After update on kernel-2.6.38.3-18.fc15.x86_64 I got this NULL pointer dereferences many times during today. It has always occurred when trying to launch new application from favorites in gnome-shell.

Here is my trace:
BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: [<ffffffffa00e15ba>] nv50_vm_map_sg+0x29/0x8f [nouveau]
PGD 124b94067 PUD 1302fa067 PMD 0 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/pci0000:00/0000:00:1c.1/uevent
CPU 1 
Modules linked in: md4 nls_utf8 cifs fscache tun fuse ppdev lp parport_pc parport sunrpc cpufreq_ondemand acpi_cpufreq freq_table mperf ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables snd_hda_codec_analog btusb bluetooth arc4 snd_hda_intel iwlagn snd_hda_codec snd_hwdep r852 sm_common nand snd_seq snd_seq_device snd_pcm iwlcore mac80211 e1000e nand_ids nand_ecc mtd thinkpad_acpi i2c_i801 cfg80211 snd_timer snd rfkill iTCO_wdt iTCO_vendor_support snd_page_alloc soundcore microcode joydev wmi uinput ipv6 sdhci_pci sdhci mmc_core firewire_ohci firewire_core yenta_socket crc_itu_t nouveau ttm drm_kms_helper drm i2c_algo_bit i2c_core video [last unloaded: parport]
Pid: 1336, comm: Xorg Not tainted 2.6.38.3-18.fc15.x86_64 #1 LENOVO 6460D6G/6460D6G
RIP: 0010:[<ffffffffa00e15ba>]  [<ffffffffa00e15ba>] nv50_vm_map_sg+0x29/0x8f [nouveau]
RSP: 0018:ffff880124be3a28  EFLAGS: 00010206
RAX: 0000000000000690 RBX: ffff88008f354480 RCX: 0000000000009b55
RDX: ffff88008f354480 RSI: ffff88012f158c00 RDI: ffff88008f3544a8
RBP: ffff880124be3a68 R08: 0000000000000690 R09: 0000000000000000
R10: 000000000000a1e5 R11: 0000000000020000 R12: 000000000004daa8
R13: ffff88008f3544a8 R14: ffff88012f158c00 R15: 0000000000000690
FS:  00007f481bc248a0(0000) GS:ffff8800bfd00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000000 CR3: 000000012f42a000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process Xorg (pid: 1336, threadinfo ffff880124be2000, task ffff88013000c560)
Stack:
 ffff88012f396500 ffff88012f396500 ffff88012ef80000 ffff88012f396500
 ffff88008f3544a8 0000000000000001 0000000000000000 0000000000000690
 ffff880124be3ad8 ffffffffa00a6482 ffff880124be3ac8 ffffffff00020000
Call Trace:
 [<ffffffffa00a6482>] nouveau_vm_map_sg+0xbe/0xf7 [nouveau]
 [<ffffffffa008dcb6>] nouveau_bo_move_ntfy+0x76/0x82 [nouveau]
 [<ffffffffa00707ab>] ttm_bo_handle_move_mem+0x164/0x299 [ttm]
 [<ffffffffa00714b2>] ttm_bo_move_buffer+0xd4/0x10c [ttm]
 [<ffffffffa00715a0>] ttm_bo_validate+0xb6/0xf4 [ttm]
 [<ffffffffa008e394>] nouveau_bo_validate+0x28/0x48 [nouveau]
 [<ffffffffa0090225>] validate_list+0x129/0x2c9 [nouveau]
 [<ffffffffa0090da2>] nouveau_gem_ioctl_pushbuf+0x638/0xd15 [nouveau]
 [<ffffffffa0023861>] drm_ioctl+0x29e/0x37b [drm]
 [<ffffffff811eb291>] ? inode_has_perm+0x76/0x8c
 [<ffffffffa009076a>] ? nouveau_gem_ioctl_pushbuf+0x0/0xd15 [nouveau]
 [<ffffffff811eb34b>] ? file_has_perm+0xa4/0xc6
 [<ffffffff8112f55c>] do_vfs_ioctl+0x47e/0x4bf
 [<ffffffff8112f5f3>] sys_ioctl+0x56/0x7b
 [<ffffffff81009bc2>] system_call_fastpath+0x16/0x1b
Code: 5d c3 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 0f 1f 44 00 00 49 89 fd 49 89 f6 48 89 d3 44 8d 24 cd 00 00 00 00 eb 52 
RIP  [<ffffffffa00e15ba>] nv50_vm_map_sg+0x29/0x8f [nouveau]
 RSP <ffff880124be3a28>
CR2: 0000000000000000

Got the same trace with kernel 2.6.39-0.rc7.git3.0.fc16.x86_64.

It seems to happen at least when opening large .jpgs in Firefox.

I think I've get a pretty good reproducer. Opening this attachment https://bugzilla.redhat.com/attachment.cgi?id=498868 with eog does it. The first time it does open normally, but then when opening again after having closed the first eog instance immediately crashes the kernel.

Ironically, what I see then is pretty close to that picture :-)

I can confirm that opening https://bugzilla.redhat.com/attachment.cgi?id=498868 in EoG crashes systems afflicted by this bug. But my system crashed the first time the image was opened.

*** Bug 704662 has been marked as a duplicate of this bug. ***

Thanks for the bug report.  We have reviewed the information you have provided above, and there is some additional information we require that will be helpful in our diagnosis of this issue.

Please add drm.debug=0x04 to the kernel command line, restart computer, and attach

* your X server config file (/etc/X11/xorg.conf, if available),
* X server log file (/var/log/Xorg.*.log)
* output of the dmesg command, and
* system log (/var/log/messages)

to the bug report as individual uncompressed file attachments using the bugzilla file attachment link above.

We will review this issue again once you've had a chance to attach this information.

Thanks in advance.

*** Bug 713834 has been marked as a duplicate of this bug. ***

Created attachment 505682 [details]
dmesg with kernel debug=0x04 on

Created attachment 505684 [details]
Xorg.log with kernel running debug=0x04

Created attachment 505685 [details]
messages with kernel running debug=0x04

Was this the information you were looking for?

(In reply to comment #4)
> I can confirm that opening https://bugzilla.redhat.com/attachment.cgi?id=498868
> in EoG crashes systems afflicted by this bug. But my system crashed the first
> time the image was opened.

I can also confirm that opening https://bugzilla.redhat.com/attachment.cgi?id=498868 crashes my system. My system crashes at first opening attempt.

Snippets from lshw:
    description: Notebook
    product: 7665WB2 ()
    vendor: LENOVO
    version: ThinkPad T61
    serial: L3Y4114
    width: 64 bits
    capabilities: smbios-2.4 dmi-2.4 vsyscall64 vsyscall32
    configuration: administrator_password=disabled boot=normal chassis=notebook family=ThinkPad T61 frontpanel_password=unknown keyboard_password=disabled power-on_password=enabled uuid=EB348181-4A35-11CB-BC5F-AF0112DD049C
*-display
description: VGA compatible controller
product: G84M [Quadro NVS 140M]
vendor: nVidia Corporation
physical id: 0
bus info: pci@0000:01:00.0
version: a1
width: 64 bits
clock: 33MHz
capabilities: pm msi pciexpress vga_controller bus_master cap_list rom
configuration: driver=nouveau latency=0
resources: irq:16 memory:d2000000-d2ffffff memory:e0000000-efffffff memory:d0000000-d1ffffff ioport:2000(size=128)

Versions:
kernel-2.6.38.8-35.fc15.x86_64
xorg-x11-drv-nouveau-0.0.16-24.20110324git8378443.fc15.x86_64
xorg-x11-server-Xorg-1.10.3-1.fc15.x86_64
mesa-dri-drivers-7.11-0.16.20110709.0.fc15.x86_64

It seems I can't reproduce this anymore using kernel 3.0 and the latest nouveau bits from http://cgit.freedesktop.org/nouveau/linux-2.6

Created attachment 519092 [details]
clutter program that reliably triggers this bug

I'm attaching a short clutter program that I've found will reliably trigger this bug and crash/hang the kernel.

(In reply to comment #14)
> Created attachment 519092 [details]
> clutter program that reliably triggers this bug
> 
> I'm attaching a short clutter program that I've found will reliably trigger
> this bug and crash/hang the kernel.

Can I have the exact versions of clutter, xorg-x11-drv-nouveau, mesa-dri-drivers and kernel where you can reproduce this?  I just gave it a go and can't make it crash anything.

Does this example still case issues with 3.0 / upstream nouveau bits?

Just fixing metadata, we are still waiting on reply to the question in the comment 15.

Thank you

I updated to latest fc15 packages. Still on fc15 nouveau.
I can't make the clutter program crash the machine.

Anyhow, I have experienced the problem twice today. It looks like the problem is more seldom, but again it can still appear.
I can't reproduce the error with https://bugzilla.redhat.com/attachment.cgi?id=498868 any more.

Packages:
xorg-x11-drv-nouveau-0.0.16-24.20110324git8378443.fc15.x86_64
kernel-2.6.40.3-0.fc15.x86_64
mesa-dri-llvmcore-7.11-0.16.20110709.0.fc15.x86_64
mesa-dri-filesystem-7.11-1.fc15.x86_64
mesa-dri-drivers-7.11-1.fc15.x86_64

I ended up talking with Ben on IRC and he was finally able to reproduce this and did 2 patches which he submitted for upstream review[1]. I've been using these patches and the problem seems indeed fixed.

[1] http://lists.freedesktop.org/archives/dri-devel/2011-August/013789.html

*** Bug 708238 has been marked as a duplicate of this bug. ***

Can you enlighten me on how to compile the needed bits including the new patches? Can I keep my fc15 kernel?

(In reply to comment #20)
> Can you enlighten me on how to compile the needed bits including the new
> patches? Can I keep my fc15 kernel?

Assuming the patches get the OK from a couple of other upstream developers too, I'll get them into F15 ASAP.

is that patch included in new kernel-2.6.40.3-0.fc15.x86_64?

(In reply to comment #22)
> is that patch included in new kernel-2.6.40.3-0.fc15.x86_64?

No. When it's there I'm sure this bug will be updated.

do you have an idea when that will be done? a few hours, few days?

happens for me as well, kernel 2.6.40.4-5.fc15.x86_64

(In reply to comment #25)
> happens for me as well, kernel 2.6.40.4-5.fc15.x86_64

I'm not sure this'd be the same bug, that kernel should have the fix.  Can you post me a backtrace?

Hi Ben,

that's sadly all I have. No backtrace available (kernel did crashed hard):

BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: [<ffffffffa00e5fde>] nv50_vm_map_sg+0x29/0x8f [nouveau]
PGD 13228d067 PUD 131872067 PMD 0
Oops: 0000 [#1] SMP
CPU 0
Modules linked in: nfs lockd fscache auth_rpcgss nfs_acl tcp_lp fuse ip6table_filter ip6_tables ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack xt_CHECKSUM iptable_mangle bridge stp llc sunrpc cpufreq_ondemand acpi_cpufreq mperf rfcomm bnep sha256_generic dm_crypt snd_hda_codec_analog btusb bluetooth snd_hda_intel snd_hda_codec r852 sm_common nand snd_hwdep snd_seq snd_seq_device arc4 snd_pcm nand_ids iwl3945 iwl_legacy virtio_net thinkpad_acpi kvm_intel i2c_i801 snd_timer nand_ecc mtd r592 memstick ppdev kvm e1000e mac80211 snd_page_alloc snd soundcore iTCO_wdt parport_pc iTCO_vendor_support parport microcode cfg80211 rfkill joydev ipv6 sdhci_pci sdhci mmc_core firewire_ohci firewire_core crc_itu_t yenta_socket nouveau ttm drm_kms_helper drm i2c_algo_bit i2c_core mxm_wmi wmi video [last unloaded: scsi_wait_scan]
Sep 13 15:16:27 halden kernel: [10929.478884]
Pid: 1664, comm: Xorg Not tainted 2.6.40.4-5.fc15.x86_64 #1 LENOVO 6457VF4/6457VF4
RIP: 0010:[<ffffffffa00e5fde>]  [<ffffffffa00e5fde>] nv50_vm_map_sg+0x29/0x8f [nouveau]
RSP: 0018:ffff880132303a28  EFLAGS: 00010206
RAX: 0000000000000ff0 RBX: ffff8800bb1a86c0 RCX: 0000000000007e7c
RDX: ffff8800bb1a86c0 RSI: ffff880131633ea0 RDI: ffff8800bb1a86e8
RBP: ffff880132303a68 R08: 0000000000000ff0 R09: 0000000000000000
R10: 0000000000008e6c R11: 0000000000020000 R12: 000000000003f3e0
R13: ffff8800bb1a86e8 R14: ffff880131633ea0 R15: 0000000000000ff0
FS:  00007f5b121758a0(0000) GS:ffff88013bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  
CR2: 0000000000000000 CR3: 00000001311e7000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fff

Are you *positive* that you have actually booted that kernel?  This problem should be fixed there..

Yes, the machine was booted with kernel "2.6.40.4-5.fc15.x86_64".
Just see in the dump above - it's printed inside there and I just copy&pasted the output out of the /var/log/messages file.

The crash happened when I had a huge rdesktop window opened (twice the size of my screen) which I then moved around...

hi

I have the same problem with 

2.6.40.4-5.fc15.x86_64

Sep 27 09:40:00 jostra kernel: [10847.420008] Process X (pid: 1301, threadinfo ffff880123422000, task ffff8801355dae60)
Sep 27 09:40:00 jostra kernel: [10847.420008] Stack:
Sep 27 09:40:00 jostra kernel: [10847.420008]  ffff880134bfaa80 ffff880134280000 0000000000002000 ffff880134bfaa80
Sep 27 09:40:00 jostra kernel: [10847.420008]  ffff8800a14d3868 0000000000000001 0000000000000000 0000000000000050
Sep 27 09:40:00 jostra kernel: [10847.420008]  ffff880123423ad8 ffffffffa00a8406 ffff880123423ac8 ffffffff00020000
Sep 27 09:40:00 jostra kernel: [10847.420008] Call Trace:
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffffa00a8406>] nouveau_vm_map_sg+0xc1/0xfd [nouveau]
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffffa008f8ae>] nouveau_bo_move_ntfy+0x76/0x82 [nouveau]
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffffa007481a>] ttm_bo_handle_move_mem+0x160/0x295 [ttm]
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffffa0075521>] ttm_bo_move_buffer+0xd4/0x10c [ttm]
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffffa007560f>] ttm_bo_validate+0xb6/0xf4 [ttm]
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffffa008ff8c>] nouveau_bo_validate+0x28/0x48 [nouveau]
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffffa0091db8>] validate_list+0x129/0x2bf [nouveau]
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffffa0092994>] nouveau_gem_ioctl_pushbuf+0x638/0xd15 [nouveau]
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffffa0091219>] ? __nouveau_fence_unref+0x26/0x31 [nouveau]
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffffa00287f7>] drm_ioctl+0x29e/0x37b [drm]
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffffa009235c>] ? nouveau_gem_ioctl_new+0x18d/0x18d [nouveau]
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffff81134f0a>] do_vfs_ioctl+0x460/0x4a1
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffff81126a9a>] ? fsnotify_access+0x5f/0x67
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffff81134fa1>] sys_ioctl+0x56/0x79
Sep 27 09:40:00 jostra kernel: [10847.420008]  [<ffffffff8148e842>] system_call_fastpath+0x16/0x1b
Sep 27 09:40:00 jostra kernel: [10847.420008] Code: 5d c3 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 66 66 66 66 90 49 89 fd 49 89 f6 48 89 d3 44 8d 24 cd 00 00 00 00 eb 52
Sep 27 09:40:00 jostra kernel: [10847.420008] RIP  [<ffffffffa00e5fde>] nv50_vm_map_sg+0x29/0x8f [nouveau]
Sep 27 09:40:00 jostra kernel: [10847.420008]  RSP <ffff880123423a28>
Sep 27 09:40:00 jostra kernel: [10847.420008] CR2: 0000000000000000



i was just using firefox and okular.


br jost

hi

how can I upload files?

br jost

Created attachment 525049 [details]
Xorg log

I'm using that parameters in grub drm.debug=14 log_buf_len=16M

Created attachment 525052 [details]
messages

it all started at Sep 27 09:39:40

Created attachment 525054 [details]
dmesge from running kernel

where have f15 old dmesg?

it's happen again. This is really bad situation.

but it's look different now:

Sep 27 14:51:32 jostra kernel: [18629.700141] [TTM] Failed to find memory space for buffer 0xffff8800530d0000 eviction.
Sep 27 14:51:32 jostra kernel: [18629.700146] [TTM] No space for ffff8800530d0000 (1088 pages, 4352K, 4M)
Sep 27 14:51:32 jostra kernel: [18629.700149] [TTM]   placement[0]=0x00070002 (1)
Sep 27 14:51:32 jostra kernel: [18629.700151] [TTM]     has_type: 1
Sep 27 14:51:32 jostra kernel: [18629.700153] [TTM]     use_type: 1
Sep 27 14:51:32 jostra kernel: [18629.700155] [TTM]     flags: 0x0000000A
Sep 27 14:51:32 jostra kernel: [18629.700157] [TTM]     gpu_offset: 0x00000000
Sep 27 14:51:32 jostra kernel: [18629.700160] [TTM]     size: 131072
Sep 27 14:51:32 jostra kernel: [18629.700162] [TTM]     available_caching: 0x00070000
Sep 27 14:51:32 jostra kernel: [18629.700164] [TTM]     default_caching: 0x00010000
Sep 27 14:51:32 jostra kernel: [18629.700483] [TTM] Failed to find memory space for buffer 0xffff88001ffd3800 eviction.
Sep 27 14:51:32 jostra kernel: [18629.700487] [TTM] No space for ffff88001ffd3800 (1088 pages, 4352K, 4M)
Sep 27 14:51:32 jostra kernel: [18629.700490] [TTM]   placement[0]=0x00070002 (1)
Sep 27 14:51:32 jostra kernel: [18629.700492] [TTM]     has_type: 1
Sep 27 14:51:32 jostra kernel: [18629.700494] [TTM]     use_type: 1
Sep 27 14:51:32 jostra kernel: [18629.700496] [TTM]     flags: 0x0000000ASep 27 14:52:57 jostra kernel: imklog 5.8.5, log source = /proc/kmsg started.

Unfortunately the nv50_vm_map_sg+0x29/0x8f [nouveau] still appear.

Sep 28 16:11:35 myfedora kernel: [22620.663372] Pid: 1345, comm: X Not tainted 2.6.40.4-5.fc15.x86_64 #1 LENOVO 7665WB2/7665WB2
Sep 28 16:11:35 myfedora kernel: [22620.663390] RIP: 0010:[<ffffffffa00e5fde>]  [<ffffffffa00e5fde>] nv50_vm_map_sg+0x29/0x8f [nouveau]

I can reproduce by downloading: 
http://www.redhat.com/promo/summit/2010/presentations/summit/decoding-the-code/wed/cshabazi-530-more/MORE-Kickstart-Tips-and-Tricks.pdf 
and browse the document with okular (page up / page down 20-30 times). It can take a while, but the kernel panic is appearing.

kernel-2.6.40.4-5.fc15.x86_64
xorg-x11-drv-nouveau-0.0.16-24.20110324git8378443.fc15.x86_64
mesa-dri-llvmcore-7.11-0.16.20110709.0.fc15.x86_64
mesa-dri-filesystem-7.11-1.fc15.x86_64
mesa-dri-drivers-7.11-1.fc15.x86_64

Hi,
just one remark maybe got nothing to do with bug, but in my situation and in comment 36 was involved okular for reading pdf. Can Pebo tray opening that pdf in link comment 36 with any other pdf reader like xpdf or evince.

no comment

Oct  3 10:14:41 jostra kernel: [ 4498.584831] [drm] nouveau 0000:01:00.0: fail ttm_validate
Oct  3 10:14:41 jostra kernel: [ 4498.584834] [drm] nouveau 0000:01:00.0: validate vram_list
Oct  3 10:14:41 jostra kernel: [ 4498.584839] [drm] nouveau 0000:01:00.0: validate: -12
Oct  3 10:14:41 jostra kernel: [ 4498.584906] [TTM] Failed to find memory space for buffer 0xffff880073968c00 eviction.
Oct  3 10:14:41 jostra kernel: [ 4498.584909] [TTM] No space for ffff880073968c00 (1280 pages, 5120K, 5M)
Oct  3 10:14:41 jostra kernel: [ 4498.584913] [TTM]   placement[0]=0x00070002 (1)
Oct  3 10:14:41 jostra kernel: [ 4498.584915] [TTM]     has_type: 1
Oct  3 10:14:41 jostra kernel: [ 4498.584917] [TTM]     use_type: 1
Oct  3 10:14:41 jostra kernel: [ 4498.584919] [TTM]     flags: 0x0000000A
Oct  3 10:14:41 jostra kernel: [ 4498.584921] [TTM]     gpu_offset: 0x00000000
Oct  3 10:14:41 jostra kernel: [ 4498.584923] [TTM]     size: 131072
Oct  3 10:14:41 jostra kernel: [ 4498.584925] [TTM]     available_caching: 0x00070000
Oct  3 10:14:41 jostra kernel: [ 4498.584928] [TTM]     default_caching: 0x00010000
Oct  3 10:14:41 jostra kernel: [ 4498.584954] BUG: unable to handle kernel NULL pointer dereference at           (null)
Oct  3 10:14:41 jostra kernel: [ 4498.585007] IP: [<ffffffffa00e5fde>] nv50_vm_map_sg+0x29/0x8f [nouveau]
Oct  3 10:14:41 jostra kernel: [ 4498.585007] PGD 1365f4067 PUD 1340dd067 PMD 0 
Oct  3 10:14:41 jostra kernel: [ 4498.585007] Oops: 0000 [#1] SMP 
Oct  3 10:14:41 jostra kernel: [ 4498.585007] CPU 0 
Oct  3 10:14:41 jostra kernel: [ 4498.585007] Modules linked in: fuse ppdev parport_pc lp parport vboxnetadp vboxnetflt vboxdrv sunrpc cpufreq_ondemand acpi_cpufreq mperf rfcomm ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables nf_conntrack_ipv4 bnep nf_defrag_ipv4 xt_state nf_conntrack snd_hda_codec_analog btusb bluetooth arc4 snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device r592 iwl4965 microcode memstick iwl_legacy mac80211 snd_pcm r852 sm_common nand nand_ids nand_ecc mtd i2c_i801 iTCO_wdt cfg80211 joydev e1000e iTCO_vendor_support snd_timer snd_page_alloc thinkpad_acpi rfkill snd soundcore ipv6 sdhci_pci sdhci mmc_core firewire_ohci firewire_core crc_itu_t yenta_socket nouveau ttm drm_kms_helper drm i2c_algo_bit i2c_core mxm_wmi wmi video [last unloaded: scsi_wait_scan]
Oct  3 10:14:41 jostra kernel: [ 4498.585007] 
Oct  3 10:14:41 jostra kernel: [ 4498.585007] Pid: 1455, comm: X Not tainted 2.6.40.4-5.fc15.x86_64 #1 LENOVO 8918DEG/8918DEG
Oct  3 10:14:41 jostra kernel: [ 4498.585007] RIP: 0010:[<ffffffffa00e5fde>]  [<ffffffffa00e5fde>] nv50_vm_map_sg+0x29/0x8f [nouveau]
Oct  3 10:14:41 jostra kernel: [ 4498.585007] RSP: 0018:ffff8801353e9a28  EFLAGS: 00010202
Oct  3 10:14:41 jostra kernel: [ 4498.585007] RAX: 0000000000000001 RBX: ffff8800543b9a80 RCX: 000000000000ce6e
Oct  3 10:14:41 jostra kernel: [ 4498.585007] RDX: ffff8800543b9a80 RSI: ffff88013459acc0 RDI: ffff880123cf4210
Oct  3 10:14:41 jostra kernel: [ 4498.585007] RBP: ffff8801353e9a68 R08: 0000000000000001 R09: 0000000000000000
Oct  3 10:14:41 jostra kernel: [ 4498.585007] R10: 000000000000ce6f R11: 0000000000020000 R12: 0000000000067370
Oct  3 10:14:41 jostra kernel: [ 4498.585007] R13: ffff880123cf4210 R14: ffff88013459acc0 R15: 0000000000000001
Oct  3 10:14:41 jostra kernel: [ 4498.585007] FS:  00007f870d5f08a0(0000) GS:ffff88013ec00000(0000) knlGS:0000000000000000
Oct  3 10:14:41 jostra kernel: [ 4498.585007] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Oct  3 10:14:41 jostra kernel: [ 4498.585007] CR2: 0000000000000000 CR3: 0000000123064000 CR4: 00000000000026f0
Oct  3 10:14:41 jostra kernel: [ 4498.585007] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Oct  3 10:14:41 jostra kernel: [ 4498.585007] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Oct  3 10:14:41 jostra kernel: [ 4498.585007] Process X (pid: 1455, threadinfo ffff8801353e8000, task ffff880123074590)
Oct  3 10:14:41 jostra kernel: [ 4498.585007] Stack:
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  00000000000080d0 ffffffffa008b263 ffff8801353e9a88 ffff8801344acc00
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  ffff880123cf4210 0000000000000001 0000000000000000 0000000000000001
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  ffff8801353e9ad8 ffffffffa00a8406 ffff8801344acc00 0000000000020000
Oct  3 10:14:41 jostra kernel: [ 4498.585007] Call Trace:
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffffa008b263>] ? nouveau_gart_manager_new+0x5a/0xd3 [nouveau]
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffffa00a8406>] nouveau_vm_map_sg+0xc1/0xfd [nouveau]
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffffa008f8ae>] nouveau_bo_move_ntfy+0x76/0x82 [nouveau]
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffffa007481a>] ttm_bo_handle_move_mem+0x160/0x295 [ttm]
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffffa0075521>] ttm_bo_move_buffer+0xd4/0x10c [ttm]
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffff81055f60>] ? vprintk+0x3a2/0x3e4
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffffa007560f>] ttm_bo_validate+0xb6/0xf4 [ttm]
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffffa008ff8c>] nouveau_bo_validate+0x28/0x48 [nouveau]
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffffa0091db8>] validate_list+0x129/0x2bf [nouveau]
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffffa0092994>] nouveau_gem_ioctl_pushbuf+0x638/0xd15 [nouveau]
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffffa0091219>] ? __nouveau_fence_unref+0x26/0x31 [nouveau]
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffffa00287f7>] drm_ioctl+0x29e/0x37b [drm]
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffffa009235c>] ? nouveau_gem_ioctl_new+0x18d/0x18d [nouveau]
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffff8101013e>] ? __switch_to_xtra+0x13b/0x164
Oct  3 10:14:41 jostra kernel: [ 4498.585007]  [<ffffffff81042cb3>] ? set_next_entity+0x45/0x97
Oct  3 10:14:41 jostra kernel: [ 4498.645446]  [<ffffffff81134f0a>] do_vfs_ioctl+0x460/0x4a1
Oct  3 10:14:41 jostra kernel: [ 4498.645446]  [<ffffffff8104522f>] ? finish_task_switch+0x49/0xb7
Oct  3 10:14:41 jostra kernel: [ 4498.645446]  [<ffffffff81134fa1>] sys_ioctl+0x56/0x79
Oct  3 10:14:41 jostra kernel: [ 4498.645446]  [<ffffffff8148e842>] system_call_fastpath+0x16/0x1b
Oct  3 10:14:41 jostra kernel: [ 4498.645446] Code: 5d c3 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 66 66 66 66 90 49 89 fd 49 89 f6 48 89 d3 44 8d 24 cd 00 00 00 00 eb 52 
Oct  3 10:14:41 jostra kernel: [ 4498.645446] RIP  [<ffffffffa00e5fde>] nv50_vm_map_sg+0x29/0x8f [nouveau]
Oct  3 10:14:41 jostra kernel: [ 4498.645446]  RSP <ffff8801353e9a28>
Oct  3 10:14:41 jostra kernel: [ 4498.645446] CR2: 0000000000000000
Oct  3 10:14:41 jostra kernel: [ 4498.695399] ---[ end trace 65371c021e17755d ]---
Oct  3 10:16:52 jostra kernel: imklog 5.8.5, log source = /proc/kmsg started.
Oct  3 10:16:52 jostra rsyslogd: [origin software="rsyslogd" swVersion="5.8.5" x-pid="957" x-info="http://www.rsyslog.com"] start
Oct  3 10:16:52 jostra kernel: [    0.000000] Initializing cgroup subsys cpuset
Oct  3 10:16:52 jostra kernel: [    0.000000] Initializing cgroup subsys cpu
Oct  3 10:16:52 jostra kernel: [    0.000000] Linux version 2.6.40.4-5.fc15.x86_64 (mockbuild.fedoraproject.org) (gcc version 4.6.0 20110603 (Red Hat 4.6.0-10) (GCC) ) #1 SMP Tue Aug 30 14:38:32 UTC 2011

Same problem with evince

Oct  3 14:57:27 myfedora kernel: [  463.725155] BUG: unable to handle kernel NULL pointer dereference at           (null)
Oct  3 14:57:27 myfedora kernel: [  463.725188] IP: [<ffffffffa00e5fde>] nv50_vm_map_sg+0x29/0x8f [nouveau]
Oct  3 14:57:27 myfedora kernel: [  463.725243] PGD 130d5b067 PUD 1316b4067 PMD 0 
Oct  3 14:57:27 myfedora kernel: [  463.725259] Oops: 0000 [#1] SMP 
Oct  3 14:57:27 myfedora kernel: [  463.725272] CPU 1 
Oct  3 14:57:27 myfedora kernel: [  463.725277] Modules linked in: tcp_lp fuse ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat xt_CHECKSUM iptable_mangle bridge stp llc sunrpc cpufreq_ondemand acpi_cpufreq mperf ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 rfcomm xt_state nf_conntrack ip6table_filter ip6_tables bnep snd_hda_codec_analog arc4 ppdev r852 sm_common nand nand_ids nand_ecc r592 mtd memstick iwl4965 iwl_legacy snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device mac80211 thinkpad_acpi snd_pcm microcode btusb cfg80211 uvcvideo bluetooth parport_pc snd_timer parport e1000e snd videodev media soundcore rfkill v4l2_compat_ioctl32 snd_page_alloc joydev i2c_i801 iTCO_wdt iTCO_vendor_support virtio_net kvm_intel kvm ipv6 sdhci_pci sdhci mmc_core firewire_ohci firewire_core yenta_socket crc_itu_t nouveau ttm drm_kms_helper drm i2c_algo_bit i2c_core mxm_wmi wmi video [last unloaded: scsi_wait_scan]
Oct  3 14:57:27 myfedora kernel: [  463.726018] 
Oct  3 14:57:27 myfedora kernel: [  463.726018] Pid: 1338, comm: X Not tainted 2.6.40.4-5.fc15.x86_64 #1 LENOVO 7665WB2/7665WB2
Oct  3 14:57:27 myfedora kernel: [  463.726018] RIP: 0010:[<ffffffffa00e5fde>]  [<ffffffffa00e5fde>] nv50_vm_map_sg+0x29/0x8f [nouveau]
Oct  3 14:57:27 myfedora kernel: [  463.726018] RSP: 0018:ffff88011a649a28  EFLAGS: 00010202
Oct  3 14:57:27 myfedora kernel: [  463.726018] RAX: 0000000000002d10 RBX: ffff880094587300 RCX: 000000000000de20
Oct  3 14:57:27 myfedora kernel: [  463.726018] RDX: ffff880094587300 RSI: ffff8801315814e0 RDI: ffff880094587328
Oct  3 14:57:27 myfedora kernel: [  463.726018] RBP: ffff88011a649a68 R08: 0000000000002d10 R09: 0000000000000000
Oct  3 14:57:27 myfedora kernel: [  463.726018] R10: 0000000000010b30 R11: 0000000000020000 R12: 000000000006f100
Oct  3 14:57:27 myfedora kernel: [  463.726018] R13: ffff880094587328 R14: ffff8801315814e0 R15: 0000000000002d10
Oct  3 14:57:27 myfedora kernel: [  463.726018] FS:  00007f53da5418a0(0000) GS:ffff88013bd00000(0000) knlGS:0000000000000000

Try as I might (even with the test program above), I can't reproduce this issue.  I'll continue looking, but I'm quite baffled currently.

Are any of you guys able to run for a little while with the latest F16 kernel from koji and see if it still happens there too?  Those kernels are a little closer to upstream nouveau.

It might be interesting to know if the test program (https://bugzilla.redhat.com/attachment.cgi?id=519092) triggers the bug for them.

To test that, you should compile it with

$ cc `pkg-config --libs --cflags clutter-1.0` nouveau-memory-error.c

and the run ./a.out _and_ press return several times.

Have been running on rawhide kernel all day. No crashes. First time in months i have been working for a whole day without a kernel panic.

kernel-3.1.0-0.rc8.git0.0.fc17.x86_64

Only pain with this rawhide kernel is the keyboard is sticky, and the mouse is reacting slowly. The GUI updates are slow as well.

I was using 2.6.40.6-0.fc15.x86_64 and get the same crash and also test comment 41 and nothing happens.

This message is a notice that Fedora 15 is now at end of life. Fedora
has stopped maintaining and issuing updates for Fedora 15. It is
Fedora's policy to close all bug reports from releases that are no
longer maintained. At this time, all open bugs with a Fedora 'version'
of '15' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that
we were unable to fix it before Fedora 15 reached end of life. If you
would still like to see this bug fixed and are able to reproduce it
against a later version of Fedora, you are encouraged to click on
"Clone This Bug" (top right of this page) and open it against that
version of Fedora.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

The process we are following is described here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping