bug still here with upstream kernel (2.6.33-rc1, up to commit dd59f6c76b265ed2ff18b497d6105a9511b1feb1) and mesa git master (up to ad7f9d71e22fb7667c90dbbc0558939b89a45154)

----from syslog-----

Dec 21 22:55:12 (none) kernel: BUG: unable to handle kernel NULL pointer dereference at 00000040
Dec 21 22:55:12 (none) kernel: IP: [<d11dd08a>] r100_cs_track_check+0x4a9/0x56a [radeon]
Dec 21 22:55:12 (none) kernel: *pde = 00000000 
Dec 21 22:55:12 (none) kernel: Oops: 0000 [#1] SMP 
Dec 21 22:55:12 (none) kernel: last sysfs file: /sys/devices/platform/w83627hf.656/in8_input
Dec 21 22:55:12 (none) kernel: Modules linked in: radeon ttm drm_kms_helper drm i2c_algo_bit cfbcopyarea cfbimgblt cfbfillrect snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_pcm_oss snd_mixer_oss nfsd lockd nfs_acl auth_rpcgss sunrpc ipv6 uhci_hcd tuner_simple tuner_types tda9887 snd_cs4236 snd_mpu401 tda8290 snd_wavefront snd_via82xx snd_ac97_codec snd_wss_lib ac97_bus snd_pcm snd_opl3_lib ppdev snd_timer snd_hwdep snd_page_alloc ehci_hcd snd_mpu401_uart saa7134 snd_rawmidi snd_seq_device rtc_cmos parport_pc rtc_core shpchp rtc_lib ir_common ns558 videobuf_dma_sg snd parport pci_hotplug floppy processor gameport usbcore 8139too mii soundcore videobuf_core button ir_core tveeprom thermal via_agp mousedev evdev ufs xfs exportfs agpgart psmouse tuner v4l2_common videodev v4l1_compat w83627hf hwmon_vid hwmon i2c_viapro i2c_dev i2c_core fbcon tileblit font bitblit softcursor fb via82cxxx ide_gd_mod ide_core
Dec 21 22:55:12 (none) kernel: 
Dec 21 22:55:12 (none) kernel: EIP: 0060:[<d11dd08a>] EFLAGS: 00010202 CPU: 0
Dec 21 22:55:12 (none) kernel: EIP is at r100_cs_track_check+0x4a9/0x56a [radeon]
Dec 21 22:55:12 (none) kernel: EAX: 00000000 EBX: 00000000 ECX: c71080d0 EDX: 00000004
Dec 21 22:55:12 (none) kernel: ESI: 00004000 EDI: 00000004 EBP: c71b7da8 ESP: c71b7d60
Dec 21 22:55:12 (none) kernel:  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Dec 21 22:55:12 (none) kernel: Process stex3d (pid: 3826, ti=c71b7000 task=c7120ce0 task.ti=c71b7000)
Dec 21 22:55:12 (none) kernel: Stack:
Dec 21 22:55:12 (none) kernel:  00000040 c7054d50 00002d00 c71b7de4 c7108000 c8ea9000 00000000 c7105600
Dec 21 22:55:12 (none) kernel: <0> 00000006 00000000 c7108000 00000066 00000004 00000024 00001000 00000000
Dec 21 22:55:12 (none) kernel: <0> c71b7e28 c7108000 c71b7e10 d11ded69 00000003 00000000 00001000 00000004
Dec 21 22:55:12 (none) kernel: Call Trace:
Dec 21 22:55:12 (none) kernel:  [<d11ded69>] ? r100_cs_parse+0x41a/0x46a [radeon]
Dec 21 22:55:12 (none) kernel:  [<d11da709>] ? radeon_cs_ioctl+0xe3/0x162 [radeon]
Dec 21 22:55:12 (none) kernel:  [<d10bc63f>] ? drm_ioctl+0x20b/0x28b [drm]
Dec 21 22:55:12 (none) kernel:  [<d11da626>] ? radeon_cs_ioctl+0x0/0x162 [radeon]
Dec 21 22:55:12 (none) kernel:  [<c10918dd>] ? filemap_fault+0x6e/0x2e5
Dec 21 22:55:12 (none) kernel:  [<c10b8ba1>] ? mem_cgroup_update_file_mapped+0x12/0x5c
Dec 21 22:55:12 (none) kernel:  [<c109140b>] ? unlock_page+0x43/0x46
Dec 21 22:55:12 (none) kernel:  [<c10a3565>] ? __do_fault+0x33c/0x36c
Dec 21 22:55:12 (none) kernel:  [<c10c59f3>] ? vfs_ioctl+0x62/0x8a
Dec 21 22:55:12 (none) kernel:  [<c10c5f34>] ? do_vfs_ioctl+0x470/0x4aa
Dec 21 22:55:12 (none) kernel:  [<c10a9558>] ? do_mmap_pgoff+0x22a/0x27a
Dec 21 22:55:12 (none) kernel:  [<c101c9cc>] ? do_page_fault+0x26c/0x2aa
Dec 21 22:55:12 (none) kernel:  [<c10c5f9f>] ? sys_ioctl+0x31/0x4a
Dec 21 22:55:12 (none) kernel:  [<c1240175>] ? syscall_call+0x7/0xb
Dec 21 22:55:12 (none) kernel: Code: c8 80 b8 cd 08 00 00 00 74 62 8b 45 d0 31 db 8b 55 c8 c1 e0 07 8d 8c 02 d0 00 00 00 8b 01 89 fa 0f af 51 08 0f af 51 0c 03 51 04 <8b> 40 40 c1 e0 0c 39 c2 76 2c 50 52 68 98 bb 1f d1 68 0b 5e 20 
Dec 21 22:55:12 (none) kernel: EIP: [<d11dd08a>] r100_cs_track_check+0x4a9/0x56a [radeon] SS:ESP 0068:c71b7d60
Dec 21 22:55:12 (none) kernel: CR2: 0000000000000040
Dec 21 22:55:12 (none) kernel: ---[ end trace 2cbdd1b091cfad6d ]---

issue still here, on 33-rc4+:

after minor modification in drivers/gpu/drm/radeon/r100.c

----debug patch

diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 8760d66..09e5acb 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2846,6 +2846,8 @@ static int r100_cs_track_texture_check(struct radeon_device *rdev,
                }
                size *= track->textures[u].cpp;
 
+               // r100_cs_track_texture_print(&track->textures[u]); // tmp debug
+
                switch (track->textures[u].tex_coord_type) {
                case 0:
                        break;
@@ -2975,6 +2977,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
                          prim_walk);
                return -EINVAL;
        }
+       DRM_INFO("[drm] want to call r100_cs_track_texture_check! \n");
        return r100_cs_track_texture_check(rdev, track);
 }
---debug patch end

i get this

Jan 17 03:42:20 (none) kernel: Console: switching to colour frame buffer device 160x64
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* pitch                      256
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* use_pitch                  0
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* width                      64
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* width_11                   2048
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* height                     64
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* height_11                  2048
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* num levels                 0
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* depth                      6
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* bpp                        4
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* coordinate type            2
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* width round to power of 2  1
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* height round to power of 2 1
Jan 17 03:43:16 (none) kernel: [drm:r100_cs_track_texture_print] *ERROR* compress format            0
Jan 17 03:43:16 (none) kernel: BUG: unable to handle kernel NULL pointer dereference at 00000040
Jan 17 03:43:16 (none) kernel: IP: [<d11906d7>] r100_cs_track_check+0x4e2/0x58b [radeon]
Jan 17 03:43:16 (none) kernel: *pde = 00000000 
Jan 17 03:43:16 (none) kernel: Oops: 0000 [#1] SMP 
Jan 17 03:43:16 (none) kernel: last sysfs file: /sys/class/vc/vcs7/dev
Jan 17 03:43:16 (none) kernel: Modules linked in: radeon ttm drm_kms_helper drm i2c_algo_bit cfbcopyarea cfbimgblt cfbfillrect snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_pcm_oss snd_mixer_oss nfsd lockd nfs_acl auth_rpcgss sunrpc ipv6 mousedev usbhid usbmouse snd_via82xx snd_cs4236 snd_mpu401 tuner_simple tuner_types snd_ac97_codec snd_wavefront tda9887 snd_wss_lib ac97_bus tda8290 snd_pcm snd_opl3_lib uhci_hcd snd_timer snd_page_alloc snd_hwdep saa7134 snd_mpu401_uart ehci_hcd snd_rawmidi snd_seq_device ppdev ir_common rtc_cmos videobuf_dma_sg snd parport_pc rtc_core rtc_lib shpchp videobuf_core 8139too mii ns558 parport usbcore pci_hotplug floppy processor via_agp soundcore gameport ir_core thermal button tveeprom evdev ufs xfs exportfs agpgart psmouse tuner v4l2_common videodev v4l1_compat w83627hf hwmon_vid hwmon i2c_viapro i2c_dev i2c_core fbcon tileblit font bitblit softcursor fb via82cxxx ide_gd_mod ide_core
Jan 17 03:43:16 (none) kernel: 
Jan 17 03:43:16 (none) kernel: Pid: 3804, comm: stex3d Not tainted 2.6.33-rc4-i486 #61 MS-6380E/MS-6380E
Jan 17 03:43:16 (none) kernel: EIP: 0060:[<d11906d7>] EFLAGS: 00210246 CPU: 0
Jan 17 03:43:16 (none) kernel: EIP is at r100_cs_track_check+0x4e2/0x58b [radeon]
Jan 17 03:43:16 (none) kernel: EAX: 00000000 EBX: 00000000 ECX: cd59b0d4 EDX: 00000004
Jan 17 03:43:16 (none) kernel: ESI: 00004000 EDI: cd59b0d0 EBP: cac32da4 ESP: cac32d5c
Jan 17 03:43:16 (none) kernel:  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Jan 17 03:43:16 (none) kernel: Process stex3d (pid: 3804, ti=cac32000 task=cbb88000 task.ti=cac32000)
Jan 17 03:43:16 (none) kernel: Stack:
Jan 17 03:43:16 (none) kernel:  00000040 cbb66210 00002d00 cac32de0 cd59b000 cd591000 00000004 00000000
Jan 17 03:43:16 (none) kernel: <0> cac33400 00000000 cd59b000 00000066 00000004 00000024 00001000 00000000
Jan 17 03:43:16 (none) kernel: <0> cac32e24 cd59b000 cac32e0c d119239e 00000003 00000000 00001000 00000004
Jan 17 03:43:16 (none) kernel: Call Trace:
Jan 17 03:43:16 (none) kernel:  [<d119239e>] ? r100_cs_parse+0x41a/0x46a [radeon]
Jan 17 03:43:16 (none) kernel:  [<d118de21>] ? radeon_cs_ioctl+0xe3/0x162 [radeon]
Jan 17 03:43:16 (none) kernel:  [<d106e698>] ? drm_ioctl+0x268/0x310 [drm]
Jan 17 03:43:16 (none) kernel:  [<d118dd3e>] ? radeon_cs_ioctl+0x0/0x162 [radeon]
Jan 17 03:43:16 (none) kernel:  [<c10b8ff5>] ? mem_cgroup_update_file_mapped+0x12/0x5c
Jan 17 03:43:16 (none) kernel:  [<c1091833>] ? unlock_page+0x43/0x46
Jan 17 03:43:16 (none) kernel:  [<c10a3895>] ? __do_fault+0x33c/0x36c
Jan 17 03:43:16 (none) kernel:  [<d106e430>] ? drm_ioctl+0x0/0x310 [drm]
Jan 17 03:43:16 (none) kernel:  [<c10c5e48>] ? vfs_ioctl+0x27/0x8a
Jan 17 03:43:16 (none) kernel:  [<c10c63c4>] ? do_vfs_ioctl+0x470/0x4aa
Jan 17 03:43:16 (none) kernel:  [<c10a9888>] ? do_mmap_pgoff+0x22a/0x27a
Jan 17 03:43:16 (none) kernel:  [<c101c7ac>] ? do_page_fault+0x26c/0x2aa
Jan 17 03:43:16 (none) kernel:  [<c10c642f>] ? sys_ioctl+0x31/0x4a
Jan 17 03:43:16 (none) kernel:  [<c1240cb5>] ? syscall_call+0x7/0xb
Jan 17 03:43:16 (none) kernel: Code: 00 8b 45 c8 80 b8 d1 08 00 00 00 74 53 8b 55 e0 8d 4f 04 31 db 8b 92 34 01 00 00 89 55 d0 8b 01 8b 51 0c 0f af 51 08 0f af 55 d0 <8b> 40 40 03 51 04 c1 e0 0c 39 c2 76 1d 50 52 68 60 f0 1a d1 68 
Jan 17 03:43:16 (none) kernel: EIP: [<d11906d7>] r100_cs_track_check+0x4e2/0x58b [radeon] SS:ESP 0068:cac32d5c
Jan 17 03:43:16 (none) kernel: CR2: 0000000000000040
Jan 17 03:43:16 (none) kernel: ---[ end trace 92b6cc214ec9a14f ]---

after some digging in sources .... this patch fixes oops:

diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c
index 2094212..ace59ca 100644
--- a/drivers/gpu/drm/radeon/r200.c
+++ b/drivers/gpu/drm/radeon/r200.c
@@ -373,10 +373,10 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                case 7:
                        track->textures[i].tex_coord_type = 0;
                        break;
-               case 1:
+               case 2:
                        track->textures[i].tex_coord_type = 1;
                        break;
-               case 2:
+               case 1:
                        track->textures[i].tex_coord_type = 2;
                        break;
                }


-------

progs/demos/cubemap still work. 

Created attachment 32742 [details] [review]
patch for upstream

good catch.  I'm sending this upstream.

Patch merged in 2.6.33-rc6.