[Nouveau,Fwd:,[PATCH] Fix null dereference oopses for nv40 cards] kernel 3.13.0-rc8

Commit Message

Ben Skeggs Jan. 14, 2014, 5:07 a.m. UTC

On Tue, Jan 14, 2014 at 1:22 PM, Bob Gleitsmann <[e-mail]> wrote:
> I should have mentioned that this applies to Linus' 3.13.0-rc7 and rc8
> git. Maybe it's obvious.
Hey Bob,

Thanks for reporting this.  Can you try the attached patch instead and
report if it helps you?

Ben.

>
> Sorry about that.
>
> Bob
> -------- Forwarded Message --------
> From: Bob Gleitsmann <[e-mail]>
> To: [e-mail]
> Cc: [e-mail], [e-mail]
> Subject: [PATCH] Fix null dereference oopses for nv40 cards
> Date: Mon, 13 Jan 2014 01:45:36 -0500
>
> The problem affects nv40 cards during booting. It comes from there being
> two places where subdev arrays are maintained. A commit was recently
> added to make the two equal. However, the struct nouveau_device version
> ends up being referenced before it is initialized. The problem arises
> during the creation of the INSTMEM and THERM subdevs. '
>
> Signed off by: Bob Gleitsmann [e-mail]
>
> diff --git a/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c b/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c
> index b10a143..0f494ca 100644
> --- a/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c
> +++ b/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c
> @@ -23,6 +23,7 @@
>   */
>
>  #include <engine/graph/nv40.h>
> +#include <core/device.h>
>
>  #include "nv04.h"
>
> @@ -38,6 +39,7 @@ nv40_instmem_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
>
>         ret = nouveau_instmem_create(parent, engine, oclass, &priv);
>         *pobject = nv_object(priv);
> +       device->subdev[NVDEV_SUBDEV_INSTMEM] = *pobject;
>         if (ret)
>                 return ret;
>
> diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c b/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c
> index 002e51b..59b25be 100644
> --- a/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c
> +++ b/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c
> @@ -187,9 +187,11 @@ nv40_therm_ctor(struct nouveau_object *parent,
>  {
>         struct nv40_therm_priv *priv;
>         int ret;
> +       struct nouveau_device *device = nv_device(parent);
>
>         ret = nouveau_therm_create(parent, engine, oclass, &priv);
>         *pobject = nv_object(priv);
> +       device->subdev[NVDEV_SUBDEV_THERM] = *pobject;
>         if (ret)
>                 return ret;
>
>
>
>
> _______________________________________________
> Nouveau mailing list
> [e-mail]
> http://lists.freedesktop.org/mailman/listinfo/nouveau

Patch

From a79811f15925281dc7fe1797430e51063707c72d Mon Sep 17 00:00:00 2001
From: Ben Skeggs <[e-mail]>
Date: Tue, 14 Jan 2014 14:56:22 +1000
Subject: [PATCH] fix null ptr dereferences on some boards

Regression from "device: populate master subdev pointer only when fully
constructed"

Reported-by: Bob Gleitsmann <[e-mail]>
Signed-off-by: Ben Skeggs <[e-mail]>
---
 nvkm/include/subdev/instmem.h | 7 +++++++
 nvkm/subdev/therm/ic.c        | 3 ++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/nvkm/include/subdev/instmem.h b/nvkm/include/subdev/instmem.h
index e40b26c..c1df26f 100644
--- a/nvkm/include/subdev/instmem.h
+++ b/nvkm/include/subdev/instmem.h
@@ -35,6 +35,13 @@  struct nouveau_instmem {
 static inline struct nouveau_instmem *
 nouveau_instmem(void *obj)
 {
+	/* nv04/nv40 impls need to create objects in their constructor,
+	 * which is before the subdev pointer is valid
+	 */
+	if (nv_iclass(obj, NV_SUBDEV_CLASS) &&
+	    nv_subidx(obj) == NVDEV_SUBDEV_INSTMEM)
+		return obj;
+
 	return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_INSTMEM];
 }
 
diff --git a/nvkm/subdev/therm/ic.c b/nvkm/subdev/therm/ic.c
index e44ed7b..8c26ff1 100644
--- a/nvkm/subdev/therm/ic.c
+++ b/nvkm/subdev/therm/ic.c
@@ -31,7 +31,8 @@  static bool
 probe_monitoring_device(struct nouveau_i2c_port *i2c,
 			struct i2c_board_info *info)
 {
-	struct nouveau_therm_priv *priv = (void *)nouveau_therm(i2c);
+	struct nouveau_therm_priv *priv =
+		(void *)nv_pclass(i2c, NV_SUBDEV_CLASS);
 	struct nvbios_therm_sensor *sensor = &priv->bios_sensor;
 	struct i2c_client *client;
 
-- 
1.8.5.2