Bug 488342
| Summary: | nouveau triggers null ptr deref in nv04_instmem_init | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Jarod Wilson <jarod> | |
| Component: | kernel | Assignee: | Ben Skeggs <bskeggs> | |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | high | Docs Contact: | ||
| Priority: | low | |||
| Version: | rawhide | CC: | kernel-maint, leon, obmun.h, quintela, wwoods | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 490494 (view as bug list) | Environment: | ||
| Last Closed: | 2009-03-06 23:34:53 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
|
Description
Jarod Wilson
2009-03-03 19:40:38 UTC
Ah. 2.6.29-0.179.rc6.git5.fc11 is one of the builds that has nouveau kms turned on. Probably relevant, and possibly a non-issue w/o kms prematurely enabled. Nope. Same failure w/the kms config bits turned off (local build). Oops 256668 first showed up in kernel version 2.6.29-0.179.rc6.git5.fc11.x86_64 Oops 256668 last showed up in version 2.6.29-0.187.rc6.git6.fc10.x86_64 2.6.29-rc6-git6 -- 1 2.6.29-rc6-git5 -- 7 BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 IP: [] nv04_instmem_init+0x9b/0x21d [nouveau] PGD 23b592067 PUD 23b507067 PMD 23b589067 PTE 0 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/pci0000:00/0000:00:08.0/0000:05:00.0/resource CPU 0 Modules linked in: sco bridge stp llc bnep l2cap bluetooth sunrpc ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 cpufreq_ondemand powernow_k8 freq_table xfs exportfs btrfs zlib_deflate libcrc32c dm_multipath raid1 uinput snd_emu10k1_synth snd_emux_synth snd_seq_virmidi snd_seq_midi_emul snd_emu10k1 snd_rawmidi snd_ac97_codec ac97_bus snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_device snd_timer snd_page_alloc snd_util_mem firewire_ohci snd_hwdep firewire_core pcspkr serio_raw snd emu10k1_gp tg3 k8temp hwmon crc_itu_t e100 soundcore gameport mii ata_generic pata_acpi 3w_9xxx pata_serverworks i2c_piix4 shpchp sata_svw raid456 async_xor async_memcpy async_tx xor ext4 jbd2 crc16 nouveau drm i2c_core [last unloaded: scsi_wait_scan] Pid: 2927, comm: Xorg Tainted: G W 2.6.29-0.187.rc6.git6.fc10.x86_64 #1 empty RIP: 0010:[] [] nv04_instmem_init+0x9b/0x21d [nouveau] RSP: 0018:ffff88023b583db8 EFLAGS: 00010206 RAX: 0000000000000000 RBX: ffff88023bea6000 RCX: 0000000000000000 RDX: 0000000000010000 RSI: 0000000000000000 RDI: ffff88023bea6000 RBP: ffff88023b583dd8 R08: ffff88023b583db8 R09: 0000000000000000 R10: 000000000000029d R11: 0000000000000001 R12: ffff88023bc230d8 R13: ffff88023bc230d8 R14: ffff88023bea6000 R15: ffff88023bea6000 FS: 00007f53b713a7d0(0000) GS:ffffffff8197d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000023b41a000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process Xorg (pid: 2927, threadinfo ffff88023b582000, task ffff880230400000) Stack: ffff88023bea6000 ffff88023bc230d8 0000000000006440 ffff88022eca4290 ffff88023b583e08 ffffffffa0045346 ffff88022ecbbe00 ffffffffa0077020 0000000000000000 0000000000006440 ffff88023b583e18 ffffffffa00454c1 Call Trace: [] nouveau_card_init+0x7fc/0x969 [nouveau] [] nouveau_ioctl_card_init+0xe/0x10 [nouveau] [] drm_ioctl+0x1eb/0x276 [drm] [] ? _raw_spin_lock+0x68/0x116 [] ? nouveau_ioctl_card_init+0x0/0x10 [nouveau] [] vfs_ioctl+0x64/0x7d [] do_vfs_ioctl+0x470/0x4b0 [] sys_ioctl+0x5a/0x7c [] system_call_fastpath+0x16/0x1b Code: 8b 95 48 05 00 00 48 c7 c6 70 8e 06 a0 48 c7 c7 40 cb 06 a0 31 c0 c1 ea 0a e8 02 ea 33 e1 ba 00 00 01 00 31 c9 eb 12 49 8b 45 28 <48> 8b 58 18 48 8d 04 1a 89 08 48 83 c2 04 41 39 95 48 05 00 00 RIP [] nv04_instmem_init+0x9b/0x21d [nouveau] RSP CR2: 0000000000000018 *** Bug 488615 has been marked as a duplicate of this bug. *** This has been fixed, will appear in the next kernel build after kernel-2.6.29-0.203.rc7.fc11. No more oopses for me, so that's a distinct improvement, but still no X. The following shows up in dmesg: [drm] Allocating FIFO number 0 [drm] nouveau_fifo_alloc: initialised FIFO 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] Allocating FIFO number 1 [drm] nouveau_fifo_alloc: initialised FIFO 1 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] nouveau_fifo_free: freeing fifo 1 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] nouveau_fifo_free: freeing fifo 0 [drm:nouveau_fifo_free] *ERROR* Failed to idle channel 0 before destroy.Prepare for strangeness.. [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] Allocating FIFO number 0 DMA-API: debugging out of memory - disabling [drm] nouveau_fifo_alloc: initialised FIFO 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] Allocating FIFO number 1 [drm] nouveau_fifo_alloc: initialised FIFO 1 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] nouveau_fifo_free: freeing fifo 1 [drm] PFIFO_DMA_PUSHER - Ch 0 [drm] nouveau_fifo_free: freeing fifo 0 [drm:nouveau_fifo_free] *ERROR* Failed to idle channel 0 before destroy.Prepare for strangeness.. The entire block repeats several times until X finally gives up on starting, ultimately ending with: Fatal server error: Detected GPU lockup (can attach full log file if so desired) I was experiencing this on a Geforce Go 7300 (see details below) with all the recent kernels, and I just want to note that the las Koji kernel build by Dave Airlie works for me and X session with Nouveau driver is again running perfectly.
So for:
01:00.0 VGA compatible controller: nVidia Corporation G72M [Quadro NVS 110M/GeForce Go 7300] (rev a1) (prog-if 00 [VGA controller])
Subsystem: Toshiba America Info Systems Device ff02
Koji kernel build:
ID 92792
Package Name kernel
Version 2.6.29
Release 0.207.rc7.fc11
using nouveau:
xorg-x11-drv-nouveau-0.0.12-8.20090305git42f99e6.fc11.x86_64
and X:
xorg-x11-server-Xorg-1.6.0-7.fc11.x86_64
solved this problem for me
Ok, I'll mark this as resolved then :) (In reply to comment #6) > No more oopses for me, so that's a distinct improvement, but still no X. The > following shows up in dmesg: > > [drm] Allocating FIFO number 0 > [drm] nouveau_fifo_alloc: initialised FIFO 0 > [drm] PFIFO_DMA_PUSHER - Ch 0 > > --snip-- > > (can attach full log file if so desired) Thank you, a full dmesg log would be very useful. It'd be even more useful if you were able to load the drm module with debug=1 :) When you do so can you please file a new bug, as the original issue mentioned here is fixed. *** Bug 489058 has been marked as a duplicate of this bug. *** |