3.1rc10 null pointer dereference ideapad_backlight_notify_power

3.1rc10 null pointer dereference ideapad_backlight_notify_power

[Sam Tygier]

In kernels 3.1rc9 and 3.1rc10 (from the ubuntu mainline repo) I get a crash when disabling and then enabling the screen backlight with the alt+f2 key on a lenovo ideapad S12 (intel version). The crash does not occur with 3.0 kernels in ubuntu.  I have not tested earlier 3.1 rcs.

The crash message scrolls to fast to see, it is not writen to a log, and i dont see it on a USB serial console (I may be doing something wrong, but I do see other messages during boot). I managed to get some photos of the message. interesting parts are:

BUG: unable to handle kernel NULL pointer dereference at 00000008
IP: [<f807b29e>]  ideapad_backlight_notify_power+0x2e/0x40 [ideapad_laptop]
*pde = 00000000
Oops: 0002 [#1] SMP

call trace functions:
ideapad_acpi_notify
acpi_device_notify
acpi_ev_notify_dispach
acpi_os_execute_deferred
process_one_work
? acpi_os_wait_events_complete
????????? can't read this one
kthread
kthread_bind
kernel_thread_helper

i put the photos at http://www.hep.manchester.ac.uk/u/sam/pub/ideapad/

if it would be helpfull, i could try a few more times for sharper photos. please let me know if there is any other useful information you need.

thanks,
sam  

Re: 3.1rc10 null pointer dereference ideapad_backlight_notify_power

[David Rientjes]

On Wed, 19 Oct 2011, Sam Tygier wrote:

> In kernels 3.1rc9 and 3.1rc10 (from the ubuntu mainline repo) I get a crash
> when disabling and then enabling the screen backlight with the alt+f2 key on a
> lenovo ideapad S12 (intel version). The crash does not occur with 3.0 kernels
> in ubuntu.  I have not tested earlier 3.1 rcs.
> 
> The crash message scrolls to fast to see, it is not writen to a log, and i
> dont see it on a USB serial console (I may be doing something wrong, but I do
> see other messages during boot). I managed to get some photos of the message.
> interesting parts are:
> 
> BUG: unable to handle kernel NULL pointer dereference at 00000008
> IP: [<f807b29e>]  ideapad_backlight_notify_power+0x2e/0x40 [ideapad_laptop]
> *pde = 00000000
> Oops: 0002 [#1] SMP
> 
> call trace functions:
> ideapad_acpi_notify
> acpi_device_notify
> acpi_ev_notify_dispach
> acpi_os_execute_deferred
> process_one_work
> ? acpi_os_wait_events_complete
> ????????? can't read this one
> kthread
> kthread_bind
> kernel_thread_helper
> 
> i put the photos at http://www.hep.manchester.ac.uk/u/sam/pub/ideapad/
> 
> if it would be helpfull, i could try a few more times for sharper photos.
> please let me know if there is any other useful information you need.
> 

Looks light it may be changed via the acpi video driver where ->blight is 
NULL.  Adding Ike and Matthew to the cc.

Re: 3.1rc10 null pointer dereference ideapad_backlight_notify_power

[Ike Panhc]

On 10/20/2011 04:20 AM, David Rientjes wrote:
> On Wed, 19 Oct 2011, Sam Tygier wrote:
> 
>> In kernels 3.1rc9 and 3.1rc10 (from the ubuntu mainline repo) I get a crash
>> when disabling and then enabling the screen backlight with the alt+f2 key on a
>> lenovo ideapad S12 (intel version). The crash does not occur with 3.0 kernels
>> in ubuntu.  I have not tested earlier 3.1 rcs.
>>
>> The crash message scrolls to fast to see, it is not writen to a log, and i
>> dont see it on a USB serial console (I may be doing something wrong, but I do
>> see other messages during boot). I managed to get some photos of the message.
>> interesting parts are:
>>
>> BUG: unable to handle kernel NULL pointer dereference at 00000008
>> IP: [<f807b29e>]  ideapad_backlight_notify_power+0x2e/0x40 [ideapad_laptop]
>> *pde = 00000000
>> Oops: 0002 [#1] SMP
>>
>> call trace functions:
>> ideapad_acpi_notify
>> acpi_device_notify
>> acpi_ev_notify_dispach
>> acpi_os_execute_deferred
>> process_one_work
>> ? acpi_os_wait_events_complete
>> ????????? can't read this one
>> kthread
>> kthread_bind
>> kernel_thread_helper
>>
>> i put the photos at http://www.hep.manchester.ac.uk/u/sam/pub/ideapad/
>>
>> if it would be helpfull, i could try a few more times for sharper photos.
>> please let me know if there is any other useful information you need.
>>
> 
> Looks light it may be changed via the acpi video driver where ->blight is 
> NULL.  Adding Ike and Matthew to the cc.
> 

This issue has been reported[1] and patch[2] is ready.

[1] http://www.mail-archive.com/platform-driver-x86@vger.kernel.org/msg02340.html

[2] http://www.mail-archive.com/platform-driver-x86@vger.kernel.org/msg02343.html
    http://www.mail-archive.com/platform-driver-x86@vger.kernel.org/msg02346.html

Thanks for reporting this issue.

Re: 3.1rc10 null pointer dereference ideapad_backlight_notify_power

[David Rientjes]

On Thu, 20 Oct 2011, Ike Panhc wrote:

> This issue has been reported[1] and patch[2] is ready.
> 
> [1] http://www.mail-archive.com/platform-driver-x86@vger.kernel.org/msg02340.html
> 
> [2] http://www.mail-archive.com/platform-driver-x86@vger.kernel.org/msg02343.html
>     http://www.mail-archive.com/platform-driver-x86@vger.kernel.org/msg02346.html
> 

It certainly looks like the patch in [2] will fix the issue, but it looks 
like those are from a couple months ago and I'm still not seeing it in 
linux-next.  Matthew, how is this going to Linus and will it be cc'd to 
stable@vger.kernel.org?

Re: 3.1rc10 null pointer dereference ideapad_backlight_notify_power

[Sam Tygier]

>On Thu, 20 Oct 2011, Ike Panhc wrote:
>
>> This issue has been reported[1] and patch[2] is ready.
>> 
>> [1] http://www.mail-archive.com/platform-driver-x86@vger.kernel.org/msg02340.html
>> 
>> [2] http://www.mail-archive.com/platform-driver-x86@vger.kernel.org/msg02343.html
>>    http://www.mail-archive.com/platform-driver-x86@vger.kernel.org/msg02346.html
>> 
>
>It certainly looks like the patch in [2] will fix the issue, but it looks 
>like those are from a couple months ago and I'm still not seeing it in 
>linux-next.  Matthew, how is this going to Linus and will it be cc'd to 
>stable@vger.kernel.org?


the patch works for me (i applied it to kernel between r10 and 3.1 final). for some reason i don't understand i had to apply the patch by hand.


my git diff says:

diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 0c59541..36953bd 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -492,6 +492,9 @@ static void ideapad_backlight_notify_power(struct ideapad_private *priv)
 {
        unsigned long power;
        struct backlight_device *blightdev = priv->blightdev;
+       
+       if (!blightdev)
+               return;
 
        if (read_ec_data(ideapad_handle, 0x18, &power))
                return;


i am not quite sure of the etiquette, should I repost the patch in its original form, or my version, or can someone else get this included.

thanks

sam

Re: 3.1rc10 null pointer dereference ideapad_backlight_notify_power

[David Rientjes]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 1186 bytes --]

On Mon, 24 Oct 2011, Sam Tygier wrote:

> >On Thu, 20 Oct 2011, Ike Panhc wrote:
> >
> >> This issue has been reported[1] and patch[2] is ready.
> >> 
> >> [1] http://www.mail-archive.com/platform-driver-x86@vger.kernel.org/msg02340.html
> >> 
> >> [2] http://www.mail-archive.com/platform-driver-x86@vger.kernel.org/msg02343.html
> >>    http://www.mail-archive.com/platform-driver-x86@vger.kernel.org/msg02346.html
> >> 
> >
> >It certainly looks like the patch in [2] will fix the issue, but it looks 
> >like those are from a couple months ago and I'm still not seeing it in 
> >linux-next.  Matthew, how is this going to Linus and will it be cc'd to 
> >stable@vger.kernel.org?
> 
> 
> the patch works for me (i applied it to kernel between r10 and 3.1 final). for some reason i don't understand i had to apply the patch by hand.
> 

So we can add your

	Tested-by: Sam Tygier <samtygier@yahoo.co.uk>

to the patch.

> i am not quite sure of the etiquette, should I repost the patch in its original form, or my version, or can someone else get this included.
> 

This will go through Matthew's tree and hopefully also backported to 
stable through stable@vger.kernel.org.  Matthew?