crash with "drm/ttm: callback move_notify any time bo placement change v4" patch

crash with "drm/ttm: callback move_notify any time bo placement change v4" patch

[Konrad Rzeszutek Wilk]

Hey,

When I use the drm-next tree without the patch it works fine. 
(albeit slowly - but I posted the patches for that).

With the patch mentioned I get this:

00:0d.0 VGA compatible controller: nVidia Corporation C61 [GeForce 6150SE nForce 430] (rev a2)
sh-4.1# cd 0000:00:0d.0
sh-4.1# cd driver
sh-4.1# echo "0000:00:0d.0" > unbind
[  144.585574] BUG: unable to handle kernel NULL pointer dereference at           (null)
[  144.585588] IP: [<ffffffffa012a805>] nouveau_bo_move_ntfy+0x25/0xb0 [nouveau]
[  144.585605] PGD 30b5a067 PUD 30af1067 PMD 0 
[  144.585612] Oops: 0000 [#1] PREEMPT SMP 
[  144.585619] CPU 0 
[  144.585622] Modules linked in: dm_multipath dm_mod xen_evtchn iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi libcrc32c crc32c radeon sg sd_mod fbcon tileblit nouveau font bitblit softcursor ttm drm_kms_helper mxm_wmi wmi video sata_nv ata_generic libata skge e1000 scsi_mod xen_blkfront xen_netfront fb_sys_fops sysimgblt sysfillrect syscopyarea xenfs [last unloaded: dump_dma]
[  144.585705] 
[  144.585709] Pid: 3223, comm: sh Tainted: G           O 3.2.0-rc5-00169-g82d722f #2 BIOSTAR Group N61PB-M2S/N61PB-M2S
[  144.585718] RIP: e030:[<ffffffffa012a805>]  [<ffffffffa012a805>] nouveau_bo_move_ntfy+0x25/0xb0 [nouveau]
[  144.585730] RSP: e02b:ffff880030a69bf8  EFLAGS: 00010292
[  144.585733] RAX: ffffffffa012a7e0 RBX: ffff88002dacca10 RCX: ffff88000ef80498
[  144.585737] RDX: ffff88000ef80498 RSI: 0000000000000000 RDI: ffff88002dacc800
[  144.585741] RBP: ffff880030a69c28 R08: 0000000000000000 R09: ffff88000f228d38
[  144.585745] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
[  144.585749] R13: ffff88002dacca10 R14: ffff88002dacc800 R15: ffff88000f228d38
[  144.585757] FS:  00007fcdfa067700(0000) GS:ffff88003fe5b000(0000) knlGS:0000000000000000
[  144.585761] CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b
[  144.585765] CR2: 0000000000000000 CR3: 0000000030bc6000 CR4: 0000000000000660
[  144.585769] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  144.585774] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  144.585778] Process sh (pid: 3223, threadinfo ffff880030a68000, task ffff88003a3809f0)
[  144.585782] Stack:
[  144.585784]  ffff880030a69c18 ffff88002dacc800 0000000000000001 ffff88000ef80728
[  144.585793]  ffff88000ef80320 ffff88000f228d38 ffff880030a69c48 ffffffffa00f4aa1
[  144.585802]  ffff880030a69c48 ffff88002dacc800 ffff880030a69cb8 ffffffffa00f7ad9
[  144.585810] Call Trace:
[  144.585818]  [<ffffffffa00f4aa1>] ttm_bo_cleanup_memtype_use+0x21/0x80 [ttm]
[  144.585825]  [<ffffffffa00f7ad9>] ttm_bo_release+0x249/0x270 [ttm]
[  144.585833]  [<ffffffff81085261>] ? get_parent_ip+0x11/0x50
[  144.585839]  [<ffffffffa00f7890>] ? ttm_bo_create+0x110/0x110 [ttm]
[  144.585846]  [<ffffffff812c2007>] kref_put+0x37/0x70
[  144.585852]  [<ffffffffa00f541d>] ttm_bo_unref+0x3d/0x50 [ttm]
[  144.585859]  [<ffffffff8139be20>] ? drm_gem_object_handle_free+0x90/0x90
[  144.585868]  [<ffffffffa012e49a>] nouveau_gem_object_del+0x3a/0x70 [nouveau]
[  144.585874]  [<ffffffff8139be45>] drm_gem_object_free+0x25/0x40
[  144.585879]  [<ffffffff812c2007>] kref_put+0x37/0x70
[  144.585890]  [<ffffffffa014b401>] nouveau_fbcon_fini+0xb1/0x130 [nouveau]
[  144.585899]  [<ffffffffa0121f05>] nouveau_unload+0x1b5/0x220 [nouveau]
[  144.585904]  [<ffffffff8139a302>] ? drm_lastclose+0x2b2/0x300
[  144.585910]  [<ffffffff813a038e>] drm_put_dev+0x6e/0x240
[  144.585918]  [<ffffffffa0121018>] nouveau_pci_remove+0x18/0x20 [nouveau]
[  144.585924]  [<ffffffff812e6eb2>] pci_device_remove+0x32/0x60
[  144.585930]  [<ffffffff813b8b41>] __device_release_driver+0x61/0xc0
[  144.585935]  [<ffffffff813b8c98>] device_release_driver+0x28/0x40
[  144.585940]  [<ffffffff813b81a9>] driver_unbind+0x99/0xb0
[  144.585945]  [<ffffffff813b7747>] drv_attr_store+0x27/0x30
[  144.585951]  [<ffffffff811ebb2d>] sysfs_write_file+0xdd/0x160
[  144.585957]  [<ffffffff8117d018>] vfs_write+0xc8/0x190
[  144.585962]  [<ffffffff8117d1cc>] sys_write+0x4c/0x90
[  144.585968]  [<ffffffff815df452>] system_call_fastpath+0x16/0x1b
[  144.585972] Code: 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 49 89 fe 41 55 4c 8d af 10 02 00 00 41 54 49 89 f4 53 48 83 ec 08 48 8b 9f 10 02 00 00 <4c> 8b 3e 4c 39 eb 75 13 eb 61 90 48 89 df e8 78 75 02 00 48 8b 
[  144.586053] RIP  [<ffffffffa012a805>] nouveau_bo_move_ntfy+0x25/0xb0 [nouveau]
[  144.586059]  RSP <ffff880030a69bf8>
[  144.586059] CR2: 0000000000000000
[  144.586059] ---[ end trace 520b019831a63add ]---
Dec 12 16:49:49 tst004 init: process '/bin/sh' (pid 3223) exited. Scheduling for restart.
Dec 12 16:49:49 tst004 init: starting pid 3331, tty '/dev/hvc0': '/bin/sh'
sh-4.1#