39242 [details]
Check sdvo pin is valid
Comment 4 Chris Wilson 2010-12-16 14:49:22 UTC
I believe I've fixed this with:

commit 63abf3edaf42d0b9f278df90fe41c7ed4796b6b1
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Wed Dec 8 16:48:21 2010 +0000

    drm/i915/sdvo: Only use the SDVO pin if it is in the valid range
    
    BIOSes. Can't live without them (apparently), definitely can't live with
    them.
    
    Reported-by: Ben Gamari <bgamari@gmail.com>
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=24312
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

which is heading upstream.
Comment 5 Florian Mickler 2011-01-23 15:44:36 UTC
turned up in .37-rc8:
commit 63abf3edaf42d0b9f278df90fe41c7ed4796b6b1
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Wed Dec 8 16:48:21 2010 +0000

    drm/i915/sdvo: Only use the SDVO pin if it is in the valid range
Comment 6 Ben Gamari 2012-08-29 14:34:22 UTC
It seems this has returned in v3.5. Opened a new bug as 46631.

Note You need to log in before you can comment on or make changes to this bug.