[Bug 553176] Re: [i915] Crash after suspending (NULL pointer dereference in intel_crt_detect())

[Gabe Gorelick]

Oh yes, I see that now. But if the oops traces do point to the same bug,
then couldn't the same bug be causing the intel_tv_detect() NULL pointer
dereference? They have very similar stacktraces:

[<f857cac9>] ? intel_crt_detect+0x69/0xe0 [i915]
 [<f80ceeee>] ? drm_helper_probe_single_connector_modes+0x26e/0x300 [drm_kms_helper]
 [<f8368d5e>] ? drm_mode_object_find+0x4e/0x70 [drm]
 [<f8369b7f>] ? drm_mode_getconnector+0x2df/0x380 [drm]
 [<c0589b59>] ? mutex_lock+0x19/0x40
 [<c04c64a7>] ? ethtool_get_drvinfo+0x137/0x140
 [<f835e7cd>] ? drm_ioctl+0x25d/0x3e0 [drm]
 [<c04c64a7>] ? ethtool_get_drvinfo+0x137/0x140
 [<f83698a0>] ? drm_mode_getconnector+0x0/0x380 [drm]
 [<f835e570>] ? drm_ioctl+0x0/0x3e0 [drm]
 [<c0215f71>] ? vfs_ioctl+0x21/0x90
 [<c0216259>] ? do_vfs_ioctl+0x79/0x310
 [<c058d210>] ? do_page_fault+0x160/0x3a0
 [<c0216557>] ? sys_ioctl+0x67/0x80
 [<c04c64a7>] ? ethtool_get_drvinfo+0x137/0x140
 [<c01033ec>] ? syscall_call+0x7/0xb
 [<c04c64a7>] ? ethtool_get_drvinfo+0x137/0x140
 [<c04c64a7>] ? ethtool_get_drvinfo+0x137/0x140

 vs

 [<f868540f>] ? intel_tv_detect+0x8f/0x1c0 [i915]
 [<f8322c46>] ? drm_helper_probe_single_connector_modes+0x296/0x300 [drm_kms_helper]
 [<f84c6e8e>] ? drm_mode_object_find+0x4e/0x70 [drm]
 [<f84c83bf>] ? drm_mode_getconnector+0x2df/0x380 [drm]
 [<f84bd815>] ? drm_ioctl+0x185/0x370 [drm]
 [<c04c64a7>] ? hidinput_hid_event+0x1d7/0x3a0
 [<f84c80e0>] ? drm_mode_getconnector+0x0/0x380 [drm]
 [<c04c64a7>] ? hidinput_hid_event+0x1d7/0x3a0
 [<c02f1c84>] ? security_file_permission+0x14/0x20
 [<c0213e5b>] ? vfs_ioctl+0x7b/0x90
 [<c04c64a7>] ? hidinput_hid_event+0x1d7/0x3a0
 [<c0214159>] ? do_vfs_ioctl+0x79/0x310
 [<c0205750>] ? do_sync_write+0x0/0x100
 [<c0214457>] ? sys_ioctl+0x67/0x80
 [<c04c64a7>] ? hidinput_hid_event+0x1d7/0x3a0
 [<c010344c>] ? syscall_call+0x7/0xb
 [<c04c64a7>] ? hidinput_hid_event+0x1d7/0x3a0
 [<c04c64a7>] ? hidinput_hid_event+0x1d7/0x3a0

The bottom of the traces don't really matter, but they both have the
same 3 functions leading up to the crash (besides the last one) which
seems to indicate that at some common point, e.g. drm_mode_getconnector,
NULL is passed as an argument to the next function in the call stack
when it shouldn't be, thus causing the NULL pointer dereference later on
down the road.

-- 
[i915] Crash after suspending (NULL pointer dereference in intel_crt_detect())
https://bugs.launchpad.net/bugs/553176
You received this bug notification because you are a member of Kernel
Bugs, which is subscribed to linux in ubuntu.