Bug 488342 - nouveau triggers null ptr deref in nv04_instmem_init
nouveau triggers null ptr deref in nv04_instmem_init
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: kernel (Show other bugs)
rawhide
All Linux
low Severity high
: ---
: ---
Assigned To: Ben Skeggs
Fedora Extras Quality Assurance
:
: 488615 489058 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-03-03 14:40 EST by Jarod Wilson
Modified: 2009-03-13 17:48 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 490494 (view as bug list)
Environment:
Last Closed: 2009-03-06 18:34:53 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jarod Wilson 2009-03-03 14:40:38 EST
Description of problem:
If I try to start up X on the PCIe GeForce 6600GT in one of my x86_64 boxes here using the nouveau driver, all hell breaks loose, the box starts beeping like mad and it goes oops all over itself.

http://www.kerneloops.org/oops.php?number=256668

Version-Release number of selected component (if applicable):
# uname -r
2.6.29-0.179.rc6.git5.fc11.x86_64
# rpm -q xorg-x11-drv-nouveau
xorg-x11-drv-nouveau-0.0.12-7.20090302gite6c3b98.fc11.x86_64

Additional info:
# lspci -v -s 05:00.0
05:00.0 VGA compatible controller: nVidia Corporation NV43 [GeForce 6600 GT] (rev a2) (prog-if 00 [VGA controller])
	Subsystem: eVga.com. Corp. Device c420
	Flags: bus master, fast devsel, latency 0, IRQ 28
	Memory at f8000000 (32-bit, non-prefetchable) [size=64M]
	Memory at d0000000 (64-bit, prefetchable) [size=128M]
	Memory at fd000000 (64-bit, non-prefetchable) [size=16M]
	Expansion ROM at feae0000 [disabled] [size=128K]
	Capabilities: [60] Power Management version 2
	Capabilities: [68] MSI: Mask- 64bit+ Count=1/1 Enable-
	Capabilities: [78] Express Endpoint, MSI 00
	Kernel driver in use: nouveau
	Kernel modules: nouveau, nvidiafb

Remote access to the box can be arranged, its here in the office.

Nb: nv also fails to function, but vesa does work.
Comment 1 Jarod Wilson 2009-03-03 14:48:41 EST
Ah. 2.6.29-0.179.rc6.git5.fc11 is one of the builds that has nouveau kms turned on. Probably relevant, and possibly a non-issue w/o kms prematurely enabled.
Comment 2 Jarod Wilson 2009-03-03 15:41:17 EST
Nope. Same failure w/the kms config bits turned off (local build).
Comment 3 Chuck Ebbert 2009-03-04 21:43:59 EST
Oops 256668 first showed up in kernel version 2.6.29-0.179.rc6.git5.fc11.x86_64
Oops 256668 last showed up in version 2.6.29-0.187.rc6.git6.fc10.x86_64
2.6.29-rc6-git6 -- 1
2.6.29-rc6-git5 -- 7

BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
IP: [] nv04_instmem_init+0x9b/0x21d [nouveau]
PGD 23b592067 PUD 23b507067 PMD 23b589067 PTE 0
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/pci0000:00/0000:00:08.0/0000:05:00.0/resource
CPU 0 
Modules linked in: sco bridge stp llc bnep l2cap bluetooth sunrpc ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 cpufreq_ondemand powernow_k8 freq_table xfs exportfs btrfs zlib_deflate libcrc32c dm_multipath raid1 uinput snd_emu10k1_synth snd_emux_synth snd_seq_virmidi snd_seq_midi_emul snd_emu10k1 snd_rawmidi snd_ac97_codec ac97_bus snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_device snd_timer snd_page_alloc snd_util_mem firewire_ohci snd_hwdep firewire_core pcspkr serio_raw snd emu10k1_gp tg3 k8temp hwmon crc_itu_t e100 soundcore gameport mii ata_generic pata_acpi 3w_9xxx pata_serverworks i2c_piix4 shpchp sata_svw raid456 async_xor async_memcpy async_tx xor ext4 jbd2 crc16 nouveau drm i2c_core [last unloaded: scsi_wait_scan]
Pid: 2927, comm: Xorg Tainted: G        W  2.6.29-0.187.rc6.git6.fc10.x86_64 #1 empty
RIP: 0010:[]  [] nv04_instmem_init+0x9b/0x21d [nouveau]
RSP: 0018:ffff88023b583db8  EFLAGS: 00010206
RAX: 0000000000000000 RBX: ffff88023bea6000 RCX: 0000000000000000
RDX: 0000000000010000 RSI: 0000000000000000 RDI: ffff88023bea6000
RBP: ffff88023b583dd8 R08: ffff88023b583db8 R09: 0000000000000000
R10: 000000000000029d R11: 0000000000000001 R12: ffff88023bc230d8
R13: ffff88023bc230d8 R14: ffff88023bea6000 R15: ffff88023bea6000
FS:  00007f53b713a7d0(0000) GS:ffffffff8197d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 000000023b41a000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process Xorg (pid: 2927, threadinfo ffff88023b582000, task ffff880230400000)
Stack:
ffff88023bea6000 ffff88023bc230d8 0000000000006440 ffff88022eca4290
ffff88023b583e08 ffffffffa0045346 ffff88022ecbbe00 ffffffffa0077020
0000000000000000 0000000000006440 ffff88023b583e18 ffffffffa00454c1
Call Trace:
[] nouveau_card_init+0x7fc/0x969 [nouveau]
[] nouveau_ioctl_card_init+0xe/0x10 [nouveau]
[] drm_ioctl+0x1eb/0x276 [drm]
[] ? _raw_spin_lock+0x68/0x116
[] ? nouveau_ioctl_card_init+0x0/0x10 [nouveau]
[] vfs_ioctl+0x64/0x7d
[] do_vfs_ioctl+0x470/0x4b0
[] sys_ioctl+0x5a/0x7c
[] system_call_fastpath+0x16/0x1b
Code: 8b 95 48 05 00 00 48 c7 c6 70 8e 06 a0 48 c7 c7 40 cb 06 a0 31 c0 c1 ea 0a e8 02 ea 33 e1 ba 00 00 01 00 31 c9 eb 12 49 8b 45 28 <48> 8b 58 18 48 8d 04 1a 89 08 48 83 c2 04 41 39 95 48 05 00 00 
RIP  [] nv04_instmem_init+0x9b/0x21d [nouveau]
RSP 
CR2: 0000000000000018
Comment 4 Chuck Ebbert 2009-03-04 21:45:20 EST
*** Bug 488615 has been marked as a duplicate of this bug. ***
Comment 5 Ben Skeggs 2009-03-04 21:52:23 EST
This has been fixed, will appear in the next kernel build after kernel-2.6.29-0.203.rc7.fc11.
Comment 6 Jarod Wilson 2009-03-05 10:53:19 EST
No more oopses for me, so that's a distinct improvement, but still no X. The following shows up in dmesg:

[drm] Allocating FIFO number 0
[drm] nouveau_fifo_alloc: initialised FIFO 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] Allocating FIFO number 1
[drm] nouveau_fifo_alloc: initialised FIFO 1
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] nouveau_fifo_free: freeing fifo 1
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] nouveau_fifo_free: freeing fifo 0
[drm:nouveau_fifo_free] *ERROR* Failed to idle channel 0 before destroy.Prepare for strangeness..
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] Allocating FIFO number 0
DMA-API: debugging out of memory - disabling
[drm] nouveau_fifo_alloc: initialised FIFO 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] Allocating FIFO number 1
[drm] nouveau_fifo_alloc: initialised FIFO 1
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] nouveau_fifo_free: freeing fifo 1
[drm] PFIFO_DMA_PUSHER - Ch 0
[drm] nouveau_fifo_free: freeing fifo 0
[drm:nouveau_fifo_free] *ERROR* Failed to idle channel 0 before destroy.Prepare for strangeness..


The entire block repeats several times until X finally gives up on starting, ultimately ending with:

Fatal server error:
Detected GPU lockup

(can attach full log file if so desired)
Comment 7 Jacobo Cabaleiro 2009-03-06 17:54:22 EST
I was experiencing this on a Geforce Go 7300 (see details below) with all the recent kernels, and I just want to note that the las Koji kernel build by Dave Airlie works for me and X session with Nouveau driver is again running perfectly.

So for:
    01:00.0 VGA compatible controller: nVidia Corporation G72M [Quadro NVS 110M/GeForce Go 7300] (rev a1) (prog-if 00 [VGA controller])
            Subsystem: Toshiba America Info Systems Device ff02
Koji kernel build:
    ID	92792
    Package Name	kernel
    Version	2.6.29
    Release	0.207.rc7.fc11
using nouveau:
    xorg-x11-drv-nouveau-0.0.12-8.20090305git42f99e6.fc11.x86_64
and X:
    xorg-x11-server-Xorg-1.6.0-7.fc11.x86_64
solved this problem for me
Comment 8 Ben Skeggs 2009-03-06 18:34:53 EST
Ok, I'll mark this as resolved then :)

(In reply to comment #6)
> No more oopses for me, so that's a distinct improvement, but still no X. The
> following shows up in dmesg:
> 
> [drm] Allocating FIFO number 0
> [drm] nouveau_fifo_alloc: initialised FIFO 0
> [drm] PFIFO_DMA_PUSHER - Ch 0
>
> --snip--
> 
> (can attach full log file if so desired)  
Thank you, a full dmesg log would be very useful.  It'd be even more useful if you were able to load the drm module with debug=1 :)  When you do so can you please file a new bug, as the original issue mentioned here is fixed.
Comment 9 Ben Skeggs 2009-03-13 17:48:32 EDT
*** Bug 489058 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.