| Message ID | CACAvsv7-3nLH=47oXCXkP3PGP+UXrBgHyW1qy-YjXq41xf_e+Q@mail.gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 14/01/14 05:15, Ben Skeggs wrote: > On Tue, Jan 14, 2014 at 3:07 PM, Ben Skeggs <skeggsb@gmail.com> wrote: >> On Tue, Jan 14, 2014 at 1:22 PM, Bob Gleitsmann <rjgleits@bellsouth.net> wrote: >>> I should have mentioned that this applies to Linus' 3.13.0-rc7 and rc8 >>> git. Maybe it's obvious. >> Hey Bob, >> >> Thanks for reporting this. Can you try the attached patch instead and >> report if it helps you? > Thinko in first attempt, new one attached. > Seems to resolve the problem over at https://bugs.freedesktop.org/show_bug.cgi?id=73607 Thanks Ben >> >> Ben. >> >>> >>> Sorry about that. >>> >>> Bob >>> -------- Forwarded Message -------- >>> From: Bob Gleitsmann <rjgleits@bellsouth.net> >>> To: bskeggs@redhat.com >>> Cc: nouveau@lists.freedesktop.org, dri-devel@lists.freedesktop.org >>> Subject: [PATCH] Fix null dereference oopses for nv40 cards >>> Date: Mon, 13 Jan 2014 01:45:36 -0500 >>> >>> The problem affects nv40 cards during booting. It comes from there being >>> two places where subdev arrays are maintained. A commit was recently >>> added to make the two equal. However, the struct nouveau_device version >>> ends up being referenced before it is initialized. The problem arises >>> during the creation of the INSTMEM and THERM subdevs. ' >>> >>> Signed off by: Bob Gleitsmann rjgleits@bellsouth.net >>> >>> diff --git a/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c b/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c >>> index b10a143..0f494ca 100644 >>> --- a/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c >>> +++ b/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c >>> @@ -23,6 +23,7 @@ >>> */ >>> >>> #include <engine/graph/nv40.h> >>> +#include <core/device.h> >>> >>> #include "nv04.h" >>> >>> @@ -38,6 +39,7 @@ nv40_instmem_ctor(struct nouveau_object *parent, struct nouveau_object *engine, >>> >>> ret = nouveau_instmem_create(parent, engine, oclass, &priv); >>> *pobject = nv_object(priv); >>> + device->subdev[NVDEV_SUBDEV_INSTMEM] = *pobject; >>> if (ret) >>> return ret; >>> >>> diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c b/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c >>> index 002e51b..59b25be 100644 >>> --- a/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c >>> +++ b/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c >>> @@ -187,9 +187,11 @@ nv40_therm_ctor(struct nouveau_object *parent, >>> { >>> struct nv40_therm_priv *priv; >>> int ret; >>> + struct nouveau_device *device = nv_device(parent); >>> >>> ret = nouveau_therm_create(parent, engine, oclass, &priv); >>> *pobject = nv_object(priv); >>> + device->subdev[NVDEV_SUBDEV_THERM] = *pobject; >>> if (ret) >>> return ret; >>> >>> >>> >>> >>> _______________________________________________ >>> Nouveau mailing list >>> Nouveau@lists.freedesktop.org >>> http://lists.freedesktop.org/mailman/listinfo/nouveau >>> >>> >>> _______________________________________________ >>> Nouveau mailing list >>> Nouveau@lists.freedesktop.org >>> http://lists.freedesktop.org/mailman/listinfo/nouveau
Seems to work OK thanks. Bob On Tue, 2014-01-14 at 15:15 +1000, Ben Skeggs wrote: > On Tue, Jan 14, 2014 at 3:07 PM, Ben Skeggs <skeggsb@gmail.com> wrote: > > On Tue, Jan 14, 2014 at 1:22 PM, Bob Gleitsmann <rjgleits@bellsouth.net> wrote: > >> I should have mentioned that this applies to Linus' 3.13.0-rc7 and rc8 > >> git. Maybe it's obvious. > > Hey Bob, > > > > Thanks for reporting this. Can you try the attached patch instead and > > report if it helps you? > Thinko in first attempt, new one attached. > > > > > Ben. > > > >> > >> Sorry about that. > >> > >> Bob > >> -------- Forwarded Message -------- > >> From: Bob Gleitsmann <rjgleits@bellsouth.net> > >> To: bskeggs@redhat.com > >> Cc: nouveau@lists.freedesktop.org, dri-devel@lists.freedesktop.org > >> Subject: [PATCH] Fix null dereference oopses for nv40 cards > >> Date: Mon, 13 Jan 2014 01:45:36 -0500 > >> > >> The problem affects nv40 cards during booting. It comes from there being > >> two places where subdev arrays are maintained. A commit was recently > >> added to make the two equal. However, the struct nouveau_device version > >> ends up being referenced before it is initialized. The problem arises > >> during the creation of the INSTMEM and THERM subdevs. ' > >> > >> Signed off by: Bob Gleitsmann rjgleits@bellsouth.net > >> > >> diff --git a/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c b/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c > >> index b10a143..0f494ca 100644 > >> --- a/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c > >> +++ b/drivers/gpu/drm/nouveau/core/subdev/instmem/nv40.c > >> @@ -23,6 +23,7 @@ > >> */ > >> > >> #include <engine/graph/nv40.h> > >> +#include <core/device.h> > >> > >> #include "nv04.h" > >> > >> @@ -38,6 +39,7 @@ nv40_instmem_ctor(struct nouveau_object *parent, struct nouveau_object *engine, > >> > >> ret = nouveau_instmem_create(parent, engine, oclass, &priv); > >> *pobject = nv_object(priv); > >> + device->subdev[NVDEV_SUBDEV_INSTMEM] = *pobject; > >> if (ret) > >> return ret; > >> > >> diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c b/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c > >> index 002e51b..59b25be 100644 > >> --- a/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c > >> +++ b/drivers/gpu/drm/nouveau/core/subdev/therm/nv40.c > >> @@ -187,9 +187,11 @@ nv40_therm_ctor(struct nouveau_object *parent, > >> { > >> struct nv40_therm_priv *priv; > >> int ret; > >> + struct nouveau_device *device = nv_device(parent); > >> > >> ret = nouveau_therm_create(parent, engine, oclass, &priv); > >> *pobject = nv_object(priv); > >> + device->subdev[NVDEV_SUBDEV_THERM] = *pobject; > >> if (ret) > >> return ret; > >> > >> > >> > >> > >> _______________________________________________ > >> Nouveau mailing list > >> Nouveau@lists.freedesktop.org > >> http://lists.freedesktop.org/mailman/listinfo/nouveau
From 2f40bcd890aa9d861c7e26b4867580f58836d8ec Mon Sep 17 00:00:00 2001 From: Ben Skeggs <bskeggs@redhat.com> Date: Tue, 14 Jan 2014 14:56:22 +1000 Subject: [PATCH] fix null ptr dereferences on some boards Regression from "device: populate master subdev pointer only when fully constructed" Reported-by: Bob Gleitsmann <rjgleits@bellsouth.net> Signed-off-by: Ben Skeggs <bskeggs@redhat.com> --- drm/dispnv04/dfp.c | 2 +- drm/dispnv04/tvnv04.c | 2 +- nvkm/include/subdev/i2c.h | 2 +- nvkm/include/subdev/instmem.h | 7 +++++++ nvkm/subdev/i2c/base.c | 4 ++-- nvkm/subdev/therm/ic.c | 10 +++++----- 6 files changed, 17 insertions(+), 10 deletions(-) diff --git a/drm/dispnv04/dfp.c b/drm/dispnv04/dfp.c index 936a71c..7fdc51e 100644 --- a/drm/dispnv04/dfp.c +++ b/drm/dispnv04/dfp.c @@ -643,7 +643,7 @@ static void nv04_tmds_slave_init(struct drm_encoder *encoder) get_tmds_slave(encoder)) return; - type = i2c->identify(i2c, 2, "TMDS transmitter", info, NULL); + type = i2c->identify(i2c, 2, "TMDS transmitter", info, NULL, NULL); if (type < 0) return; diff --git a/drm/dispnv04/tvnv04.c b/drm/dispnv04/tvnv04.c index cc4b208..244822d 100644 --- a/drm/dispnv04/tvnv04.c +++ b/drm/dispnv04/tvnv04.c @@ -59,7 +59,7 @@ int nv04_tv_identify(struct drm_device *dev, int i2c_index) struct nouveau_i2c *i2c = nouveau_i2c(drm->device); return i2c->identify(i2c, i2c_index, "TV encoder", - nv04_tv_encoder_info, NULL); + nv04_tv_encoder_info, NULL, NULL); } diff --git a/nvkm/include/subdev/i2c.h b/nvkm/include/subdev/i2c.h index 9fa5da7..7f50a85 100644 --- a/nvkm/include/subdev/i2c.h +++ b/nvkm/include/subdev/i2c.h @@ -73,7 +73,7 @@ struct nouveau_i2c { int (*identify)(struct nouveau_i2c *, int index, const char *what, struct nouveau_i2c_board_info *, bool (*match)(struct nouveau_i2c_port *, - struct i2c_board_info *)); + struct i2c_board_info *, void *), void *); struct list_head ports; }; diff --git a/nvkm/include/subdev/instmem.h b/nvkm/include/subdev/instmem.h index e40b26c..c1df26f 100644 --- a/nvkm/include/subdev/instmem.h +++ b/nvkm/include/subdev/instmem.h @@ -35,6 +35,13 @@ struct nouveau_instmem { static inline struct nouveau_instmem * nouveau_instmem(void *obj) { + /* nv04/nv40 impls need to create objects in their constructor, + * which is before the subdev pointer is valid + */ + if (nv_iclass(obj, NV_SUBDEV_CLASS) && + nv_subidx(obj) == NVDEV_SUBDEV_INSTMEM) + return obj; + return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_INSTMEM]; } diff --git a/nvkm/subdev/i2c/base.c b/nvkm/subdev/i2c/base.c index 041fd5e..c33c03d 100644 --- a/nvkm/subdev/i2c/base.c +++ b/nvkm/subdev/i2c/base.c @@ -197,7 +197,7 @@ static int nouveau_i2c_identify(struct nouveau_i2c *i2c, int index, const char *what, struct nouveau_i2c_board_info *info, bool (*match)(struct nouveau_i2c_port *, - struct i2c_board_info *)) + struct i2c_board_info *, void *), void *data) { struct nouveau_i2c_port *port = nouveau_i2c_find(i2c, index); int i; @@ -221,7 +221,7 @@ nouveau_i2c_identify(struct nouveau_i2c *i2c, int index, const char *what, } if (nv_probe_i2c(port, info[i].dev.addr) && - (!match || match(port, &info[i].dev))) { + (!match || match(port, &info[i].dev, data))) { nv_info(i2c, "detected %s: %s\n", what, info[i].dev.type); return i; diff --git a/nvkm/subdev/therm/ic.c b/nvkm/subdev/therm/ic.c index e44ed7b..7610fc5 100644 --- a/nvkm/subdev/therm/ic.c +++ b/nvkm/subdev/therm/ic.c @@ -29,9 +29,9 @@ static bool probe_monitoring_device(struct nouveau_i2c_port *i2c, - struct i2c_board_info *info) + struct i2c_board_info *info, void *data) { - struct nouveau_therm_priv *priv = (void *)nouveau_therm(i2c); + struct nouveau_therm_priv *priv = data; struct nvbios_therm_sensor *sensor = &priv->bios_sensor; struct i2c_client *client; @@ -96,7 +96,7 @@ nouveau_therm_ic_ctor(struct nouveau_therm *therm) }; i2c->identify(i2c, NV_I2C_DEFAULT(0), "monitoring device", - board, probe_monitoring_device); + board, probe_monitoring_device, therm); if (priv->ic) return; } @@ -108,7 +108,7 @@ nouveau_therm_ic_ctor(struct nouveau_therm *therm) }; i2c->identify(i2c, NV_I2C_DEFAULT(0), "monitoring device", - board, probe_monitoring_device); + board, probe_monitoring_device, therm); if (priv->ic) return; } @@ -117,5 +117,5 @@ nouveau_therm_ic_ctor(struct nouveau_therm *therm) device. Let's try our static list. */ i2c->identify(i2c, NV_I2C_DEFAULT(0), "monitoring device", - nv_board_infos, probe_monitoring_device); + nv_board_infos, probe_monitoring_device, therm); } -- 1.8.5.2