Bug 1021779

Summary:

[ATI Radeon HD 8970M: Null pointer dereference] at radeon_vm_bo_add+0x92/0xc0

Product:

[Fedora] Fedora

Reporter:

Joe Julian <joe>

Component:

xorg-x11-drv-ati

Assignee:

X/OpenGL Maintenance List <xgl-maint>

Status:

CLOSED EOL

QA Contact:

Fedora Extras Quality Assurance <extras-qa>

Severity:

unspecified

Docs Contact:

Priority:

unspecified

Version:

CC:

gansalmon, itamar, jonathan, kernel-maint, maderat, madhu.chinakonda, marcelo.barbosa, xgl-maint

Target Milestone:

---

Target Release:

---

Hardware:

Unspecified

OS:

Unspecified

Whiteboard:

Fixed In Version:

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2016-07-19 10:30:19 UTC

Type:

Bug

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
lspci -s01:00.0 -vv	none
dmesg	none
dmesg kernel 3.13	none

Description Joe Julian 2013-10-22 05:40:04 UTC

Description of problem:
Kernel error:

[  126.763526] BUG: unable to handle kernel NULL pointer dereference at 0000000000000250
[  126.763612] IP: [<ffffffffa0251be2>] radeon_vm_bo_add+0x92/0xc0 [radeon]
[  126.763721] PGD 228049067 PUD 232d75067 PMD 0 
[  126.763774] Oops: 0000 [#1] SMP 
[  126.763812] Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast ipt_MASQUERADE ip6t_REJECT xt_conntrack bnep ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw vfat fat kvm_amd kvm arc4 snd_hda_codec_realtek rtl8723ae rtl_pci rtlwifi snd_hda_codec_hdmi crct10dif_pclmul snd_hda_intel snd_hda_codec crc32_pclmul mac80211 btusb cfg80211 crc32c_intel bluetooth msi_wmi ghash_clmulni_intel sparse_keymap rfkill snd_hwdep sdhci_pci snd_seq sdhci alx mmc_core serio_raw mdio microcode k10temp snd_seq_device snd_pcm i2c_piix4 wmi shpchp
[  126.764645]  video snd_page_alloc snd_timer snd soundcore acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd sunrpc binfmt_misc ata_generic pata_acpi radeon i2c_algo_bit drm_kms_helper ttm pata_atiixp drm i2c_core
[  126.764869] CPU: 3 PID: 1436 Comm: Xorg Not tainted 3.12.0-0.rc6.git0.1.fc21.x86_64 #1
[  126.764938] Hardware name: Micro-Star International Co., Ltd. GX70 3BE/MS-176K, BIOS E176KAMS.706 05/07/2013
[  126.765020] task: ffff880232c36d60 ti: ffff880230c2c000 task.ti: ffff880230c2c000
[  126.765083] RIP: 0010:[<ffffffffa0251be2>]  [<ffffffffa0251be2>] radeon_vm_bo_add+0x92/0xc0 [radeon]
[  126.765195] RSP: 0018:ffff880230c2db80  EFLAGS: 00010202
[  126.765241] RAX: ffff880232c36d60 RBX: ffff8802281385a0 RCX: ffff880230c2dfd8
[  126.765301] RDX: ffff88008cc1cc90 RSI: ffff88008cc1cc90 RDI: ffff8802281385d0
[  126.765361] RBP: ffff880230c2dba8 R08: ffff88008cc1cc90 R09: ffff880236c01a00
[  126.765420] R10: ffffffffa0251b7e R11: 0000000000000006 R12: ffff88008cc1cc80
[  126.765480] R13: 0000000000000000 R14: ffff8802281385d0 R15: ffff88008cc1ccc0
[  126.765541] FS:  00007ff5adf9c9c0(0000) GS:ffff88023ed80000(0000) knlGS:0000000000000000
[  126.765608] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  126.765657] CR2: 0000000000000250 CR3: 0000000232d73000 CR4: 00000000000407e0
[  126.765716] Stack:
[  126.765737]  ffff88003e750000 ffff88023028a800 0000000000000000 ffff88008cc1cc80
[  126.765815]  ffff88023028a820 ffff880230c2dbe0 ffffffffa0236d63 ffff880230c2dbd0
[  126.765891]  ffff880231552000 ffff88023028a800 ffff88003e74c058 ffff8802302d3d00
[  126.765968] Call Trace:
[  126.766026]  [<ffffffffa0236d63>] radeon_driver_open_kms+0x83/0xf0 [radeon]
[  126.766109]  [<ffffffffa0026a7b>] drm_open+0x29b/0x6f0 [drm]
[  126.766181]  [<ffffffffa0026fce>] drm_stub_open+0xfe/0x190 [drm]
[  126.766239]  [<ffffffff811ae4fc>] chrdev_open+0x9c/0x180
[  126.766289]  [<ffffffff811a788b>] do_dentry_open+0x1eb/0x280
[  126.766354]  [<ffffffff811ae460>] ? cdev_put+0x30/0x30
[  126.766401]  [<ffffffff811a7951>] finish_open+0x31/0x40
[  126.766449]  [<ffffffff811b877c>] do_last+0x5cc/0x1220
[  126.766497]  [<ffffffff811b948b>] path_openat+0xbb/0x660
[  126.766546]  [<ffffffff81228669>] ? ext4_file_write+0x99/0x3e0
[  126.766602]  [<ffffffff811462d6>] ? free_pages+0x66/0x70
[  126.766650]  [<ffffffff811ba15a>] do_filp_open+0x3a/0x90
[  126.766700]  [<ffffffff811c5f2d>] ? __alloc_fd+0x7d/0x120
[  126.766750]  [<ffffffff811a8d5e>] do_sys_open+0x12e/0x210
[  126.766801]  [<ffffffff811a8e5e>] SyS_open+0x1e/0x20
[  126.766848]  [<ffffffff81671229>] system_call_fastpath+0x16/0x1b
[  126.766900] Code: 28 01 00 00 00 48 89 03 48 89 43 08 4c 89 70 30 4c 89 70 38 e8 f0 43 41 e1 49 8b 54 24 10 49 8d 74 24 10 4c 89 f7 e8 2e 45 0c e1 <49> 8b b5 50 02 00 00 49 8d 95 48 02 00 00 48 89 df e8 18 45 0c 
[  126.767305] RIP  [<ffffffffa0251be2>] radeon_vm_bo_add+0x92/0xc0 [radeon]
[  126.767398]  RSP <ffff880230c2db80>
[  126.767429] CR2: 0000000000000250
[  126.771130] ---[ end trace 16b7227fee05aa57 ]---


Version-Release number of selected component (if applicable):
kernel-3.12.0-0.rc6.git0.1.fc21.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Try to start Xorg, ie.: Xorg :0 vt7

Additional info:
Hardware is an MSI GX70 laptop

00:01.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Richland [Radeon HD 8650G] (prog-if 00 [VGA controller])
	Subsystem: Micro-Star International Co., Ltd. Device 10ef
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0, Cache Line Size: 64 bytes
	Interrupt: pin A routed to IRQ 52
	Region 0: Memory at c0000000 (32-bit, prefetchable) [size=256M]
	Region 1: I/O ports at f000 [size=256]
	Region 2: Memory at feb00000 (32-bit, non-prefetchable) [size=256K]
	Expansion ROM at <unassigned> [disabled]
	Capabilities: [50] Power Management version 3
		Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
		Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
	Capabilities: [58] Express (v2) Root Complex Integrated Endpoint, MSI 00
		DevCap:	MaxPayload 128 bytes, PhantFunc 0, Latency L0s <4us, L1 unlimited
			ExtTag+ RBE+ FLReset-
		DevCtl:	Report errors: Correctable- Non-Fatal- Fatal- Unsupported-
			RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+
			MaxPayload 128 bytes, MaxReadReq 128 bytes
		DevSta:	CorrErr- UncorrErr- FatalErr- UnsuppReq- AuxPwr- TransPend-
		LnkCap:	Port #0, Speed unknown, Width x0, ASPM unknown, Latency L0 <64ns, L1 <1us
			ClockPM- Surprise- LLActRep- BwNot-
		LnkCtl:	ASPM Disabled; Disabled- Retrain- CommClk-
			ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
		LnkSta:	Speed unknown, Width x0, TrErr- Train- SlotClk- DLActive- BWMgmt- ABWMgmt-
		DevCap2: Completion Timeout: Not Supported, TimeoutDis-, LTR-, OBFF Not Supported
		DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis-, LTR-, OBFF Disabled
		LnkCtl2: Target Link Speed: 2.5GT/s, EnterCompliance- SpeedDis-
			 Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-
			 Compliance De-emphasis: -6dB
		LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete-, EqualizationPhase1-
			 EqualizationPhase2-, EqualizationPhase3-, LinkEqualizationRequest-
	Capabilities: [a0] MSI: Enable+ Count=1/1 Maskable- 64bit+
		Address: 00000000fee0800c  Data: 4172
	Capabilities: [100 v1] Vendor Specific Information: ID=0001 Rev=1 Len=010 <?>
	Kernel driver in use: radeon

Comment 1 Joe Julian 2013-10-26 22:48:31 UTC

I hadn't noticed that I was actually getting the error on the second Radeon card, the HD 8970M.

I'm attaching the pci info for the second card and the dmesg data where it fails to initialize.

I can attach an Xorg log if necessary, but since the null pointer error just happens opening /dev/drm/1 I suspect that it's due to the failure to initialize.

Comment 2 Joe Julian 2013-10-26 22:51:12 UTC

Created attachment 816464 [details]
lspci -s01:00.0 -vv

Comment 3 Joe Julian 2013-10-26 22:52:08 UTC

Created attachment 816465 [details]
dmesg

Comment 4 Mateusz M. 2013-11-29 15:06:40 UTC

Created attachment 830696 [details]
dmesg kernel 3.13

Comment 5 Mateusz M. 2013-12-25 09:56:08 UTC

(In reply to Mateusz M. from comment #4)
> Created attachment 830696 [details]
> dmesg kernel 3.13

kernel 3.13-rc5+git
changing to UEFI CFM and radeon.audio=0 work around an issue for me

Comment 6 Jaroslav Reznik 2015-03-03 15:09:27 UTC

This bug appears to have been reported against 'rawhide' during the Fedora 22 development cycle.
Changing version to '22'.

More information and reason for this action is here:
https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora22

Comment 7 Fedora End Of Life 2016-07-19 10:30:19 UTC

Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.