<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_REOPENED " title="REOPENED - Kernel "NULL pointer dereference" with MST monitor on HSW" href="https://bugs.freedesktop.org/show_bug.cgi?id=97666#c34">Comment # 34</a> on <a class="bz_bug_link bz_status_REOPENED " title="REOPENED - Kernel "NULL pointer dereference" with MST monitor on HSW" href="https://bugs.freedesktop.org/show_bug.cgi?id=97666">bug 97666</a> from <a class="email" href="mailto:carlos.santa@intel.com" title="Carlos Santa <carlos.santa@intel.com>"> Carlos Santa</a> <pre>(In reply to Ville Syrjala from <a href="show_bug.cgi?id=97666#c33">comment #33</a>) > (In reply to Carlos Santa from <a href="show_bug.cgi?id=97666#c32">comment #32</a>) > > Hi Ville, > > > > I tested the following 3 patches on today's drm-nightly: > > > > 1. drm/i915: Refresh that status of MST capable connectors in ->detect() > > 2. drm/fb-helper: Fix connector ref leak on error > > 3. drm/fb-helper: Keep references for the current set of used connectors > > > > You're right, after applying #1, the null pointer issue comes back but after > > applying #2, and doing the display power on/off to repro the bug, the system > > freezes and never comes back again. Same behavior if then applying patch #3 > > on top, which is supposed to be the fix. > > Freezes hard enough to not leave a trace in netconsole/serial etc. ? Logs > would be nice. Ok, I got the log using dmesg -w. It's actually oopsing the same way as before, see the <a href="attachment.cgi?id=10" name="attach_10" title="sample code">attachment 10</a> <a href="attachment.cgi?id=10&action=edit" title="sample code">[details]</a>-21-2016. More on the traces, the "adapter" parameter being passed to i2c_transfer() from drm_do_probe_ddc_edid() although is not NULL it appears to arrive with invalid data, the pointer that gets de-referenced is this one "adapter->algo->master_xfer". Adding more traces I was able to track the sequence to: i2c_transfer() drm_do_probe_ddc_edid() drm_get_edid() port->connector = (*mstb->mgr->cbs->add_connector)(mstb->mgr, port, proppath); drm_dp_add_port(port->connector, &port->aux.ddc) drm_dp_send_link_address() The port->connector is what gets passed to drm_get_edid() as a reference, I am guessing that this "port" somehow is becoming invalid from within intel_dp_add_mst_connector().</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are on the CC list for the bug.</li> <li>You are the QA Contact for the bug.</li> </ul> </body> </html>