Bug 96554

Summary:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000470

Product:

DRI

Reporter:

Kim Lidström <dxtr>

Component:

DRM/Intel

Assignee:

Intel GFX Bugs mailing list <intel-gfx-bugs>

Status:

CLOSED DUPLICATE

QA Contact:

Intel GFX Bugs mailing list <intel-gfx-bugs>

Severity:

critical

Priority:

lowest

CC:

dxtr, intel-gfx-bugs, lyude

Version:

unspecified

Hardware:

x86-64 (AMD64)

OS:

Linux (All)

Whiteboard:

i915 platform:

SKL

i915 features:

display/DP MST

Attachments:

Description	Flags
dmesg	none

Description Kim Lidström 2016-06-16 12:14:26 UTC

Created attachment 124559 [details]
dmesg

Hi!
I am running the linux mainline (4.7.0rc3 as of this writing) on a thinkpad x260 connected to a docking station/port replicator with two displayport monitors attached and, except for the good ol' WARN_ON(!wm_changed) warnings I am experiencing occasional freezes. To me they seem to happen at random.

my dmesg is attached.

lspci:
00:00.0 Host bridge: Intel Corporation Skylake Host Bridge/DRAM Registers (rev 08)
	Subsystem: Lenovo Device 504a
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ >SERR- <PERR- INTx-
	Latency: 0
	Capabilities: <access denied>

00:02.0 VGA compatible controller: Intel Corporation Skylake Integrated Graphics (rev 07) (prog-if 00 [VGA controller])
	Subsystem: Lenovo Device 504a
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 122
	Region 0: Memory at f0000000 (64-bit, non-prefetchable) [size=16M]
	Region 2: Memory at e0000000 (64-bit, prefetchable) [size=256M]
	Region 4: I/O ports at e000 [size=64]
	[virtual] Expansion ROM at 000c0000 [disabled] [size=128K]
	Capabilities: <access denied>
	Kernel driver in use: i915
	Kernel modules: i915

00:14.0 USB controller: Intel Corporation Sunrise Point-LP USB 3.0 xHCI Controller (rev 21) (prog-if 30 [XHCI])
	Subsystem: Lenovo Device 504a
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 124
	Region 0: Memory at f1220000 (64-bit, non-prefetchable) [size=64K]
	Capabilities: <access denied>
	Kernel driver in use: xhci_hcd
	Kernel modules: xhci_pci

00:14.2 Signal processing controller: Intel Corporation Sunrise Point-LP Thermal subsystem (rev 21)
	Subsystem: Lenovo Device 504a
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin C routed to IRQ 18
	Region 0: Memory at f124a000 (64-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>
	Kernel driver in use: intel_pch_thermal
	Kernel modules: intel_pch_thermal

00:16.0 Communication controller: Intel Corporation Sunrise Point-LP CSME HECI #1 (rev 21)
	Subsystem: Lenovo Device 504a
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 126
	Region 0: Memory at f124b000 (64-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>
	Kernel driver in use: mei_me
	Kernel modules: mei_me

00:17.0 SATA controller: Intel Corporation Sunrise Point-LP SATA Controller [AHCI mode] (rev 21) (prog-if 01 [AHCI 1.0])
	Subsystem: Lenovo Device 504a
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 125
	Region 0: Memory at f1248000 (32-bit, non-prefetchable) [size=8K]
	Region 1: Memory at f124e000 (32-bit, non-prefetchable) [size=256]
	Region 2: I/O ports at e080 [size=8]
	Region 3: I/O ports at e088 [size=4]
	Region 4: I/O ports at e060 [size=32]
	Region 5: Memory at f124c000 (32-bit, non-prefetchable) [size=2K]
	Capabilities: <access denied>
	Kernel driver in use: ahci
	Kernel modules: ahci

00:1c.0 PCI bridge: Intel Corporation Device 9d10 (rev f1) (prog-if 00 [Normal decode])
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 16
	Bus: primary=00, secondary=02, subordinate=02, sec-latency=0
	Memory behind bridge: f1100000-f11fffff
	Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-
	BridgeCtl: Parity- SERR- NoISA- VGA- MAbort- >Reset- FastB2B-
		PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
	Capabilities: <access denied>
	Kernel driver in use: pcieport
	Kernel modules: shpchp

00:1c.2 PCI bridge: Intel Corporation Device 9d12 (rev f1) (prog-if 00 [Normal decode])
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin C routed to IRQ 18
	Bus: primary=00, secondary=04, subordinate=04, sec-latency=0
	Memory behind bridge: f1000000-f10fffff
	Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-
	BridgeCtl: Parity- SERR- NoISA- VGA- MAbort- >Reset- FastB2B-
		PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
	Capabilities: <access denied>
	Kernel driver in use: pcieport
	Kernel modules: shpchp

00:1f.0 ISA bridge: Intel Corporation Sunrise Point-LP LPC Controller (rev 21)
	Subsystem: Lenovo Device 504a
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0

00:1f.2 Memory controller: Intel Corporation Sunrise Point-LP PMC (rev 21)
	Subsystem: Lenovo Device 504a
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Region 0: Memory at f1244000 (32-bit, non-prefetchable) [size=16K]

00:1f.3 Audio device: Intel Corporation Sunrise Point-LP HD Audio (rev 21)
	Subsystem: Lenovo Device 504a
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 64
	Interrupt: pin A routed to IRQ 129
	Region 0: Memory at f1240000 (64-bit, non-prefetchable) [size=16K]
	Region 4: Memory at f1230000 (64-bit, non-prefetchable) [size=64K]
	Capabilities: <access denied>
	Kernel driver in use: snd_hda_intel
	Kernel modules: snd_hda_intel, snd_soc_skl

00:1f.4 SMBus: Intel Corporation Sunrise Point-LP SMBus (rev 21)
	Subsystem: Lenovo Device 504a
	Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Interrupt: pin A routed to IRQ 16
	Region 0: Memory at f124d000 (64-bit, non-prefetchable) [size=256]
	Region 4: I/O ports at efa0 [size=32]
	Kernel driver in use: i801_smbus
	Kernel modules: i2c_i801

00:1f.6 Ethernet controller: Intel Corporation Ethernet Connection I219-V (rev 21)
	Subsystem: Lenovo Device 2233
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 127
	Region 0: Memory at f1200000 (32-bit, non-prefetchable) [size=128K]
	Capabilities: <access denied>
	Kernel driver in use: e1000e
	Kernel modules: e1000e

02:00.0 Unassigned class [ff00]: Realtek Semiconductor Co., Ltd. RTS522A PCI Express Card Reader (rev 01)
	Subsystem: Lenovo Device 504a
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 123
	Region 0: Memory at f1100000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>
	Kernel driver in use: rtsx_pci
	Kernel modules: rtsx_pci

04:00.0 Network controller: Intel Corporation Wireless 8260 (rev 3a)
	Subsystem: Intel Corporation Device 1130
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 128
	Region 0: Memory at f1000000 (64-bit, non-prefetchable) [size=8K]
	Capabilities: <access denied>
	Kernel driver in use: iwlwifi
	Kernel modules: iwlwifi

Comment 1 Kim Lidström 2016-06-16 12:15:49 UTC

I forgot to type in that it does not seem to happen when I don't have any external monitors connected.

Comment 2 Jani Nikula 2016-06-16 12:26:15 UTC

Jun 16 13:35:28 greger kernel: Call Trace:
Jun 16 13:35:28 greger kernel:  [<ffffffffa01ada75>] intel_mst_disable_dp+0x45/0x80 [i915]
Jun 16 13:35:28 greger kernel:  [<ffffffffa0180551>] haswell_crtc_disable+0x171/0x330 [i915]
Jun 16 13:35:28 greger kernel:  [<ffffffffa0188e17>] intel_atomic_commit+0x3f7/0x1460 [i915]
Jun 16 13:35:28 greger kernel:  [<ffffffff815d234f>] ? __ww_mutex_lock+0x4f/0x90
Jun 16 13:35:28 greger kernel:  [<ffffffffa005595d>] ? drm_atomic_check_only+0x18d/0x610 [drm]
Jun 16 13:35:28 greger kernel:  [<ffffffffa0055436>] ? drm_atomic_set_crtc_for_connector+0x96/0x100 [drm]
Jun 16 13:35:28 greger kernel:  [<ffffffffa0055e17>] drm_atomic_commit+0x37/0x60 [drm]
Jun 16 13:35:28 greger kernel:  [<ffffffffa00c1198>] restore_fbdev_mode+0x238/0x260 [drm_kms_helper]
Jun 16 13:35:28 greger kernel:  [<ffffffffa00c3834>] drm_fb_helper_restore_fbdev_mode_unlocked+0x34/0x80 [drm_kms_helper]
Jun 16 13:35:28 greger kernel:  [<ffffffffa00c38ad>] drm_fb_helper_set_par+0x2d/0x50 [drm_kms_helper]
Jun 16 13:35:28 greger kernel:  [<ffffffffa00c37a8>] drm_fb_helper_hotplug_event+0xd8/0x130 [drm_kms_helper]
Jun 16 13:35:28 greger kernel:  [<ffffffffa00c3857>] drm_fb_helper_restore_fbdev_mode_unlocked+0x57/0x80 [drm_kms_helper]
Jun 16 13:35:28 greger kernel:  [<ffffffffa01a49f2>] intel_fbdev_restore_mode+0x22/0x80 [i915]
Jun 16 13:35:28 greger kernel:  [<ffffffffa01cf7de>] i915_driver_lastclose+0xe/0x20 [i915]
Jun 16 13:35:28 greger kernel:  [<ffffffffa0038fae>] drm_lastclose+0x2e/0x120 [drm]
Jun 16 13:35:28 greger kernel:  [<ffffffffa003939a>] drm_release+0x2fa/0x4d0 [drm]
Jun 16 13:35:28 greger kernel:  [<ffffffff811fa6af>] __fput+0x9f/0x1e0
Jun 16 13:35:28 greger kernel:  [<ffffffff811fa82e>] ____fput+0xe/0x10
Jun 16 13:35:28 greger kernel:  [<ffffffff81097143>] task_work_run+0x83/0xb0
Jun 16 13:35:28 greger kernel:  [<ffffffff8107db74>] do_exit+0x314/0xb70
Jun 16 13:35:28 greger kernel:  [<ffffffff8107e44b>] do_group_exit+0x3b/0xb0
Jun 16 13:35:28 greger kernel:  [<ffffffff8108908d>] get_signal+0x26d/0x650
Jun 16 13:35:28 greger kernel:  [<ffffffff810fa4a0>] ? futex_wake+0x90/0x170
Jun 16 13:35:28 greger kernel:  [<ffffffff8102df87>] do_signal+0x37/0x6c0
Jun 16 13:35:28 greger kernel:  [<ffffffff811a8d25>] ? handle_mm_fault+0xc45/0x1fa0
Jun 16 13:35:28 greger kernel:  [<ffffffff81003651>] exit_to_usermode_loop+0xa1/0xc0
Jun 16 13:35:28 greger kernel:  [<ffffffff81003b9e>] syscall_return_slowpath+0x4e/0x60
Jun 16 13:35:28 greger kernel:  [<ffffffff815d4bfa>] entry_SYSCALL_64_fastpath+0xa2/0xa4

Comment 3 Jani Nikula 2016-06-16 12:27:05 UTC

(Sorry, that comment turned out less helpful than I thought it would.)

Comment 4 Chris Wilson 2016-06-16 12:31:55 UTC

Please try https://patchwork.freedesktop.org/patch/93561/

Comment 5 Kim Lidström 2016-06-16 13:00:03 UTC

I am compiling the kernel with the patch applied right now and will report back.

It might take some time considering I don't know how to reproduce it and sometimes it doesn't happen for days.

Although sometimes one or both external monitors goes black for a short while before it comes back. Could that be related or should I create a new issue for that?

I don't have a log right now for it but if you want I could create a new issue the next time it happens.

Comment 6 Kim Lidström 2016-06-16 13:26:30 UTC

this fails to compile with:

drivers/gpu/drm/i915/intel_fbdev.c: In function ‘intel_fbdev_restore_mode’:
drivers/gpu/drm/i915/intel_fbdev.c:827:12: error: ‘struct intel_fbdev’ has no member named ‘cookie’
  if (ifbdev->cookie) {
            ^~
drivers/gpu/drm/i915/intel_fbdev.c:828:34: error: ‘struct intel_fbdev’ has no member named ‘cookie’
   async_synchronize_cookie(ifbdev->cookie + 1);
                                  ^~
drivers/gpu/drm/i915/intel_fbdev.c:829:9: error: ‘struct intel_fbdev’ has no member named ‘cookie’
   ifbdev->cookie = 0;

Comment 7 Chris Wilson 2016-06-17 09:05:49 UTC

Apologies, patch 44/44, but fortunately it should only depend upon https://patchwork.freedesktop.org/patch/93560/

Comment 8 Chris Wilson 2016-06-17 18:17:16 UTC


*** This bug has been marked as a duplicate of bug 93580 ***

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.