[Bug 38196] New: Null pointer dereference in nouveau_gpuobj_channel_takedown

[Bug 38196] New: Null pointer dereference in nouveau_gpuobj_channel_takedown

[bugzilla-daemon-CC+yJ3UmIYqDUpFQwHEjaQ]

https://bugs.freedesktop.org/show_bug.cgi?id=38196

           Summary: Null pointer dereference in
                    nouveau_gpuobj_channel_takedown
           Product: Mesa
           Version: git
          Platform: x86-64 (AMD64)
        OS/Version: Linux (All)
            Status: NEW
          Severity: critical
          Priority: medium
         Component: Drivers/DRI/nouveau
        AssignedTo: nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org
        ReportedBy: rjgleits-Bdlq13kUjeyLZ21kGMrzwg@public.gmane.org


The code for this procedure includes (line 878) assignment to a pointer of type
struct nv50_display_crtc. However nv50_display(dev) is null for earlier cards
(e.g., nv40). This causes a kernel oops if for example a program using mesa is
terminated.
I tried skipping the loop containing this line if nv50_display(dev) is null and
this worked on my 6800 Ultra. 

Best Wishes,

Bob Gleitsmann

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 38196] Null pointer dereference in nouveau_gpuobj_channel_takedown

[bugzilla-daemon-CC+yJ3UmIYqDUpFQwHEjaQ]

https://bugs.freedesktop.org/show_bug.cgi?id=38196

--- Comment #1 from Bob Gleitsmann <rjgleits-Bdlq13kUjeyLZ21kGMrzwg@public.gmane.org> 2011-06-11 19:23:56 PDT ---
OK I don't know what product and component are to be used for bugs in kernel
drm. It isn't mesa, but should to to the dri-devel mailing list. Or whatever
you think.

Bob

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 38196] Null pointer dereference in nouveau_gpuobj_channel_takedown

[bugzilla-daemon-CC+yJ3UmIYqDUpFQwHEjaQ]

https://bugs.freedesktop.org/show_bug.cgi?id=38196

Pekka Paalanen <pq-X3B1VOXEql0@public.gmane.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Product|Mesa                        |xorg
          Component|Drivers/DRI/nouveau         |Driver/nouveau

--- Comment #2 from Pekka Paalanen <pq-X3B1VOXEql0@public.gmane.org> 2011-06-12 01:17:03 PDT ---
Since this bug apparently refers to nouveau_object.c in the kernel DRM, change
the product/component to as per http://nouveau.freedesktop.org/wiki/Bugs .

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 38196] Null pointer dereference in nouveau_gpuobj_channel_takedown

[bugzilla-daemon-CC+yJ3UmIYqDUpFQwHEjaQ]

https://bugs.freedesktop.org/show_bug.cgi?id=38196

Emil Velikov <emil.l.velikov-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #3 from Emil Velikov <emil.l.velikov-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> 2011-06-18 06:22:14 PDT ---
Thanks for reporting this Bob

The issue should be resolved by 23a3a221(drm/nouveau: fix null pointer deref on
pre-nv50 chipsets) in nouveau-git [1]


[1] http://cgit.freedesktop.org/nouveau/linux-2.6/

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.