Bug 108912

Summary: Null PTR deref on amd-staging-drm-next since rebase for rc3
Product: DRI Reporter: Samantha McVey <samantham>
Component: DRM/AMDgpuAssignee: Default DRI bug account <dri-devel>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: medium CC: harry.wentland, nicholas.kazlauskas
Version: XOrg git   
Hardware: Other   
OS: All   
Whiteboard:
i915 platform: i915 features:
Attachments:
Description Flags
dmesg log
none
0001-drm-amd-display-Fix-NULL-ptr-deref-for-commit_planes.patch none

Description Samantha McVey 2018-11-30 04:42:35 UTC
Created attachment 142663 [details]
dmesg log

Since the rebase for rc3 I get a null ptr deref message and the system locks up as soon as KDE starts (after the login screen). This is on commit 2d73921a175ea8430718384ed3891f1710fed2df

nov 29 20:06:37 kernel: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
nov 29 20:06:37 kernel: PGD 0 P4D 0 
nov 29 20:06:37 kernel: Oops: 0000 [#1] PREEMPT SMP NOPTI
nov 29 20:06:37 kernel: CPU: 0 PID: 2291 Comm: X Tainted: G            E     4.20.0-rc3amd-staging-drm-next+ #12
nov 29 20:06:37 kernel: Hardware name: LENOVO 20MUCTO1WW/20MUCTO1WW, BIOS R0WET43W (1.11 ) 11/15/2018
nov 29 20:06:37 kernel: RIP: 0010:amdgpu_dm_atomic_commit_tail+0x339/0xdc0 [amdgpu]
nov 29 20:06:37 kernel: Code: b4 24 90 02 00 00 4d 89 f0 4c 89 e1 89 b2 74 02 00 00 48 8d 70 10 0f b6 50 08 48 8b 44 24 08 48 8b b8 20 b3 00 00 48 8b 04 24 <4c> 8b 48 08 e8 9e f8 ff ff 84 c0 0f 84 3b 08 00 00 41 83 c5 01 45
nov 29 20:06:37 kernel: RSP: 0018:ffffaaf64969bb70 EFLAGS: 00010202
nov 29 20:06:37 kernel: RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff9957f2506400
nov 29 20:06:37 kernel: RDX: 0000000000000001 RSI: ffff995580164040 RDI: ffff9957f2e12800
nov 29 20:06:37 kernel: RBP: ffff9957f34f5800 R08: ffff99557f848400 R09: 0000000000000438
nov 29 20:06:37 kernel: R10: ffff995579179c00 R11: 0000000000000780 R12: ffff9957f2506400
nov 29 20:06:37 kernel: R13: 0000000000000000 R14: ffff99557f848400 R15: ffff99557a144d80
nov 29 20:06:37 kernel: FS:  00007f0a435a9a80(0000) GS:ffff9957fbc00000(0000) knlGS:0000000000000000
nov 29 20:06:37 kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
nov 29 20:06:37 kernel: CR2: 0000000000000008 CR3: 0000000537876000 CR4: 00000000003406f0
nov 29 20:06:37 kernel: Call Trace:
nov 29 20:06:37 kernel:  ? kmem_cache_alloc_trace+0x1d2/0x580
nov 29 20:06:37 kernel:  ? _raw_spin_unlock_irq+0x22/0x40
nov 29 20:06:37 kernel:  ? wait_for_completion_timeout+0xf7/0x110
nov 29 20:06:37 kernel:  ? _raw_spin_unlock_irq+0x22/0x40
nov 29 20:06:37 kernel:  ? wait_for_completion_interruptible+0xd4/0x140
nov 29 20:06:37 kernel:  commit_tail+0x3d/0x70 [drm_kms_helper]
nov 29 20:06:37 kernel:  drm_atomic_helper_commit+0x103/0x110 [drm_kms_helper]
nov 29 20:06:37 kernel:  drm_mode_obj_set_property_ioctl+0x122/0x280 [drm]
nov 29 20:06:37 kernel:  ? drm_connector_set_obj_prop+0x80/0x80 [drm]
nov 29 20:06:37 kernel:  drm_connector_property_set_ioctl+0x29/0x30 [drm]
nov 29 20:06:37 kernel:  drm_ioctl_kernel+0x85/0xd0 [drm]
nov 29 20:06:37 kernel:  drm_ioctl+0x1d6/0x360 [drm]
nov 29 20:06:37 kernel:  ? drm_connector_set_obj_prop+0x80/0x80 [drm]
nov 29 20:06:37 kernel:  ? ep_send_events_proc+0x6b/0x170
nov 29 20:06:37 kernel:  ? preempt_count_sub+0x43/0x50
nov 29 20:06:37 kernel:  amdgpu_drm_ioctl+0x49/0x80 [amdgpu]
nov 29 20:06:37 kernel:  do_vfs_ioctl+0x90/0x5f0
nov 29 20:06:37 kernel:  ? __fget+0x6e/0xa0
nov 29 20:06:37 kernel:  ksys_ioctl+0x60/0x90
nov 29 20:06:37 kernel:  __x64_sys_ioctl+0x16/0x20
nov 29 20:06:37 kernel:  do_syscall_64+0x60/0x110
nov 29 20:06:37 kernel:  entry_SYSCALL_64_after_hwframe+0x49/0xbe
nov 29 20:06:37 kernel: RIP: 0033:0x7f0a4466baa7
nov 29 20:06:37 kernel: Code: 00 00 90 48 8b 05 f1 83 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c1 83 2c 00 f7 d8 64 89 01 48
nov 29 20:06:37 kernel: RSP: 002b:00007ffd3eae39f8 EFLAGS: 00003246 ORIG_RAX: 0000000000000010
nov 29 20:06:37 kernel: RAX: ffffffffffffffda RBX: 00005629892b2690 RCX: 00007f0a4466baa7
nov 29 20:06:37 kernel: RDX: 00007ffd3eae3a30 RSI: 00000000c01064ab RDI: 000000000000000d
nov 29 20:06:37 kernel: RBP: 00007ffd3eae3a30 R08: 00005629892f8ab0 R09: 0000000000000001
nov 29 20:06:37 kernel: R10: 00000000005732d8 R11: 0000000000003246 R12: 00000000c01064ab
nov 29 20:06:37 kernel: R13: 000000000000000d R14: 00007f0a45e85c20 R15: 0000000000000007
nov 29 20:06:37 kernel: Modules linked in: cmac(E) fuse(E) rfcomm(E) ccm(E) af_packet(E) xt_tcpudp(E) ip6t_rpfilter(E) ip6t_REJECT(E) nf_reject_ipv6(E) ipt_REJECT(E) nf_reject_ipv4(E) xt_conntrack(E) ebtable_nat(E) ip6table_nat(E) nf_nat_ipv6(E) ip6table_mangle(E) ip6table_raw(E) ip6table_security(E) iptable_nat(E) nf_nat_ipv4(E) nf_nat(E) iptable_mangle(E) iptable_raw(E) iptable_security(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) ip_set(E) nfnetlink(E) ebtable_filter(E) ebtables(E) ip6table_filter(E) ip6_tables(E) iptable_filter(E) ip_tables(E) x_tables(E) bpfilter(E) bnep(E) xfs(E) btusb(E) uvcvideo(E) btrtl(E) videobuf2_vmalloc(E) btbcm(E) btintel(E) videobuf2_memops(E) videobuf2_v4l2(E) bluetooth(E) videodev(E) videobuf2_common(E) ecdh_generic(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) msr(E) arc4(E) snd_hda_codec_realtek(E) snd_hda_codec_generic(E) snd_hda_codec_hdmi(E) edac_mce_amd(E) iwlmvm(E) snd_hda_intel(E) kvm_amd(E) ccp(E) snd_hda_codec(E) kvm(E) mac80211(E)
nov 29 20:06:37 kernel:  snd_hda_core(E) irqbypass(E) snd_hwdep(E) joydev(E) snd_pcm(E) wmi_bmof(E) sp5100_tco(E) thinkpad_acpi(E) snd_timer(E) k10temp(E) i2c_piix4(E) snd(E) iwlwifi(E) rtsx_pci_ms(E) soundcore(E) battery(E) ac(E) r8169(E) ipmi_devintf(E) memstick(E) ipmi_msghandler(E) cfg80211(E) ucsi_acpi(E) libphy(E) typec_ucsi(E) typec(E) i2c_scmi(E) rfkill(E) button(E) pcc_cpufreq(E) acpi_cpufreq(E) btrfs(E) libcrc32c(E) xor(E) raid6_pq(E) dm_crypt(E) algif_skcipher(E) af_alg(E) hid_multitouch(E) hid_generic(E) usbhid(E) uas(E) usb_storage(E) crct10dif_pclmul(E) crc32_pclmul(E) crc32c_intel(E) ghash_clmulni_intel(E) rtsx_pci_sdmmc(E) mmc_core(E) aesni_intel(E) aes_x86_64(E) crypto_simd(E) cryptd(E) glue_helper(E) amdgpu(E) chash(E) amd_iommu_v2(E) gpu_sched(E) i2c_algo_bit(E) ttm(E) ehci_pci(E) drm_kms_helper(E) syscopyarea(E) sysfillrect(E) xhci_pci(E) sysimgblt(E) fb_sys_fops(E) serio_raw(E) xhci_hcd(E) ehci_hcd(E) drm(E) usbcore(E) rtsx_pci(E) wmi(E) video(E) sg(E) dm_multipath(E) dm_mod(E)
nov 29 20:06:37 kernel:  scsi_dh_rdac(E) scsi_dh_emc(E) scsi_dh_alua(E) efivarfs(E)
nov 29 20:06:37 kernel: CR2: 0000000000000008
nov 29 20:06:37 kernel: ---[ end trace 6d210eaeb18f974a ]---
nov 29 20:06:37 kernel: RIP: 0010:amdgpu_dm_atomic_commit_tail+0x339/0xdc0 [amdgpu]
nov 29 20:06:37 kernel: Code: b4 24 90 02 00 00 4d 89 f0 4c 89 e1 89 b2 74 02 00 00 48 8d 70 10 0f b6 50 08 48 8b 44 24 08 48 8b b8 20 b3 00 00 48 8b 04 24 <4c> 8b 48 08 e8 9e f8 ff ff 84 c0 0f 84 3b 08 00 00 41 83 c5 01 45
nov 29 20:06:37 kernel: RSP: 0018:ffffaaf64969bb70 EFLAGS: 00010202
nov 29 20:06:37 kernel: RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff9957f2506400
nov 29 20:06:37 kernel: RDX: 0000000000000001 RSI: ffff995580164040 RDI: ffff9957f2e12800
nov 29 20:06:37 kernel: RBP: ffff9957f34f5800 R08: ffff99557f848400 R09: 0000000000000438
nov 29 20:06:37 kernel: R10: ffff995579179c00 R11: 0000000000000780 R12: ffff9957f2506400
nov 29 20:06:37 kernel: R13: 0000000000000000 R14: ffff99557f848400 R15: ffff99557a144d80
nov 29 20:06:37 kernel: FS:  00007f0a435a9a80(0000) GS:ffff9957fbc00000(0000) knlGS:0000000000000000
nov 29 20:06:37 kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
nov 29 20:06:37 kernel: CR2: 0000000000000008 CR3: 0000000537876000 CR4: 00000000003406f0
Comment 1 Nicholas Kazlauskas 2018-11-30 15:08:16 UTC
Created attachment 142666 [details] [review]
0001-drm-amd-display-Fix-NULL-ptr-deref-for-commit_planes.patch

Does this resolve the issue?
Comment 2 Samantha McVey 2018-11-30 15:27:27 UTC
Nicholas,

That patch seems to resolve the issue.
Comment 3 Samantha McVey 2018-12-03 22:52:38 UTC
Closing since it's been fixed.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.