Bug 525889 - Kernel Oops Due To radeon_ib_free
Summary: Kernel Oops Due To radeon_ib_free
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: rawhide
Hardware: i686
OS: Linux
low
high
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-09-26 18:28 UTC by Mathieu Chouquet-Stringer
Modified: 2009-09-26 21:24 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2009-09-26 21:24:45 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Mathieu Chouquet-Stringer 2009-09-26 18:28:18 UTC
Description of problem:
Hello,

I've recently upgraded to rawhide and can trigger the following bug pretty easily (with 2.6.31-40.fc12.i686.PAE):

------------[ cut here ]------------
WARNING: at drivers/gpu/drm/radeon/radeon_fence.c:160 radeon_fence_signaled+0x64/0xa2 [radeon]() (Tainted: G        W )
Hardware name: 236621U
Querying an unemited fence : d9de2f50 !
Modules linked in: nfs lockd fscache nfs_acl auth_rpcgss fuse sunrpc autofs4 ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 d
m_multipath uinput ppdev hostap_pci snd_intel8x0 hostap snd_intel8x0m thinkpad_acpi e100 snd_ac97_codec hwmon parport_pc ac97_bus lib80211 r
fkill mii irda snd_pcm parport snd_timer iTCO_wdt crc_ccitt snd iTCO_vendor_support i2c_i801 soundcore snd_page_alloc btrfs zlib_deflate lib
crc32c yenta_socket rsrc_nonstatic video output radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core [last unloaded: scsi_wait_scan]
Pid: 1469, comm: X Tainted: G        W  2.6.31-40.fc12.i686.PAE #1
Call Trace:
 [<c044c309>] warn_slowpath_common+0x7b/0xa3
 [<f7f47efc>] ? radeon_fence_signaled+0x64/0xa2 [radeon]
 [<c044c39a>] warn_slowpath_fmt+0x34/0x48
 [<f7f47efc>] radeon_fence_signaled+0x64/0xa2 [radeon]
 [<f7f54ca8>] radeon_ib_free+0x42/0x8b [radeon]
 [<f7f5531b>] radeon_cs_parser_fini+0xaf/0xc6 [radeon]
 [<f7f557ed>] radeon_cs_ioctl+0xa8/0x173 [radeon]
 [<f7e8213a>] drm_ioctl+0x21a/0x2c4 [drm]
 [<f7f55745>] ? radeon_cs_ioctl+0x0/0x173 [radeon]
 [<c05c761d>] ? inode_has_perm+0x69/0x84
 [<c040f6e1>] ? sched_clock+0x9/0xd
 [<c050f2f3>] vfs_ioctl+0x68/0x93
 [<c050f89a>] do_vfs_ioctl+0x4b2/0x503
 [<c05c7934>] ? selinux_file_ioctl+0x51/0x66
 [<c050f940>] sys_ioctl+0x55/0x86
 [<c04124d3>] ? syscall_trace_enter+0xea/0x10f
 [<c0409ad0>] syscall_call+0x7/0xb
---[ end trace a7919e7f17c0a729 ]---

------------[ cut here ]------------
WARNING: at lib/list_debug.c:48 list_del+0x30/0x7f() (Tainted: G        W )
Hardware name: 236621U
list_del corruption. prev->next should be f6731ac0, but was 458bf45d
Modules linked in: nfs lockd fscache nfs_acl auth_rpcgss fuse sunrpc autofs4 ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 d
m_multipath uinput ppdev hostap_pci snd_intel8x0 hostap snd_intel8x0m thinkpad_acpi e100 snd_ac97_codec hwmon parport_pc ac97_bus lib80211 r
fkill mii irda snd_pcm parport snd_timer iTCO_wdt crc_ccitt snd iTCO_vendor_support i2c_i801 soundcore snd_page_alloc btrfs zlib_deflate lib
crc32c yenta_socket rsrc_nonstatic video output radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core [last unloaded: scsi_wait_scan]
Pid: 1469, comm: X Tainted: G        W  2.6.31-40.fc12.i686.PAE #1
Call Trace:
 [<c044c309>] warn_slowpath_common+0x7b/0xa3
 [<c060f790>] ? list_del+0x30/0x7f
 [<c044c39a>] warn_slowpath_fmt+0x34/0x48
 [<c060f790>] list_del+0x30/0x7f
 [<f7f54cb3>] radeon_ib_free+0x4d/0x8b [radeon]
 [<f7f5531b>] radeon_cs_parser_fini+0xaf/0xc6 [radeon]
 [<f7f557ed>] radeon_cs_ioctl+0xa8/0x173 [radeon]
 [<f7e8213a>] drm_ioctl+0x21a/0x2c4 [drm]
 [<f7f55745>] ? radeon_cs_ioctl+0x0/0x173 [radeon]
 [<c05c761d>] ? inode_has_perm+0x69/0x84
 [<c040f6e1>] ? sched_clock+0x9/0xd
 [<c050f2f3>] vfs_ioctl+0x68/0x93
 [<c050f89a>] do_vfs_ioctl+0x4b2/0x503
 [<c05c7934>] ? selinux_file_ioctl+0x51/0x66
 [<c050f940>] sys_ioctl+0x55/0x86
 [<c04124d3>] ? syscall_trace_enter+0xea/0x10f
 [<c0409ad0>] syscall_call+0x7/0xb
---[ end trace a7919e7f17c0a72a ]---

BUG: unable to handle kernel paging request at 00100104
IP: [<c060f795>] list_del+0x35/0x7f
*pdpt = 000000003216c001 *pde = 0000000037e7f067 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:02:02.0/net/eth1/statistics/collisions
Modules linked in: nfs lockd fscache nfs_acl auth_rpcgss fuse sunrpc autofs4 ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 d
m_multipath uinput ppdev hostap_pci snd_intel8x0 hostap snd_intel8x0m thinkpad_acpi e100 snd_ac97_codec hwmon parport_pc ac97_bus lib80211 r
fkill mii irda snd_pcm parport snd_timer iTCO_wdt crc_ccitt snd iTCO_vendor_support i2c_i801 soundcore snd_page_alloc btrfs zlib_deflate lib
crc32c yenta_socket rsrc_nonstatic video output radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core [last unloaded: scsi_wait_scan]

Pid: 1469, comm: X Tainted: G        W  (2.6.31-40.fc12.i686.PAE #1) 236621U
EIP: 0060:[<c060f795>] EFLAGS: 00013296 CPU: 0
EIP is at list_del+0x35/0x7f
EAX: 00100100 EBX: f6731ac0 ECX: 00000000 EDX: 00000000
ESI: f6731030 EDI: f67318c4 EBP: f217dda8 ESP: f217dda0
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process X (pid: 1469, ti=f217c000 task=f21a95c0 task.ti=f217c000)
Stack:
 d62da1d6 f6731ac0 f217ddc0 f7f54cb3 d62da1d6 f217ddf0 00000002 000000c0
<0> f217ddd8 f7f5531b d62da1d6 f6731030 fffffff4 f217de30 f217de40 f7f557ed
<0> f7f7ba50 f7f722f8 f2013000 f6731b64 f6731030 f2013000 00000002 d9de23c0
Call Trace:
 [<f7f54cb3>] ? radeon_ib_free+0x4d/0x8b [radeon]
 [<f7f5531b>] ? radeon_cs_parser_fini+0xaf/0xc6 [radeon]
 [<f7f557ed>] ? radeon_cs_ioctl+0xa8/0x173 [radeon]
 [<f7e8213a>] ? drm_ioctl+0x21a/0x2c4 [drm]
 [<f7f55745>] ? radeon_cs_ioctl+0x0/0x173 [radeon]
 [<c05c761d>] ? inode_has_perm+0x69/0x84
 [<c040f6e1>] ? sched_clock+0x9/0xd
 [<c050f2f3>] ? vfs_ioctl+0x68/0x93
 [<c050f89a>] ? do_vfs_ioctl+0x4b2/0x503
 [<c05c7934>] ? selinux_file_ioctl+0x51/0x66
 [<c050f940>] ? sys_ioctl+0x55/0x86
 [<c04124d3>] ? syscall_trace_enter+0xea/0x10f
 [<c0409ad0>] ? syscall_call+0x7/0xb
Code: a1 14 00 00 00 89 45 f8 31 c0 8b 43 04 8b 00 39 d8 74 16 50 53 68 d9 92 97 c0 6a 30 68 13 93 97 c0 e8 d6 cb e3 ff 83 c4 14 8b 03 <8b> 
40 04 39 d8 74 16 50 53 68 24 93 97 c0 6a 33 68 13 93 97 c0 
EIP: [<c060f795>] list_del+0x35/0x7f SS:ESP 0068:f217dda0
CR2: 0000000000100104
---[ end trace a7919e7f17c0a72b ]---



Version-Release number of selected component (if applicable):
kernel-2.6.31-40.fc12.i686.PAE
and prior: kernel-2.6.31-33.fc12.i686.PAE (I think that's the version number I'm sending this from a different computer)

How reproducible:
It's easily reproducible if I browse the web.  When it happens, the machine is still up (I can ssh to it) but X is completely dead (corrupted screen) and I cannot switch back to a VT.

Comment 1 Chuck Ebbert 2009-09-26 18:35:41 UTC
Please try with 2.6.31.1-48, which has a radeon update.

Comment 2 Mathieu Chouquet-Stringer 2009-09-26 21:24:45 UTC
Much better...  I still get a lot of:
[TTM] Failed moving buffer. Proposed placement 0x00060004
[TTM] Out of aperture space or DRM memory quota.
[drm:radeon_object_create] *ERROR* Failed to allocate TTM object (12582912, 0x00060004, 0)
[drm:radeon_gem_object_create] *ERROR* Failed to allocate GEM object (12582912, 4, 4096)
[TTM] Failed moving buffer. Proposed placement 0x00060004
[TTM] Out of aperture space or DRM memory quota.
[drm:radeon_object_create] *ERROR* Failed to allocate TTM object (12582912, 0x00060004, 0)
[drm:radeon_gem_object_create] *ERROR* Failed to allocate GEM object (12582912, 4, 4096)


But X doesn't crash nor the kernel...  I'm closing this one...


Note You need to log in before you can comment on or make changes to this bug.