Bug 98620

Summary: radeon kernel module NULL pointer dereference on Radeon 9550 at shut-down
Product: DRI Reporter: Arthur Marsh <arthur.marsh>
Component: DRM/RadeonAssignee: Default DRI bug account <dri-devel>
Status: RESOLVED MOVED QA Contact:
Severity: normal    
Priority: medium    
Version: unspecified   
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
See Also: https://bugzilla.kernel.org/show_bug.cgi?id=178421
Whiteboard:
i915 platform: i915 features:
Attachments:
Description Flags
full dmesg when crashing none

Description Arthur Marsh 2016-11-07 04:00:47 UTC 
Created attachment 127808 [details]
full dmesg when crashing

At shut-down:

[ 2515.296325] BUG: unable to handle kernel NULL pointer dereference at 000007b4
[ 2515.300025] IP: [<f8593b36>] radeon_connector_unregister+0x6/0x40 [radeon]
[ 2515.300025] *pde = 00000000 

[ 2515.300025] Oops: 0000 [#1] PREEMPT SMP
[ 2515.300025] Modules linked in: eata cpufreq_conservative cpufreq_powersave cp
ufreq_userspace binfmt_misc nls_utf8 nls_cp437 vfat fat hwmon_vid tun cuse fuse 
iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi lp ppdev powernow_k8 amd64_
edac_mod edac_mce_amd edac_core snd_via82xx snd_ac97_codec pcspkr ac97_bus snd_m
pu401_uart radeon snd_pcm snd_timer snd_rawmidi evdev snd_seq_device gameport sn
d ttm drm_kms_helper soundcore serio_raw drm k8temp i2c_algo_bit fb_sys_fops i2c
_viapro syscopyarea sysfillrect sysimgblt sg parport_pc parport asus_atk0110 acp
i_cpufreq button tpm_tis tpm_tis_core tpm ext4 crc16 jbd2 mbcache sr_mod cdrom a
ta_generic uas sd_mod usb_storage psmouse via_rhine mii pata_via ehci_pci uhci_h
cd ehci_hcd usbcore usb_common libata scsi_mod [last unloaded: eata]
[ 2515.300025] CPU: 0 PID: 7439 Comm: reboot Not tainted 4.9.0-rc4 #520
[ 2515.300025] Hardware name: System manufacturer System Product Name/A8V-MX, BI
OS 0503    12/06/2005
[ 2515.300025] task: f2cc6080 task.stack: f3934000
[ 2515.300025] EIP: 0060:[<f8593b36>] EFLAGS: 00010286 CPU: 0
[ 2515.300025] EIP is at radeon_connector_unregister+0x6/0x40 [radeon]
[ 2515.300025] EAX: f73a1000 EBX: f73a1000 ECX: 00000006 EDX: 00000000
[ 2515.300025] ESI: f5a09c64 EDI: f5a09800 EBP: f3935db4 ESP: f3935dac
[ 2515.300025]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[ 2515.300025] CR0: 80050033 CR2: 000007b4 CR3: 33dbc000 CR4: 000006d0
[ 2515.300025] Stack:
[ 2515.300025]  f83471d7 f73a1000 f3935dc4 f8347967 f5a09800 f5a09c8c f3935dd8 f
83383b3
[ 2515.300025]  f5a09800 f5a09800 f86a0000 f3935dec f8332ff7 f5a09800 f61d3000 f
86a0000
[ 2515.300025]  f3935e04 f8333640 f8358dca 00000001 f8358dc8 f61d3068 f3935e0c f
85702ee
[ 2515.300025] Call Trace:
[ 2515.300025]  [<f83471d7>] ? drm_connector_unregister.part.6+0x17/0x30 [drm]
[ 2515.300025]  [<f8347967>] drm_connector_unregister_all+0x37/0x50 [drm]
[ 2515.300025]  [<f83383b3>] drm_modeset_unregister_all+0x13/0x50 [drm]
[ 2515.300025]  [<f8332ff7>] drm_dev_unregister+0x97/0xa0 [drm]
[ 2515.300025]  [<f8333640>] drm_put_dev+0x30/0x70 [drm]
[ 2515.300025]  [<f85702ee>] radeon_pci_shutdown+0xe/0x10 [radeon]
[ 2515.300025]  [<c134da9d>] pci_device_shutdown+0x2d/0x70
[ 2515.300025]  [<c140b834>] device_shutdown+0xb4/0x170
[ 2515.300025]  [<c108126d>] kernel_restart_prepare+0x2d/0x30
[ 2515.300025]  [<c10812fe>] kernel_restart+0xe/0x60
[ 2515.300025]  [<c108162f>] SYSC_reboot+0x1bf/0x200
[ 2515.300025]  [<c10cd2ea>] ? debug_lockdep_rcu_enabled+0x1a/0x20
[ 2515.300025]  [<c10cd2ea>] ? debug_lockdep_rcu_enabled+0x1a/0x20
[ 2515.300025]  [<c11f9c50>] ? mnt_get_count+0x40/0x40
[ 2515.300025]  [<c11f9cbf>] ? mntput_no_expire+0x6f/0x3a0
[ 2515.300025]  [<c11f9cd9>] ? mntput_no_expire+0x89/0x3a0
[ 2515.300025]  [<c11f9c50>] ? mnt_get_count+0x40/0x40
[ 2515.300025]  [<c11fa00b>] ? mntput+0x1b/0x30
[ 2515.300025]  [<c11d7963>] ? __fput+0x153/0x1d0
[ 2515.300025]  [<c107ca4f>] ? task_work_run+0x6f/0x80
[ 2515.300025]  [<c10b02ac>] ? trace_hardirqs_on_caller+0xec/0x1d0
[ 2515.300025]  [<c10ad2eb>] ? trace_hardirqs_off+0xb/0x10
[ 2515.300025]  [<c10816da>] SyS_reboot+0x1a/0x20
[ 2515.300025]  [<c1001c7a>] do_fast_syscall_32+0x9a/0x220
[ 2515.300025]  [<c15ae2ec>] sysenter_past_esp+0x45/0x74
[ 2515.300025] Code: d8 e8 df 36 db ff 89 d8 e8 f8 36 db ff 89 d8 e8 11 58 c2 c8
 5b 5d c3 8d b4 26 00 00 00 00 8d bc 27 00 00 00 00 8b 90 d4 02 00 00 <80> ba b4
 07 00 00 00 75 01 c3 55 89 e5 53 89 c3 8d 82 e8 03 00
[ 2515.300025] EIP: [<f8593b36>] 
[ 2515.300025] radeon_connector_unregister+0x6/0x40 [radeon]
[ 2515.300025]  SS:ESP 0068:f3935dac
[ 2515.300025] CR2: 00000000000007b4
[ 2516.877047] ---[ end trace 076c5e2ae2d51112 ]---

Full dmesg from boot to crash is attached.

# lspci -vv -s 01:00
01:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] RV350 [Radeon 9550] (prog-if 00 [VGA controller])
        Subsystem: Gigabyte Technology Co., Ltd RV350 [Radeon 9550]
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
        Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
        Latency: 64 (2000ns min), Cache Line Size: 64 bytes
        Interrupt: pin A routed to IRQ 16
        Region 0: Memory at a0000000 (32-bit, prefetchable) [size=256M]
        Region 1: I/O ports at b000 [size=256]
        Region 2: Memory at ff4f0000 (32-bit, non-prefetchable) [size=64K]
        Expansion ROM at 000c0000 [disabled] [size=128K]
        Capabilities: [58] AGP version 3.0
                Status: RQ=256 Iso- ArqSz=0 Cal=0 SBA+ ITACoh- GART64- HTrans- 64bit- FW+ AGP3+ Rate=x4,x8
                Command: RQ=32 ArqSz=0 Cal=0 SBA+ AGP+ GART64- 64bit- FW- Rate=x8
        Capabilities: [50] Power Management version 2
                Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
        Kernel driver in use: radeon
        Kernel modules: radeonfb, radeon

01:00.1 Display controller: Advanced Micro Devices, Inc. [AMD/ATI] RV350 [Radeon 9550] (Secondary)
        Subsystem: Gigabyte Technology Co., Ltd RV350 [Radeon 9550] (Secondary)
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
        Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
        Latency: 64 (2000ns min), Cache Line Size: 64 bytes
        Region 0: Memory at 90000000 (32-bit, prefetchable) [size=256M]
        Region 1: Memory at ff4e0000 (32-bit, non-prefetchable) [size=64K]
        Capabilities: [50] Power Management version 2
                Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-

git-bisect revealed:

git bisect bad
b0c80bd5d2e317f7596fe2badc1a3379fb3211e5 is the first bad commit
commit b0c80bd5d2e317f7596fe2badc1a3379fb3211e5
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Oct 11 10:44:24 2016 -0400

    drm/radeon: fix up dp aux tear down (v2)
    
    Port the amdgpu fixes from Grazvydas to radeon.
    
    v2: drop unrelated whitespace change.
    
    bug:
    https://bugs.freedesktop.org/show_bug.cgi?id=98200
    
    Reviewed-and-Tested-by: Michel Dänzer <michel.daenzer@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

:040000 040000 b187ce6d75761c9e2eed71b385c8e0f085dbfd55 aca34c667d6253da66e824b2
a624f308841555b0 M      drivers

Rebuilding and running the kernel with that commit removed confirmed normal shutdown.
Comment 1 Michel Dänzer 2016-11-07 07:08:28 UTC 
Should be fixed by https://marc.info/?l=linux-kernel&m=147787037104246 .
Comment 2 Martin Peres 2019-11-19 09:19:23 UTC 
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/drm/amd/issues/750.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.