On Thu, Aug 22, 2013 at 09:12:40AM +0200, Maarten Lankhorst wrote: > Op 22-08-13 02:10, Ilia Mirkin schreef: > > The code expects non-VRAM mem nodes to have a pages list. If that's not > > set, it will do a null deref down the line. Warn on that condition and > > return an error. > > > > See https://bugs.freedesktop.org/show_bug.cgi?id=64774 > > > > Reported-by: Pasi K?rkk?inen <pasik at iki.fi> > > Tested-by: Pasi K?rkk?inen <pasik at iki.fi> > > Signed-off-by: Ilia Mirkin <imirkin at alum.mit.edu> > > Cc: <stable at vger.kernel.org> # 3.8+ > > --- > > > > I don't exactly understand what's going on, but this is just a > > straightforward way to avoid a null deref that you see happens in the > > bug. I haven't figured out the root cause of this, but it's getting > > well into the "I have no idea how TTM works" space. However this seems > > like a bit of defensive programming -- nouveau_vm_map_sg will pass > > node->pages as a list down, which will be dereferenced by > > nvc0_vm_map_sg. Perhaps the other arguments should make that > > dereferencing not happen, but it definitely was happening here, as you > > can see in the bug. > > > > Ben/Maarten, I'll let you judge whether this check is appropriate, > > since like I hope I was able to convey above, I'm just not really sure :) > Not it really isn't appropriate.. > > You'd have to call call nouveau_vm_map_sg_table instead, the only place that > doesn't handle that correctly > is where it's not expected to be called. > > Here, have a completely untested patch to fix things... >
Maarten: I've been testing this stuff with Linux 3.10.x, so I had to modify the patch a bit to make it apply there.. I've attached the modified copy that applies to 3.10.9, hopefully I did the backport correctly. With Linux 3.10.9 and the patch applied the kernel doesn't crash anymore, and I get this error in dmesg: [ 76.105643] nouveau W[ DRM] Trying to create a fb in vram with valid_domains=00000004 Does that help? -- Pasi -------------- next part -------------- A non-text attachment was scrubbed... Name: nouveau_test_fix_null_deref_v3.10.patch Type: text/x-diff Size: 1202 bytes Desc: not available URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130823/b13e064d/attachment.patch>
