Is: Regression introduced by 0108bc808107b97e101b15af9705729626be6447 - drm/nouveau: do not allow negative sizes for now (Was:Re: nouveau crash with 3.11-rc2)

[Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>]

On Fri, Jul 26, 2013 at 04:37:32PM -0400, Ilia Mirkin wrote:
> On Fri, Jul 26, 2013 at 2:28 PM, konrad wilk <konrad.wilk@oracle.com> wrote:
> > I just saw this on a box of mine (rc1 worked) I hadn't done yet a bisection.
> > Any suggestions?
> >
> > ring 0 polarity 1
> > [    6.023776] Already setup the GSI :22
> > ^G^G^G^G^G^G^G^G^G^G^G^G^G^G^G^G^G^G^G^G^G^G^G[    6.036680] nouveau  [
> > DEVICE][0000:00:0d.0] BOOT0  : 0x04c000a2
> > [    6.036740] nouveau  [  DEVICE][0000:00:0d.0] Chipset: C61 (NV4C)
> > [    6.036792] nouveau  [  DEVICE][0000:00:0d.0] Family : NV40
> > [    6.038554] nouveau  [   VBIOS][0000:00:0d.0] checking PRAMIN for
> > image...
> > [    6.062295] ata1: SATA link down (SStatus 0 SControl 300)
> > [    6.077777] nouveau  [   VBIOS][0000:00:0d.0] ... appears to be valid
> > [    6.077829] nouveau  [   VBIOS][0000:00:0d.0] using image from PRAMIN
> > [    6.078024] nouveau  [   VBIOS][0000:00:0d.0] BIT signature found
> > [    6.078076] nouveau  [   VBIOS][0000:00:0d.0] version 05.61.32.22.01
> > [    6.078666] skge 0000:01:08.0 eth2: addr 00:0a:5e:65:74:93
> > [    6.086529] nouveau  [     PFB][0000:00:0d.0] RAM type: unknown
> > [    6.086594] nouveau  [     PFB][0000:00:0d.0] RAM size: 128 MiB
> > [    6.086648] nouveau  [     PFB][0000:00:0d.0]    ZCOMP: 0 tags
> > [    6.115583] nouveau  [  PTHERM][0000:00:0d.0] FAN control: none /
> > external
> > [    6.115645] nouveau  [  PTHERM][0000:00:0d.0] fan management: disabled
> > [    6.115698] nouveau  [  PTHERM][0000:00:0d.0] internal sensor: no
> > [    6.140702] [TTM] Zone  kernel: Available graphics memory: 461396 kiB
> > [    6.140763] [TTM] Initializing pool allocator
> > [    6.140852] [TTM] Initializing DMA pool allocator
> > [    6.141034] Failed to add WC MTRR for
> > [00000000e0000000-00000000efffffff]; performance may suffer.
> > [    6.141095] nouveau  [     DRM] VRAM: 125 MiB
> > [    6.141189] nouveau  [     DRM] GART: 512 MiB
> > [    6.141242] nouveau  [     DRM] TMDS table version 1.1
> > [    6.141293] nouveau  [     DRM] DCB version 3.0
> > [    6.141342] nouveau  [     DRM] DCB outp 00: 01000310 00000023
> > [    6.141421] nouveau  [     DRM] DCB outp 01: 00110204 97e50000
> > [    6.141471] nouveau  [     DRM] DCB conn 00: 0000
> > [    6.141839] nouveau  [     DRM] Saving VGA fonts
> > [    6.180531] BUG: unable to handle kernel NULL pointer dereference at
> > (null)
> > [    6.180657] IP: [<ffffffffa019b316>] nouveau_bo_new+0x36/0x330 [nouveau]
> > [    6.180775] PGD 29449067 PUD 28aad067 PMD 0
> > [    6.180907] Oops: 0000 [#1] SMP
> > [    6.181013] Modules linked in: nouveau(+) skge e1000 fbcon tileblit font
> > bitblit ttm softcursor ata_generic sata_nv drm_kms_helper mxm_wmi video wmi
> > libata scsi_mod mperf xen_blkfront xen_netfront fb_sys_fops sysimgblt
> > sysfillrect syscopyarea xenfs xen_privcmd
> > [    6.181953] CPU: 0 PID: 428 Comm: kworker/0:1 Not tainted
> > 3.11.0-rc2upstream-00185-g07bc9dc #1
> > [    6.182016] Hardware name: BIOSTAR Group N61PB-M2S/N61PB-M2S, BIOS 6.00
> > PG 09/03/2009
> > [    6.182084] Workqueue: events work_for_cpu_fn
> > [    6.182167] task: ffff880037e69000 ti: ffff88003791a000 task.ti:
> > ffff88003791a000
> > [    6.182228] RIP: e030:[<ffffffffa019b316>] [<ffffffffa019b316>]
> > nouveau_bo_new+0x36/0x330 [nouveau]
> > [    6.182344] RSP: e02b:ffff88003791ba88  EFLAGS: 00010287
> > [    6.182396] RAX: 0000000000000000 RBX: ffff880028f7f000 RCX:
> > 0000000000000004
> > [    6.182457] RDX: 0000000000000100 RSI: 0000000000004000 RDI:
> > ffff88002b576800
> > [    6.182511] RBP: ffff88003791bb08 R08: 0000000000000000 R09:
> > 0000000000000000
> > [    6.182565] R10: 0000000000000004 R11: 0000000000000100 R12:
> > 0000000000004000
> > [    6.182619] R13: ffff88002b1e3000 R14: ffffffffa01fe740 R15:
> > 0000000000000000
> > [    6.182679] FS:  00007f3da25417a0(0000) GS:ffff88003de00000(0000)
> > knlGS:0000000000000000
> > [    6.182748] CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b
> > [    6.182798] CR2: 0000000000000000 CR3: 0000000027416000 CR4:
> > 0000000000000660
> > [    6.182851] Stack:
> > [    6.182896]  ffff88003791bae8 ffffffff811aa1f9 ffff88002b576800
> > ffff880027aad240
> > [    6.183108]  ffff8800000080d0 ffffffff8142a566 ffff880028f7f000
> > ffff880028f7f000
> > [    6.183295]  ffff88002b576800 0000000000000000 ffffffffa01fe740
> > ffff880028f7f000
> > [    6.183488] Call Trace:
> > [    6.183544]  [<ffffffff811aa1f9>] ? __kmalloc+0x259/0x2a0
> > [    6.183603]  [<ffffffff8142a566>] ?
> > drm_mode_crtc_set_gamma_size+0x26/0x60
> > [    6.183680]  [<ffffffffa01ac86f>] nv04_crtc_create+0xdf/0x160 [nouveau]
> > [    6.183757]  [<ffffffffa01b289a>] nv04_display_create+0x11a/0x400
> > [nouveau]
> > [    6.183813]  [<ffffffff810b817e>] ? __cancel_work_timer+0x7e/0x110
> > [    6.183886]  [<ffffffffa01a79a8>] nouveau_display_create+0x598/0x5a0
> > [nouveau]
> > [    6.183981]  [<ffffffffa019633c>] nouveau_drm_load+0x25c/0x670 [nouveau]
> > [    6.184040]  [<ffffffff8143a479>] ? device_register+0x19/0x20
> > [    6.184098]  [<ffffffff8142018c>] ? drm_get_minor+0x1fc/0x280
> > [    6.187041]  [<ffffffff814222a8>] drm_get_pci_dev+0x178/0x2a0
> > [    6.187096]  [<ffffffff81332ee3>] ? pcibios_set_master+0x83/0xb0
> > [    6.187194]  [<ffffffffa0195a6f>] nouveau_drm_probe+0x1df/0x2a0 [nouveau]
> > [    6.187257]  [<ffffffff8133617e>] local_pci_probe+0x1e/0x40
> > [    6.187310]  [<ffffffff810b4813>] work_for_cpu_fn+0x13/0x20
> > [    6.187363]  [<ffffffff810b83f7>] process_one_work+0x177/0x510
> > [    6.187419]  [<ffffffff810490e6>] ? xen_spin_lock+0xa6/0x110
> > [    6.187473]  [<ffffffff810b9918>] worker_thread+0x328/0x440
> > [    6.187525]  [<ffffffff810b95f0>] ? manage_workers+0x2e0/0x2e0
> > [    6.187580]  [<ffffffff810bf9c6>] kthread+0xc6/0xd0
> > [    6.187632]  [<ffffffff8103a209>] ? xen_end_context_switch+0x19/0x20
> > [    6.187686]  [<ffffffff810bf900>] ?
> > kthread_freezable_should_stop+0x80/0x80
> > [    6.187741]  [<ffffffff8169abbc>] ret_from_fork+0x7c/0xb0
> > [    6.187795]  [<ffffffff810bf900>] ?
> > kthread_freezable_should_stop+0x80/0x80
> > [    6.187847] Code: 83 c4 80 4c 89 65 e0 4c 89 7d f8 41 89 f4 48 89 5d d8
> > 4c 89 6d e8 45 89 cf 4c 89 75 f0 4c 8b af 48 03 00 00 49 8b 85 a0 00 00 00
> > <48> 8b 00 0f b6 48 79 b8 ff ff ff ff d3 e0 25 ff ff ff 7f 39 f0
> > [    6.190022] RIP  [<ffffffffa019b316>] nouveau_bo_new+0x36/0x330 [nouveau]
> > [    6.190126]  RSP <ffff88003791ba88>
> > [    6.190174] CR2: 0000000000000000
> > [    6.190237] ---[ end trace 8a2242fd8f3993aa ]---
> > [    6.190329] BUG: unable to handle kernel paging request at
> > ffffffffffffffd8
> > [    6.190446] IP: [<ffffffff810bf26b>] kthread_data+0xb/0x20
> > [    6.190535] PGD 1a0f067 PUD 1a11067 PMD 0
> > [    6.190686] Oops: 0000 [#2] SMP
> > [    6.190797] Modules linked in: nouveau(+) skge e1000 fbcon tileblit font
> > bitblit ttm softcursor ata_generic sata_nv drm_kms_helper mxm_wmi video wmi
> > libata scsi_mod mperf xen_blkfront xen_netfront fb_sys_fops sysimgblt
> > sysfillrect syscopyarea xenfs xen_privcmd
> > [    6.191813] CPU: 0 PID: 428 Comm: kworker/0:1 Tainted: G D
> > 3.11.0-rc2upstream-00185-g07bc9dc #1
> > [    6.191882] Hardware name: BIOSTAR Group N61PB-M2S/N61PB-M2S, BIOS 6.00
> > PG 09/03/2009
> > [    6.191956] task: ffff880037e69000 ti: ffff88003791a000 task.ti:
> > ffff88003791a000
> > [    6.192021] RIP: e030:[<ffffffff810bf26b>] [<ffffffff810bf26b>]
> > kthread_data+0xb/0x20
> > [    6.192120] RSP: e02b:ffff88003791b668  EFLAGS: 00010096
> > [    6.192170] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
> > ffffffff81cf33a0
> > [    6.192231] RDX: 0000000000000008 RSI: 0000000000000000 RDI:
> > ffff880037e69000
> > [    6.192288] RBP: ffff88003791b668 R08: 0000000000000015 R09:
> > 000000000000b74c
> > [    6.192343] R10: 0000000004eb2451 R11: ffff88003de00000 R12:
> > 0000000000000000
> > [    6.192396] R13: ffff880037e69410 R14: ffff880037ec3800 R15:
> > ffff88003791b780
> > [    6.192452] FS:  00007f3da25417a0(0000) GS:ffff88003de00000(0000)
> > knlGS:0000000000000000
> > [    6.192519] CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b
> > [    6.192572] CR2: 0000000000000028 CR3: 0000000027416000 CR4:
> > 0000000000000660
> > [    6.192626] Stack:
> > [    6.192697]  ffff88003791b688 ffffffff810b5ed0 ffff88003791b688
> > ffff88003de141c0
> > [    6.192899]  ffff88003791b718 ffffffff8169068b ffff88003791b6a8
> > ffff88003791a000
> > [    6.193092]  ffff88003791a000 ffff88003791bfd8 ffff88003791a010
> > ffff88003791a000
> > [    6.193283] Call Trace:
> > [    6.193343]  [<ffffffff810b5ed0>] wq_worker_sleeping+0x10/0x90
> > [    6.193403]  [<ffffffff8169068b>] __schedule+0x5db/0x820
> > [    6.193459]  [<ffffffff810490e6>] ? xen_spin_lock+0xa6/0x110
> > [    6.193516]  [<ffffffff81690994>] schedule+0x24/0x70
> > [    6.193574]  [<ffffffff8109ed4c>] do_exit+0x7bc/0xbf0
> > [    6.193628]  [<ffffffff81693a20>] oops_end+0xb0/0xf0
> > [    6.193683]  [<ffffffff8108c4b5>] no_context+0x115/0x2d0
> > [    6.193737]  [<ffffffff8108c78d>] __bad_area_nosemaphore+0x11d/0x220
> > [    6.193795]  [<ffffffff813159c4>] ? snprintf+0x34/0x40
> > [    6.193855]  [<ffffffff8108c89e>] bad_area_nosemaphore+0xe/0x10
> > [    6.193919]  [<ffffffff81696822>] __do_page_fault+0x442/0x520
> > [    6.193976]  [<ffffffff810bc5c8>] ? __kernel_text_address+0x58/0x80
> > [    6.194035]  [<ffffffff8104f014>] ? print_context_stack+0x74/0xd0
> > [    6.194118]  [<ffffffff8104dc9f>] ? dump_trace+0x17f/0x300
> > [    6.194174]  [<ffffffff81696909>] do_page_fault+0x9/0x10
> > [    6.194228]  [<ffffffff81692e98>] page_fault+0x28/0x30
> > [    6.194304]  [<ffffffffa019b316>] ? nouveau_bo_new+0x36/0x330 [nouveau]
> > [    6.194363]  [<ffffffff816879e1>] ? kmemleak_alloc+0x21/0x50
> > [    6.194424]  [<ffffffff811aa1f9>] ? __kmalloc+0x259/0x2a0
> > [    6.194486]  [<ffffffff8142a566>] ?
> > drm_mode_crtc_set_gamma_size+0x26/0x60
> > [    6.194564]  [<ffffffffa01ac86f>] nv04_crtc_create+0xdf/0x160 [nouveau]
> > [    6.194643]  [<ffffffffa01b289a>] nv04_display_create+0x11a/0x400
> > [nouveau]
> > [    6.194701]  [<ffffffff810b817e>] ? __cancel_work_timer+0x7e/0x110
> > [    6.194778]  [<ffffffffa01a79a8>] nouveau_display_create+0x598/0x5a0
> > [nouveau]
> > [    6.194866]  [<ffffffffa019633c>] nouveau_drm_load+0x25c/0x670 [nouveau]
> > [    6.194923]  [<ffffffff8143a479>] ? device_register+0x19/0x20
> > [    6.194988]  [<ffffffff8142018c>] ? drm_get_minor+0x1fc/0x280
> > [    6.195048]  [<ffffffff814222a8>] drm_get_pci_dev+0x178/0x2a0
> > [    6.195104]  [<ffffffff81332ee3>] ? pcibios_set_master+0x83/0xb0
> > [    6.195181]  [<ffffffffa0195a6f>] nouveau_drm_probe+0x1df/0x2a0 [nouveau]
> > [    6.195240]  [<ffffffff8133617e>] local_pci_probe+0x1e/0x40
> > [    6.195293]  [<ffffffff810b4813>] work_for_cpu_fn+0x13/0x20
> > [    6.195348]  [<ffffffff810b83f7>] process_one_work+0x177/0x510
> > [    6.195403]  [<ffffffff810490e6>] ? xen_spin_lock+0xa6/0x110
> > [    6.195481]  [<ffffffff810b9918>] worker_thread+0x328/0x440
> > [    6.195546]  [<ffffffff810b95f0>] ? manage_workers+0x2e0/0x2e0
> > [    6.195604]  [<ffffffff810bf9c6>] kthread+0xc6/0xd0
> > [    6.195660]  [<ffffffff8103a209>] ? xen_end_context_switch+0x19/0x20
> > [    6.195718]  [<ffffffff810bf900>] ?
> > kthread_freezable_should_stop+0x80/0x80
> > [    6.195778]  [<ffffffff8169abbc>] ret_from_fork+0x7c/0xb0
> > [    6.195831]  [<ffffffff810bf900>] ?
> > kthread_freezable_should_stop+0x80/0x80
> > [    6.195884] Code: 00 48 89 e5 48 8b 40 c8 c9 48 c1 e8 02 83 e0 01 c3 66
> > 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 8b 87 b8 03 00 00 55 48 89 e5
> > <48> 8b 40 d8 c9 c3 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00
> > [    6.198024] RIP  [<ffffffff810bf26b>] kthread_data+0xb/0x20
> > [    6.198104]  RSP <ffff88003791b668>
> > [    6.198150] CR2: ffffffffffffffd8
> > [    6.198198] ---[ end trace 8a2242fd8f3993ab ]---
> > [    6.198273] Fixing recursive fault but reboot is needed!
> 
> I've run into the same thing with a NV18 card. I'm pretty sure that
> commit 0108bc808107b97e101b15af9705729626be6447 is responsible -- try
> rolling it back.

Hey Ilia,
You were right. Reverting that on top v3.11-rc3 did indeed fix the issue.

Ben, Maarten, any ideas on a fix for the regression bug?
> 
>   -ilia