Nouveau - Feb 2018 - [Bug 105174] New: [regression] BUG unable to handle kernel NULL pointer dereference in kernel 4.15.3

https://bugs.freedesktop.org/show_bug.cgi?id=105174

            Bug ID: 105174
           Summary: [regression] BUG unable to handle kernel NULL pointer
                    dereference in kernel 4.15.3
           Product: xorg
           Version: unspecified
          Hardware: x86-64 (AMD64)
                OS: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Driver/nouveau
          Assignee: nouveau at lists.freedesktop.org
          Reporter: dominik at greysector.net
        QA Contact: xorg-team at lists.x.org

Created attachment 137463
  --> https://bugs.freedesktop.org/attachment.cgi?id=137463&action=edit
full dmesg

After updating to Fedora kernel 4.15.3-300.fc27.x86_64, I got:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
IP: nouveau_mem_host+0x47/0x1b0 [nouveau]

Full dmesg attached. The hardware is Dell XPS 15 with Intel and nVidia GPU in
Optimus configuration.

Note: this looks different from bug 105173.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180220/3cf9f42a/attachment-0001.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #1 from Dominik 'Rathann' Mierzejewski <dominik at
greysector.net> ---
After logging in I get no output on the second screen attached to HDMI port and
the Xorg session doesn't start fully. I can only see the wallpaper on the
built-in display. Mouse cursor moves, but doesn't respond to clicks. Machine
remains accessible via ssh. There are no errors or warnings in Xorg log.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180220/344d52ee/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #2 from Dominik 'Rathann' Mierzejewski <dominik at
greysector.net> ---
4.14.18-300.fc27.x86_64 is the last working Fedora kernel.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180220/5156d223/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

Pierre Moreau <pierre.morrow at free.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[regression] BUG unable to  |[GF108][Regression] Unable
                   |handle kernel NULL pointer  |to handle NULL pointer
                   |dereference in kernel       |dereference in
                   |4.15.3                      |nouveau_mem_host since
                   |                            |kernel 4.15.3
             Status|NEW                         |NEEDINFO

--- Comment #3 from Pierre Moreau <pierre.morrow at free.fr> ---
Thank you for the bug report.
Is this easily reproducible (and if yes, how)? Otherwise, what were you doing
when this happened?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180220/35696432/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #4 from Dominik 'Rathann' Mierzejewski <dominik at
greysector.net> ---
It happens on every login. My user display configuration is such that it
switches the HDMI output on and internal LCD off, while the login screen
(lightdm) uses the internal LCD only. Immediately after logging in, I get the
display freeze when it tries to drive the HDMI output. The mouse cursor is
still moving.

Apparently the nternal LCD is driven by i915 directly while the HDMI output
goes via nouveau.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180220/e6d0965e/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #5 from Philip Raets <philip.raets at telenet.be> ---
Created attachment 137532
  --> https://bugs.freedesktop.org/attachment.cgi?id=137532&action=edit
Log from journalctl

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180222/014340bb/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #6 from Philip Raets <philip.raets at telenet.be> ---
I have the same error in the kernel with the nouveau driver on openSUSE
Tumbleweed (kernel 4.15.3 and 4.15.4). This is on a desktop (Dell Optiplex 790
with an NVIDIA GT218 (NVS300) dual display)

They seem to happen at random in my system. I can't pinpoint an action when
this occurs. 

Attached the logs from journalctl

My bugreport on openSUSE:
https://bugzilla.opensuse.org/show_bug.cgi?id=1082308

Greetings,

Philip

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180222/7070c995/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

Philip Raets <philip.raets at telenet.be> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://bugzilla.opensuse.o
                   |                            |rg/show_bug.cgi?id=1082308

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180222/5722fa4e/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

D. Hugh Redelmeier <hugh at mimosa.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEEDINFO                    |NEW

--- Comment #7 from D. Hugh Redelmeier <hugh at mimosa.com> ---
I got here by googling for "IP: nouveau_mem_host+0x47/0x1b0
[nouveau]".  This
leads me to think that my problem is (partly) this problem.

As I type this (using a different computer) my screen is hung.  But my computer
is working.

The machine is running Fedora 27 with all updates (except the latest
proprietary nvidia driver, which fails).  The kernel is 4.15.4-300.fc27.x86_64

I'm intending that the nouveau driver be suppressed in favour of the nvidia
driver.  Historically (i.e. for about 3 years) nouveau didn't work on this
setup (GTX 650 driving a Seiki UltraHD monitor at 30Hz).

For some reason, nouveau is running and the nvidia driver is not.  Even though
I have these kernel parameters:
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau nvidia-drm.modeset=1

In any case, nouveau is now running, and I can log in, but when I start firefox
(with a LOT of tabs), nouveau dereferences a NULL and the screen freezes (but
not the mouse).

I seem to remember that when I tried nouveau in the past, it would hang in a
similar way.  My hypothesis (untested) was that my large number of firefox tabs
would exhaust some nouveau resource.  I did not have that problem with the
nvidia proprietary driver.

So I have multiple problems, but one of them is this nouveau bug.  I don't
expect a solution to my other problems to come up in this bz.

I will attach a dmesg.

PS: why is the status NEEDSINFO?  I don't see where there is an outstanding
request for info.  I will try to change the status to NEW.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180224/81944fa1/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

D. Hugh Redelmeier <hugh at mimosa.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hugh at mimosa.com

--- Comment #8 from D. Hugh Redelmeier <hugh at mimosa.com> ---
Created attachment 137583
  --> https://bugs.freedesktop.org/attachment.cgi?id=137583&action=edit
dmesg from hang on Hugh's system

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180224/24de24c9/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #9 from Pierre Moreau <pierre.morrow at free.fr> ---
Created attachment 137731
  --> https://bugs.freedesktop.org/attachment.cgi?id=137731&action=edit
Proposed patch

Could anyone please try the attached patch (from
https://github.com/skeggsb/nouveau/pull/1)?

(In reply to D. Hugh Redelmeier from comment #7)
> PS: why is the status NEEDSINFO?  I don't see where there is an
outstanding
> request for info.  I will try to change the status to NEW.
Simply because no one changed the status since the information was provided.
:-)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180301/ffc2cfa9/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #10 from Philip Raets <philip.raets at telenet.be> ---
Created attachment 137793
  --> https://bugs.freedesktop.org/attachment.cgi?id=137793&action=edit
Bootlog patched kernel 4.15.7

Hi,

I've tried a patched kernel provided by Takashi Iwai on openSUSE (see
http://bugzilla.opensuse.org/show_bug.cgi?id=1082308 )

But then my system would crash at startup

Included my bootlog with that kernel.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180305/e1ccee6a/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #11 from Dominik 'Rathann' Mierzejewski <dominik at
greysector.net> ---
(In reply to Pierre Moreau from comment #9)
> Created attachment 137731 [details] [review]
> Proposed patch
> 
> Could anyone please try the attached patch (from
> https://github.com/skeggsb/nouveau/pull/1)?
I can confirm that the patch fixes the bug for me when applied to Fedora kernel
(4.15.7-300.fc27 tested this time). Thanks!

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180309/dee1e9e9/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

Gabriel M. Elder <gabriel at tekgnowsys.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |gabriel at tekgnowsys.com

--- Comment #12 from Gabriel M. Elder <gabriel at tekgnowsys.com> ---
See also <a
href=https://bugzilla.redhat.com/show_bug.cgi?id=1551401>https://bugzilla.redhat.com/show_bug.cgi?id=1551401</a>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180313/ab6a6856/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

Gabriel M. Elder <gabriel at tekgnowsys.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://bugzilla.redhat.com
                   |                            |/show_bug.cgi?id=1551401

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180313/8772763d/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #13 from Philip Raets <philip.raets at telenet.be> ---
Created attachment 138127
  --> https://bugs.freedesktop.org/attachment.cgi?id=138127&action=edit
Log from patched opensuse

I've installed a patched kernel for opensuse (details:
https://bugzilla.opensuse.org/show_bug.cgi?id=1082308)

But the problem still occurs when opening JPG's like
https://www.dropbox.com/s/gex21o67q31aytx/PRP_5808.jpg?dl=0

This are JPG's that I exported from Darktable

attached is the error from journalctl

I have to login through ssh with my phone and then I can force a reboot. (the
graphics freeze, only the cursor is working)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180315/7c8bc71f/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

Pierre Moreau <pierre.morrow at free.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #14 from Pierre Moreau <pierre.morrow at free.fr> ---
Fyi, the attached patch has been submitted along fixes to DRM. It doesn’t look
like it has landed yet, but might be part of 4.16-rc6.

(In reply to Philip Raets from comment #13)
> Created attachment 138127 [details]
> Log from patched opensuse
> 
> I've installed a patched kernel for opensuse (details:
> https://bugzilla.opensuse.org/show_bug.cgi?id=1082308)
> 
> But the problem still occurs when opening JPG's like
> https://www.dropbox.com/s/gex21o67q31aytx/PRP_5808.jpg?dl=0
> 
> This are JPG's that I exported from Darktable
> 
> attached is the error from journalctl
> 
> I have to login through ssh with my phone and then I can force a reboot.
> (the graphics freeze, only the cursor is working)
Since the patch works for the bug report author but not for you, I think you
are experiencing another (or an additional) issue. Please open a separate bug
report.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180317/5e85ddbe/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #15 from Pierre Moreau <pierre.morrow at free.fr> ---
And thank you all for your replies and trying out the patch :-)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180317/d37568db/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #16 from Dominik 'Rathann' Mierzejewski <dominik at
greysector.net> ---
(In reply to Pierre Moreau from comment #15)
> And thank you all for your replies and trying out the patch :-)
Thank you for the quick fix!

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180319/ab14312e/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

Philip Raets <philip.raets at telenet.be> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://bugs.freedesktop.or
                   |                            |g/show_bug.cgi?id=105626

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180320/ec759267/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

Sérgio M. Basto <sergio at serjux.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://bugs.freedesktop.or
                   |                            |g/show_bug.cgi?id=105319

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180322/0fa4735f/attachment-0001.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #17 from Stefano Biagiotti <stefano.biagiotti at gtn.it> ---
Created attachment 138305
  --> https://bugs.freedesktop.org/attachment.cgi?id=138305&action=edit
dmesg with kernel-4.15.11-300.fc27

I am on Fedora 27 x86_64 with MATE Desktop Environment.
The fix posted here has been included in the new package
kernel-4.15.11-300.fc27.x86_64.rpm. (Font:
https://bugzilla.redhat.com/show_bug.cgi?id=1547037 )

I installed kernel-4.15.11-300.fc27 from updates-testing repository but it
doesn't resolve.
 $ LANG=en dnf list kernel-4.15.11-300.fc27
 Failed to set locale, defaulting to C
 Last metadata expiration check: 0:00:15 ago on Thu Mar 22 15:50:44 2018.
 Installed Packages
 kernel.x86_64           4.15.11-300.fc27                @updates-testing

Same freeze after login via lightdm.
Dmesg attached.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180323/05eff5a1/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #18 from Stefano Biagiotti <stefano.biagiotti at gtn.it> ---
Created attachment 138354
  --> https://bugs.freedesktop.org/attachment.cgi?id=138354&action=edit
journalctl (kernel-4.15.12-301.fc27.x86_64

Fedora kernel-4.15.12-301.fc27.x86_64 from updates-testing repository still
doesn't resolve.

Display adapter (from lspci) is:
01:00.0 VGA compatible controller: NVIDIA Corporation G98 [GeForce 8400 GS Rev.
2] (rev a1)

Attach is an excerpt from "journalctl -k -b -1 --no-pager
--no-hostname".

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180326/2949c3a8/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

Stefano Biagiotti <stefano.biagiotti at gtn.it> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|FIXED                       |---
             Status|RESOLVED                    |REOPENED

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180326/3f79ed01/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

Pierre Moreau <pierre.morrow at free.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|REOPENED                    |RESOLVED

--- Comment #19 from Pierre Moreau <pierre.morrow at free.fr> ---
(In reply to Stefano Biagiotti from comment #18)
> Created attachment 138354 [details]
> journalctl (kernel-4.15.12-301.fc27.x86_64
> 
> Fedora kernel-4.15.12-301.fc27.x86_64 from updates-testing repository still
> doesn't resolve.
> 
> Display adapter (from lspci) is:
> 01:00.0 VGA compatible controller: NVIDIA Corporation G98 [GeForce 8400 GS
> Rev. 2] (rev a1)
> 
> Attach is an excerpt from "journalctl -k -b -1 --no-pager
--no-hostname".
The patch was reported as working by the person who opened this bug report, so
I am changing this bug report back to fixed. Since it does not seem to be the
case for you (and you are using a GPU from a different family, Tesla vs Fermi),
you should open a different bug report.
There has been other reports of the patch not being enough on another Tesla
card (though on a different chipset): you might want to look at
https://bugs.freedesktop.org/show_bug.cgi?id=105626 and
https://bugs.freedesktop.org/show_bug.cgi?id=105687.

Also, please try to avoid posting excerpts of logs: there can other errors
happening before this NULL pointer dereference, and seeing the different
messages outputed by Nouveau during its initialisation can help shed some light
on what is going wrong; for example, there is a bug report, also on G98, of EVO
timing out since updating to 4.15
(https://bugs.freedesktop.org/show_bug.cgi?id=105319), maybe you are
experiencing that as well?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180326/8c47e639/attachment-0001.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105174

--- Comment #20 from Ilia Mirkin <imirkin at alum.mit.edu> ---
Should fix the nouveau_mem_host issue:

https://github.com/skeggsb/nouveau/commit/bdc36dcf3fe469e6bb2a1366452dcb16b84e8bcf

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180509/f0a34e60/attachment.html>