Nouveau - Nov 2013 - [Bug 71620] New: nouveau_fence_wait_uevent NULL pointer dereference

https://bugs.freedesktop.org/show_bug.cgi?id=71620

          Priority: medium
            Bug ID: 71620
          Assignee: nouveau at lists.freedesktop.org
           Summary: nouveau_fence_wait_uevent NULL pointer dereference
          Severity: normal
    Classification: Unclassified
                OS: Linux (All)
          Reporter: kdatanasov at gmail.com
          Hardware: x86-64 (AMD64)
            Status: NEW
           Version: unspecified
         Component: Drivers/DRI/nouveau
           Product: Mesa

Created attachment 89234
  --> https://bugs.freedesktop.org/attachment.cgi?id=89234&action=edit
patch_to_protect_fence_channel

Upon normal computer operation user session(GNOME-Shell) sometimes will just
terminate. Problem seems more common if two users are logged in(GNOME-Shell)
for a day.

GPU:
NVIDIA Corporation C77 [GeForce 8300] (rev a2)

kernel version:
3.12.0-upstream

Relevent dmesg output:
[29434.602169] Call Trace:
[29434.602188]  [<ffffffffa010b6db>] ?
nouveau_fence_wait_uevent.isra.1+0x1b/0x3f0 [nouveau]
[29434.602208]  [<ffffffffa010b676>] ? nouveau_fence_update+0x76/0x90
[nouveau]
[29434.602228]  [<ffffffffa010bb36>] nouveau_fence_wait+0x86/0x1a0
[nouveau]
[29434.602248]  [<ffffffffa010d7a5>] nouveau_bo_fence_wait+0x15/0x20
[nouveau]
[29434.602260]  [<ffffffffa00658a1>] ttm_bo_wait+0x91/0x190 [ttm]
[29434.602279]  [<ffffffffa0112e57>] nouveau_gem_ioctl_cpu_prep+0x57/0xe0
[nouveau]
[29434.602294]  [<ffffffffa0010c52>] drm_ioctl+0x502/0x630 [drm]
[29434.602313]  [<ffffffffa0108d11>] nouveau_drm_ioctl+0x51/0x90 [nouveau]
[29434.602324]  [<ffffffff811b3690>] do_vfs_ioctl+0x2e0/0x4c0
[29434.602332]  [<ffffffff811a2e2e>] ? ____fput+0xe/0x10
[29434.602340]  [<ffffffff81080544>] ? task_work_run+0xa4/0xe0
[29434.602347]  [<ffffffff811b38f1>] SyS_ioctl+0x81/0xa0
[29434.602356]  [<ffffffff814f81ad>] system_call_fastpath+0x1a/0x1f
[29434.602364] Code: c3 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41
57 49 89 f7 41 56 41 55 41 54 41 89 d4 53 48 89 fb 48 83 ec 58 48 8b 07
<48> 8b
48 08 48 8b 91 f8 00 00 00 4c 8b b1 b0 07 00 00 48 8b 42 

I'm trying some change(adding it as patch) - no problem so far, but since I
have zero experience in kernel/driver workflow definitely not sure if it's
OK.

Regards, K

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20131114/055b6938/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=71620

--- Comment #1 from Kostadin Atanasov <kdatanasov at gmail.com> ---
Created attachment 89720
  --> https://bugs.freedesktop.org/attachment.cgi?id=89720&action=edit
better-multithreaded-protection-for-cence-channel

After almost 2 weeks running with this patch - the same problem happen. Looking
bit more on nouveau_fence_wait function looks like I miss one place where
multithreaded problem could occur - hence second patch to for it.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20131124/b819dfd5/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=71620

Ilia Mirkin <imirkin at alum.mit.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ua_bugzilla_freedesktop at bin
                   |                            |ary-island.eu

--- Comment #2 from Ilia Mirkin <imirkin at alum.mit.edu> ---
*** Bug 72599 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20131212/439557f4/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=71620

--- Comment #3 from Rapha?l Droz <gibboris at gmail.com> ---
Created attachment 96364
  --> https://bugs.freedesktop.org/attachment.cgi?id=96364&action=edit
stacktrace from kernel oops

same here (with a slightly different stack trace), see attachment
(using 10de:06e4 (GeForce 8400 GS Rev. 2)).

Was simply using fluxbox/firefox after a resumed. It's the first time it
happens, (but I changed a couple of kernel options only 2 days ago).
I will attach the .config diff in case there's something related.

Will try the patch later if I can get the oops frequently enough.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20140325/d27b1972/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=71620

--- Comment #4 from Rapha?l Droz <gibboris at gmail.com> ---
Created attachment 96365
  --> https://bugs.freedesktop.org/attachment.cgi?id=96365&action=edit
.config diff

seems that it never happened with my previous config (used during several
weeks), but happened (once) with the new one (used only 2 days)
[ anyway other software was updated too in the interval ... ]

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20140325/b540c1c4/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=71620

--- Comment #5 from James TD Smith <ahktenzero+freedesktop at mohorovi.cc>
---
Looks like I've run into the same problem. X crashed while I was using
Firefox
and I found the traceback below in my logs. There were no errors in the Xorg
logs so I've omitted those. I'm running Debian 7.5 amd64, kernel 3.13.5,
Xorg
7.7, Nouveau 1.0.10-1+b1. Graphics card is a GF114 [GeForce GTX 560 Ti] (rev
a1).

Jun 27 23:48:46 nyarlathotep kernel: [421145.711394] BUG: unable to handle
kernel NULL pointer dereference at 0000000000000008
Jun 27 23:48:46 nyarlathotep kernel: [421145.711427] IP:
[<ffffffffa0306f0e>]
nouveau_fence_wait_uevent+0x1b/0x2e7 [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.711471] PGD 0 
Jun 27 23:48:46 nyarlathotep kernel: [421145.711477] Oops: 0000 [#1] PREEMPT
SMP 
Jun 27 23:48:46 nyarlathotep kernel: [421145.711490] Modules linked in: cpuid
sha256_generic cbc tcp_diag inet_diag xt_addrtype xt_conntrack ipt_MASQUERADE
iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack
bridge stp llc aufs(C) iptable_filter ip_tables x_tables bnep rfcomm bluetooth
rpcsec_gss_krb5 nfsv4 dns_resolver cpufreq_conservative cpufreq_userspace
cpufreq_powersave cpufreq_stats battery snd_hrtimer vboxpci(O) vboxnetadp(O)
vboxnetflt(O) vboxdrv(O) binfmt_misc uinput fuse nfsd auth_rpcgss oid_registry
nfs_acl nfs lockd fscache sunrpc synaptics_usb ext3 jbd dm_crypt md_mod
firewire_sbp2 loop parport_pc ppdev parport snd_hda_codec_hdmi powermate
snd_hda_codec_analog arc4 hid_generic snd_emu10k1_synth snd_emux_synth
snd_seq_midi_emul joydev snd_seq_virmidi usbhid hid snd_usb_audio
snd_usbmidi_lib xpad ff_memless rtl8187 nfc mac80211 cfg80211 eeprom_93cx6
rfkill snd_emu10k1 snd_seq_midi snd_seq_midi_event snd_hda_intel snd_util_mem
snd_ac97_codec snd_hda_codec snd_hwdep snd_pcm_oss snd_m
Jun 27 23:48:46 nyarlathotep kernel: ixer_oss snd_rawmidi evdev snd_pcm
ac97_bus coretemp snd_page_alloc kvm_intel kvm emu10k1_gp gameport snd_seq
nouveau snd_seq_device video snd_timer serio_raw lpc_ich mxm_wmi mfd_core wmi
pcspkr i2c_algo_bit i2c_i801 ttm drm_kms_helper drm snd asus_atk0110 i2c_core
soundcore acpi_cpufreq processor thermal_sys button ext4 crc16 jbd2 mbcache
dm_mirror dm_region_hash dm_log dm_mod sr_mod cdrom sg sd_mod usb_storage r8169
mii firewire_ohci firewire_core crc_itu_t pata_jmicron ahci libahci sky2 libata
scsi_mod xhci_hcd ehci_pci uhci_hcd ehci_hcd usbcore usb_common
Jun 27 23:48:46 nyarlathotep kernel: [421145.711942] CPU: 3 PID: 5115 Comm:
Xorg Tainted: G         C O 3.13.5 #1
Jun 27 23:48:46 nyarlathotep kernel: [421145.711951] Hardware name: System
manufacturer P5K3 Deluxe/P5K3 Deluxe, BIOS 1206    04/16/2009
Jun 27 23:48:46 nyarlathotep kernel: [421145.711969] task: ffff880222f4ef90 ti:
ffff880225014000 task.ti: ffff880225014000
Jun 27 23:48:46 nyarlathotep kernel: [421145.711979] RIP:
0010:[<ffffffffa0306f0e>]  [<ffffffffa0306f0e>]
nouveau_fence_wait_uevent+0x1b/0x2e7 [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] RSP: 0018:ffff880225015c90
 EFLAGS: 00010286
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] RAX: 0000000000000000 RBX:
0000000000000000 RCX: 0000000000000000
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] RDX: ffff88012e55ec80 RSI:
0000000000000001 RDI: ffff88012e55ef00
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] RBP: ffff88012e55ef00 R08:
ffff880225015c90 R09: 000000000000e200
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] R10: 0000000000000000 R11:
0000000000000246 R12: ffff880036478101
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] R13: ffff88003657b601 R14:
ffff88003649bd01 R15: 0000000000000001
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] FS: 
00007f7cc13fa980(0000) GS:ffff88022fd80000(0000) knlGS:0000000000000000
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] CS:  0010 DS: 0000 ES:
0000 CR0: 000000008005003b
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] CR2: 0000000000000008 CR3:
00000000ca894000 CR4: 00000000000407e0
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] Stack:
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  00000000000013fb
0000000080000000 0000000000000000 ffff88012e55ec80
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  0000000000000001
ffff88012e55ef00 0000000000000000 ffff88012e55ef00
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  ffff880036478101
ffff88003657b601 ffff88003649bd80 0000000000000001
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] Call Trace:
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa030721d>]
?
nouveau_fence_wait+0x43/0x128 [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff8138dc4b>]
?
_raw_spin_unlock+0xd/0x1f
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa0306ec2>]
?
nouveau_fence_done+0x48/0x79 [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa022906d>]
?
ttm_bo_wait+0xa2/0x158 [ttm]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa030ba5c>]
?
nouveau_gem_ioctl_cpu_prep+0x49/0x75 [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa030ba13>]
?
nouveau_gem_ioctl_pushbuf+0xbde/0xbde [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa0243fa2>]
?
drm_ioctl+0x27b/0x3ba [drm]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa030ba13>]
?
nouveau_gem_ioctl_pushbuf+0xbde/0xbde [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff81286cef>]
?
rpm_resume+0x49c/0x4ad
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff8138de57>]
?
_raw_spin_lock+0xe/0x17
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff8138dc4b>]
?
_raw_spin_unlock+0xd/0x1f
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa0305b45>]
?
nouveau_drm_ioctl+0x48/0x7c [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff8111c928>]
?
do_vfs_ioctl+0x3f8/0x441
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff811105c5>]
?
__fput+0x176/0x197
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff81125aa1>]
?
mntput_no_expire+0x1a/0x118
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff8104c398>]
?
task_work_run+0x7b/0x8a
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff8111c9bf>]
?
SyS_ioctl+0x4e/0x79
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff813924e6>]
?
system_call_fastpath+0x1a/0x1f
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] Code: 7d 28 00 5a 0f 94 c0
5b 5d 41 5c 41 5d 41 5e c3 41 57 41 56 41 88 f6 41 55 41 54 55 48 89 fd 53 48
83 ec 30 48 8b 47 28 49 89 e0 <48> 8b 48 08 48 8b 91 f0 00 00 00 4c 8b a9
68 07
00 00 48 8b 42 
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] RIP 
[<ffffffffa0306f0e>]
nouveau_fence_wait_uevent+0x1b/0x2e7 [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  RSP
<ffff880225015c90>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20140628/1b241dcc/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=71620

Ilia Mirkin <imirkin at alum.mit.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mattia.b89 at gmail.com

--- Comment #6 from Ilia Mirkin <imirkin at alum.mit.edu> ---
*** Bug 82704 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20140817/2747ba5d/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=71620

Ilia Mirkin <imirkin at alum.mit.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |scott at chaos-dragon.com

--- Comment #7 from Ilia Mirkin <imirkin at alum.mit.edu> ---
*** Bug 82975 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20140822/9ac1f2b3/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=71620

Ilia Mirkin <imirkin at alum.mit.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |reuben.m at gmail.com

--- Comment #8 from Ilia Mirkin <imirkin at alum.mit.edu> ---
*** Bug 84424 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20140928/5821e97a/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=71620

GitLab Migration User <gitlab-migration at fdo.invalid> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |MOVED

--- Comment #9 from GitLab Migration User <gitlab-migration at
fdo.invalid> ---
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been
closed from further activity.

You can subscribe and participate further through the new bug through this link
to our GitLab instance: https://gitlab.freedesktop.org/mesa/mesa/issues/1057.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20190918/b6481879/attachment-0001.html>