| Summary: | [NV1A] 3.19-rc1 NULL dereference on modprobe in pramin_fini | ||||||
|---|---|---|---|---|---|---|---|
| Product: | xorg | Reporter: | Bruno <bonbons> | ||||
| Component: | Driver/nouveau | Assignee: | Nouveau Project <nouveau> | ||||
| Status: | RESOLVED FIXED | QA Contact: | Xorg Project Team <xorg-team> | ||||
| Severity: | major | ||||||
| Priority: | medium | CC: | rjgleits | ||||
| Version: | unspecified | ||||||
| Hardware: | x86 (IA32) | ||||||
| OS: | Linux (All) | ||||||
| Whiteboard: | |||||||
| i915 platform: | i915 features: | ||||||
| Attachments: |
|
||||||
|
Description
Bruno
2014-12-21 15:06:34 UTC
Matching objdump -d -S nouveau.ko:
000136c0 <pramin_fini>:
static void
pramin_fini(void *data)
{
136c0: 55 push %ebp
136c1: 89 e5 mov %esp,%ebp
136c3: 53 push %ebx
136c4: 89 c3 mov %eax,%ebx
static inline void
nv_wr32(void *obj, u32 addr, u32 data)
{
struct nouveau_subdev *subdev = nv_subdev(obj);
nv_spam(subdev, "nv_wr32 0x%06x 0x%08x\n", addr, data);
iowrite32_native(data, subdev->mmio + addr);
136c6: 8b 00 mov (%eax),%eax
136c8: 8b 50 24 mov 0x24(%eax),%edx
136cb: 8b 43 04 mov 0x4(%ebx),%eax
136ce: 81 c2 00 17 00 00 add $0x1700,%edx
136d4: e8 fc ff ff ff call 136d5 <pramin_fini+0x15>
struct priv *priv = data;
nv_wr32(priv->bios, 0x001700, priv->bar0);
kfree(priv);
136d9: 89 d8 mov %ebx,%eax
136db: e8 fc ff ff ff call 136dc <pramin_fini+0x1c>
}
136e0: 5b pop %ebx
136e1: 5d pop %ebp
136e2: c3 ret
136e3: 8d b6 00 00 00 00 lea 0x0(%esi),%esi
136e9: 8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi
Source code:
static void
pramin_fini(void *data)
{
struct priv *priv = data;
nv_wr32(priv->bios, 0x001700, priv->bar0);
kfree(priv);
}
Created attachment 111111 [details] [review] Consider ->init NULL return as a failure Things are crashing because pramin_init returns NULL (and not a ERR_PTR). Would the following change be a proper fix?: static int shadow_method(struct nouveau_bios *bios, struct shadow *mthd, const char *name) { const struct nvbios_source *func = mthd->func; if (func->name) { nv_debug(bios, "trying %s...\n", name ? name : func->name); if (func->init) { mthd->data = func->init(bios, name); if (IS_ERR(mthd->data)) { mthd->data = NULL; return 0; + } else if (!mthd->data) { + return 0; } } mthd->score = shadow_score(bios, mthd); if (func->fini) func->fini(mthd->data); nv_debug(bios, "scored %d\n", mthd->score); mthd->data = bios->data; mthd->size = bios->size; bios->data = NULL; bios->size = 0; } return mthd->score; } If so, please apply attached patch. *** Bug 87576 has been marked as a duplicate of this bug. *** *** Bug 87641 has been marked as a duplicate of this bug. *** Should be fixed in 3.19-final. |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.