Bug 71620 - nouveau_fence_wait_uevent NULL pointer dereference
Summary: nouveau_fence_wait_uevent NULL pointer dereference
Status: RESOLVED MOVED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/nouveau (show other bugs)
Version: unspecified
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Nouveau Project
QA Contact:
URL:
Whiteboard:
Keywords:
: 72599 82704 82975 84424 (view as bug list)
Depends on:
Blocks:
 
Reported: 2013-11-14 18:55 UTC by Kostadin Atanasov
Modified: 2019-09-18 20:38 UTC (History)
5 users (show)

See Also:
i915 platform:
i915 features:


Attachments
patch_to_protect_fence_channel (2.36 KB, text/plain)
2013-11-14 18:55 UTC, Kostadin Atanasov
Details
better-multithreaded-protection-for-cence-channel (1023 bytes, patch)
2013-11-24 21:01 UTC, Kostadin Atanasov
Details | Splinter Review
stacktrace from kernel oops (5.43 KB, text/plain)
2014-03-25 12:20 UTC, Raphaël Droz
Details
.config diff (6.16 KB, text/plain)
2014-03-25 12:24 UTC, Raphaël Droz
Details

Description Kostadin Atanasov 2013-11-14 18:55:54 UTC
Created attachment 89234 [details]
patch_to_protect_fence_channel

Upon normal computer operation user session(GNOME-Shell) sometimes will just terminate. Problem seems more common if two users are logged in(GNOME-Shell) for a day.

GPU:
NVIDIA Corporation C77 [GeForce 8300] (rev a2)

kernel version:
3.12.0-upstream

Relevent dmesg output:
[29434.602169] Call Trace:
[29434.602188]  [<ffffffffa010b6db>] ? nouveau_fence_wait_uevent.isra.1+0x1b/0x3f0 [nouveau]
[29434.602208]  [<ffffffffa010b676>] ? nouveau_fence_update+0x76/0x90 [nouveau]
[29434.602228]  [<ffffffffa010bb36>] nouveau_fence_wait+0x86/0x1a0 [nouveau]
[29434.602248]  [<ffffffffa010d7a5>] nouveau_bo_fence_wait+0x15/0x20 [nouveau]
[29434.602260]  [<ffffffffa00658a1>] ttm_bo_wait+0x91/0x190 [ttm]
[29434.602279]  [<ffffffffa0112e57>] nouveau_gem_ioctl_cpu_prep+0x57/0xe0 [nouveau]
[29434.602294]  [<ffffffffa0010c52>] drm_ioctl+0x502/0x630 [drm]
[29434.602313]  [<ffffffffa0108d11>] nouveau_drm_ioctl+0x51/0x90 [nouveau]
[29434.602324]  [<ffffffff811b3690>] do_vfs_ioctl+0x2e0/0x4c0
[29434.602332]  [<ffffffff811a2e2e>] ? ____fput+0xe/0x10
[29434.602340]  [<ffffffff81080544>] ? task_work_run+0xa4/0xe0
[29434.602347]  [<ffffffff811b38f1>] SyS_ioctl+0x81/0xa0
[29434.602356]  [<ffffffff814f81ad>] system_call_fastpath+0x1a/0x1f
[29434.602364] Code: c3 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 57 49 89 f7 41 56 41 55 41 54 41 89 d4 53 48 89 fb 48 83 ec 58 48 8b 07 <48> 8b 48 08 48 8b 91 f8 00 00 00 4c 8b b1 b0 07 00 00 48 8b 42 

I'm trying some change(adding it as patch) - no problem so far, but since I have zero experience in kernel/driver workflow definitely not sure if it's OK.

Regards, K
Comment 1 Kostadin Atanasov 2013-11-24 21:01:00 UTC
Created attachment 89720 [details] [review]
better-multithreaded-protection-for-cence-channel

After almost 2 weeks running with this patch - the same problem happen. Looking bit more on nouveau_fence_wait function looks like I miss one place where multithreaded problem could occur - hence second patch to for it.
Comment 2 Ilia Mirkin 2013-12-12 02:58:34 UTC
*** Bug 72599 has been marked as a duplicate of this bug. ***
Comment 3 Raphaël Droz 2014-03-25 12:20:59 UTC
Created attachment 96364 [details]
stacktrace from kernel oops

same here (with a slightly different stack trace), see attachment
(using 10de:06e4 (GeForce 8400 GS Rev. 2)).

Was simply using fluxbox/firefox after a resumed. It's the first time it happens, (but I changed a couple of kernel options only 2 days ago).
I will attach the .config diff in case there's something related.

Will try the patch later if I can get the oops frequently enough.
Comment 4 Raphaël Droz 2014-03-25 12:24:56 UTC
Created attachment 96365 [details]
.config diff

seems that it never happened with my previous config (used during several weeks), but happened (once) with the new one (used only 2 days)
[ anyway other software was updated too in the interval ... ]
Comment 5 James TD Smith 2014-06-28 00:19:45 UTC
Looks like I've run into the same problem. X crashed while I was using Firefox and I found the traceback below in my logs. There were no errors in the Xorg logs so I've omitted those. I'm running Debian 7.5 amd64, kernel 3.13.5, Xorg 7.7, Nouveau 1.0.10-1+b1. Graphics card is a GF114 [GeForce GTX 560 Ti] (rev a1).

Jun 27 23:48:46 nyarlathotep kernel: [421145.711394] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
Jun 27 23:48:46 nyarlathotep kernel: [421145.711427] IP: [<ffffffffa0306f0e>] nouveau_fence_wait_uevent+0x1b/0x2e7 [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.711471] PGD 0 
Jun 27 23:48:46 nyarlathotep kernel: [421145.711477] Oops: 0000 [#1] PREEMPT SMP 
Jun 27 23:48:46 nyarlathotep kernel: [421145.711490] Modules linked in: cpuid sha256_generic cbc tcp_diag inet_diag xt_addrtype xt_conntrack ipt_MASQUERADE iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack bridge stp llc aufs(C) iptable_filter ip_tables x_tables bnep rfcomm bluetooth rpcsec_gss_krb5 nfsv4 dns_resolver cpufreq_conservative cpufreq_userspace cpufreq_powersave cpufreq_stats battery snd_hrtimer vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O) binfmt_misc uinput fuse nfsd auth_rpcgss oid_registry nfs_acl nfs lockd fscache sunrpc synaptics_usb ext3 jbd dm_crypt md_mod firewire_sbp2 loop parport_pc ppdev parport snd_hda_codec_hdmi powermate snd_hda_codec_analog arc4 hid_generic snd_emu10k1_synth snd_emux_synth snd_seq_midi_emul joydev snd_seq_virmidi usbhid hid snd_usb_audio snd_usbmidi_lib xpad ff_memless rtl8187 nfc mac80211 cfg80211 eeprom_93cx6 rfkill snd_emu10k1 snd_seq_midi snd_seq_midi_event snd_hda_intel snd_util_mem snd_ac97_codec snd_hda_codec snd_hwdep snd_pcm_oss snd_m
Jun 27 23:48:46 nyarlathotep kernel: ixer_oss snd_rawmidi evdev snd_pcm ac97_bus coretemp snd_page_alloc kvm_intel kvm emu10k1_gp gameport snd_seq nouveau snd_seq_device video snd_timer serio_raw lpc_ich mxm_wmi mfd_core wmi pcspkr i2c_algo_bit i2c_i801 ttm drm_kms_helper drm snd asus_atk0110 i2c_core soundcore acpi_cpufreq processor thermal_sys button ext4 crc16 jbd2 mbcache dm_mirror dm_region_hash dm_log dm_mod sr_mod cdrom sg sd_mod usb_storage r8169 mii firewire_ohci firewire_core crc_itu_t pata_jmicron ahci libahci sky2 libata scsi_mod xhci_hcd ehci_pci uhci_hcd ehci_hcd usbcore usb_common
Jun 27 23:48:46 nyarlathotep kernel: [421145.711942] CPU: 3 PID: 5115 Comm: Xorg Tainted: G         C O 3.13.5 #1
Jun 27 23:48:46 nyarlathotep kernel: [421145.711951] Hardware name: System manufacturer P5K3 Deluxe/P5K3 Deluxe, BIOS 1206    04/16/2009
Jun 27 23:48:46 nyarlathotep kernel: [421145.711969] task: ffff880222f4ef90 ti: ffff880225014000 task.ti: ffff880225014000
Jun 27 23:48:46 nyarlathotep kernel: [421145.711979] RIP: 0010:[<ffffffffa0306f0e>]  [<ffffffffa0306f0e>] nouveau_fence_wait_uevent+0x1b/0x2e7 [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] RSP: 0018:ffff880225015c90  EFLAGS: 00010286
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] RDX: ffff88012e55ec80 RSI: 0000000000000001 RDI: ffff88012e55ef00
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] RBP: ffff88012e55ef00 R08: ffff880225015c90 R09: 000000000000e200
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] R10: 0000000000000000 R11: 0000000000000246 R12: ffff880036478101
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] R13: ffff88003657b601 R14: ffff88003649bd01 R15: 0000000000000001
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] FS:  00007f7cc13fa980(0000) GS:ffff88022fd80000(0000) knlGS:0000000000000000
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] CR2: 0000000000000008 CR3: 00000000ca894000 CR4: 00000000000407e0
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] Stack:
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  00000000000013fb 0000000080000000 0000000000000000 ffff88012e55ec80
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  0000000000000001 ffff88012e55ef00 0000000000000000 ffff88012e55ef00
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  ffff880036478101 ffff88003657b601 ffff88003649bd80 0000000000000001
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] Call Trace:
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa030721d>] ? nouveau_fence_wait+0x43/0x128 [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff8138dc4b>] ? _raw_spin_unlock+0xd/0x1f
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa0306ec2>] ? nouveau_fence_done+0x48/0x79 [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa022906d>] ? ttm_bo_wait+0xa2/0x158 [ttm]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa030ba5c>] ? nouveau_gem_ioctl_cpu_prep+0x49/0x75 [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa030ba13>] ? nouveau_gem_ioctl_pushbuf+0xbde/0xbde [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa0243fa2>] ? drm_ioctl+0x27b/0x3ba [drm]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa030ba13>] ? nouveau_gem_ioctl_pushbuf+0xbde/0xbde [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff81286cef>] ? rpm_resume+0x49c/0x4ad
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff8138de57>] ? _raw_spin_lock+0xe/0x17
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff8138dc4b>] ? _raw_spin_unlock+0xd/0x1f
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffffa0305b45>] ? nouveau_drm_ioctl+0x48/0x7c [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff8111c928>] ? do_vfs_ioctl+0x3f8/0x441
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff811105c5>] ? __fput+0x176/0x197
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff81125aa1>] ? mntput_no_expire+0x1a/0x118
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff8104c398>] ? task_work_run+0x7b/0x8a
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff8111c9bf>] ? SyS_ioctl+0x4e/0x79
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  [<ffffffff813924e6>] ? system_call_fastpath+0x1a/0x1f
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] Code: 7d 28 00 5a 0f 94 c0 5b 5d 41 5c 41 5d 41 5e c3 41 57 41 56 41 88 f6 41 55 41 54 55 48 89 fd 53 48 83 ec 30 48 8b 47 28 49 89 e0 <48> 8b 48 08 48 8b 91 f0 00 00 00 4c 8b a9 68 07 00 00 48 8b 42 
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004] RIP  [<ffffffffa0306f0e>] nouveau_fence_wait_uevent+0x1b/0x2e7 [nouveau]
Jun 27 23:48:46 nyarlathotep kernel: [421145.712004]  RSP <ffff880225015c90>
Comment 6 Ilia Mirkin 2014-08-17 00:25:59 UTC
*** Bug 82704 has been marked as a duplicate of this bug. ***
Comment 7 Ilia Mirkin 2014-08-22 22:06:34 UTC
*** Bug 82975 has been marked as a duplicate of this bug. ***
Comment 8 Ilia Mirkin 2014-09-28 15:50:50 UTC
*** Bug 84424 has been marked as a duplicate of this bug. ***
Comment 9 GitLab Migration User 2019-09-18 20:38:54 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/mesa/mesa/issues/1057.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.