Bug#819881: radeon_fence_ref BUG: unable to handle kernel NULL pointer dereference

[Erik]

I visited the Debian CDs/DVDs archive and picked Jessie 8.3 from there.
Probably the easiest and fastest solution for me.
Rock solid again.

Bug#817874: Bug#819881: radeon_fence_ref BUG: unable to handle kernel NULL pointer dereference

[Michael Lange]

On Sun, 03 Apr 2016 14:32:59 +0100
Ben Hutchings  wrote:

(...)
> Sorry about this.  There was one earlier similar report which I meant
> to investigate but didn't find time before the point release.
> 
> All three call traces are very similar and, based on the functions
> listed, I believe the attached patch (taken from the next 3.16.7-ckt
> stable update) should fix the bug.  Please test that, following the
> instructions at
> 

Thanks Ben (and sorry for the late reply). The patch you sent seems to
also fix 817874, no more frozen screens here, good work :)

Kind regards

Michael

.-.. .. ...- .   .-.. --- -. --.   .- -. -..   .--. .-. --- ... .--. . .-.

You can't evaluate a man by logic alone.
-- McCoy, "I, Mudd", stardate 4513.3

Bug#819881: radeon_fence_ref BUG: unable to handle kernel NULL pointer dereference

[Erik]

As already concluded this bug causes serious trouble! My system freezes
all the time after upgrading to 8.4. Sometimes after only a few seconds,
with the hardware reset button as the only way out.

If a fix exists I would really like it to be made public through the
update-upgrade process as soon as possible. Thank you very much for
providing a fix, but does your intention to include the fix in the next
upload to jessie-security and jessie-proposed-updates mean days or
weeks wait?

Erik




On Wed, 06 Apr 2016 15:14:00 +0100 Ben Hutchings 
wrote:
> On Wed, 2016-04-06 at 11:15 +0200, LinAdmin wrote:
> > Ben
> > 
> > After the recent upgrade of Debian Jessie several systems
> > here started suffering from the same GPF.
> > 
> > I think it would be helpful for everybody concerned if you
> > could publish in the buglist the date you intend to release
> > the upgrade fixing this bug.
> 
> I'm afraid we can't make such promises.  However, I intend to include
> the fix in the next uploads to jessie-security and to jessie-proposed-
> updates.
> 
> Ben.
> 
> > Many thanks for your help and kind regards!
> > LinAdmin
> > 
> -- 
> Ben Hutchings
> Never attribute to conspiracy what can adequately be explained by
> stupidity.

Bug#819881: radeon_fence_ref BUG: unable to handle kernel NULL pointer dereference

[Ben Hutchings]

On Wed, 2016-04-06 at 11:15 +0200, LinAdmin wrote:
> Ben
> 
> After the recent upgrade of Debian Jessie several systems
> here started suffering from the same GPF.
> 
> I think it would be helpful for everybody concerned if you
> could publish in the buglist the date you intend to release
> the upgrade fixing this bug.

I'm afraid we can't make such promises.  However, I intend to include
the fix in the next uploads to jessie-security and to jessie-proposed-
updates.

Ben.

> Many thanks for your help and kind regards!
> LinAdmin
> 
-- 
Ben Hutchings
Never attribute to conspiracy what can adequately be explained by stupidity.


signature.asc
Description: This is a digitally signed message part

Bug#819881: radeon_fence_ref BUG: unable to handle kernel NULL pointer dereference

[LinAdmin]

Ben

After the recent upgrade of Debian Jessie several systems
here started suffering from the same GPF.

I think it would be helpful for everybody concerned if you
could publish in the buglist the date you intend to release
the upgrade fixing this bug.

Many thanks for your help and kind regards!
LinAdmin

Bug#819881: radeon_fence_ref BUG: unable to handle kernel NULL pointer dereference

[Serhii Horeskyi]

Hi all,
 I have the same bug,
Debian 8.3 works fine, but after upgrading to 8.4 a have got freeze



--
Regards,
Serhii Horelskyi!

Apr  4 19:13:22 Lizarra kernel: [0.00] Initializing cgroup subsys cpuset
Apr  4 19:13:22 Lizarra kernel: [0.00] Initializing cgroup subsys cpu
Apr  4 19:13:22 Lizarra kernel: [0.00] Initializing cgroup subsys cpuacct
Apr  4 19:13:22 Lizarra kernel: [0.00] Linux version 3.16.0-4-amd64 (debian-kernel@lists.debian.org) (gcc version 4.8.4 (Debian 4.8.4-1) ) #1 SMP Debian 3.16.7-ckt25-1 (2016-03-06)
Apr  4 19:13:22 Lizarra kernel: [0.00] Command line: BOOT_IMAGE=/vmlinuz-3.16.0-4-amd64 root=UUID=32b10bd8-760e-4121-8a54-441220200383 ro quiet splash radeon.audio=1
Apr  4 19:13:22 Lizarra kernel: [0.00] e820: BIOS-provided physical RAM map:
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0x-0x0009e7ff] usable
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0x0009e800-0x0009] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0x000e-0x000f] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0x0010-0xba866fff] usable
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xba867000-0xbab42fff] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xbab43000-0xbab52fff] ACPI data
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xbab53000-0xbb956fff] ACPI NVS
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xbb957000-0xbca33fff] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xbca34000-0xbca34fff] usable
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xbca35000-0xbcc3afff] ACPI NVS
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xbcc3b000-0xbd082fff] usable
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xbd083000-0xbd7f3fff] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xbd7f4000-0xbd7f] usable
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xf800-0xfbff] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xfec0-0xfec00fff] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xfec1-0xfec10fff] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xfec2-0xfec20fff] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xfed0-0xfed00fff] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xfed61000-0xfed70fff] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xfed8-0xfed8] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0xfef0-0x] reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] BIOS-e820: [mem 0x00011000-0x00043eff] usable
Apr  4 19:13:22 Lizarra kernel: [0.00] NX (Execute Disable) protection: active
Apr  4 19:13:22 Lizarra kernel: [0.00] SMBIOS 0.7 present.
Apr  4 19:13:22 Lizarra kernel: [0.00] DMI: To be filled by O.E.M. To be filled by O.E.M./M5A97 R2.0, BIOS 2603 06/26/2015
Apr  4 19:13:22 Lizarra kernel: [0.00] e820: update [mem 0x-0x0fff] usable ==> reserved
Apr  4 19:13:22 Lizarra kernel: [0.00] e820: remove [mem 0x000a-0x000f] usable
Apr  4 19:13:22 Lizarra kernel: [0.00] AGP: No AGP bridge found
Apr  4 19:13:22 Lizarra kernel: [0.00] e820: last_pfn = 0x43f000 max_arch_pfn = 0x4
Apr  4 19:13:22 Lizarra kernel: [0.00] MTRR default type: uncachable
Apr  4 19:13:22 Lizarra kernel: [0.00] MTRR fixed ranges enabled:
Apr  4 19:13:22 Lizarra kernel: [0.00]   0-9 write-back
Apr  4 19:13:22 Lizarra kernel: [0.00]   A-B write-through
Apr  4 19:13:22 Lizarra kernel: [0.00]   C-D0FFF write-protect
Apr  4 19:13:22 Lizarra kernel: [0.00]   D1000-EBFFF uncachable
Apr  4 19:13:22 Lizarra kernel: [0.00]   EC000-F write-protect
Apr  4 19:13:22 Lizarra kernel: [0.00] MTRR variable ranges enabled:
Apr  4 19:13:22 Lizarra kernel: [0.00]   0 base  mask 8000 write-back
Apr  4 19:13:22 Lizarra kernel: [0.00]   1 base 8000 mask C000 write-back
Apr  4 19:13:22 Lizarra kernel: [0.00]   2 base BD80 mask FF80 uncachable
Apr  4 19:13:22 Lizarra kernel: [0.00]   3 base BE00 mask FE00 uncachable
Apr  4 19:13:22 Lizarra kernel: [0.00]   4 disabled
Apr  4 19:13:22 Lizarra kernel: [

Bug#819881: radeon_fence_ref BUG: unable to handle kernel NULL pointer dereference

[Patrice Huaulmé]

Hi,

Today, after updating to Debian 8.4, I had the same problem (see below
the extract from syslog). So, I reinstalled the previous package
3.16.7-ckt20-1+deb8u4 and everything back to the way it was before.

Syslog extrack
Apr  3 22:04:45 hpcore2 kernel: [ 3754.417930] BUG: unable to handle
kernel NULL pointer dereference at 0008
Apr  3 22:04:45 hpcore2 kernel: [ 3754.417982] IP: []
radeon_fence_ref+0xd/0x50 [radeon]
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418053] PGD 0 
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418067] Oops: 0002 [#1] SMP 
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418090] Modules linked in: bnep
bluetooth 6lowpan_iphc snd_hrtimer snd_seq snd_seq_device cfg80211
rfkill binfmt_misc nfsd auth_rpcgss oid_registry nfs_acl nfs lockd
fscache sunrpc usblp radeon ttm drm_kms_helper drm i2c_algo_bit pcspkr
serio_raw iTCO_wdt iTCO_vendor_support evdev coretemp i2c_i801 i2c_core
snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic
snd_hda_intel snd_hda_controller snd_hda_codec snd_hwdep snd_pcm
snd_timer snd lpc_ich mfd_core shpchp soundcore button acpi_cpufreq
processor thermal_sys loop fuse parport_pc ppdev lp parport autofs4 ext4
crc16 mbcache jbd2 usb_storage sg sd_mod crc_t10dif crct10dif_generic
sr_mod cdrom crct10dif_common ata_generic psmouse ata_piix libata
scsi_mod firewire_ohci r8169 firewire_core mii crc_itu_t ehci_pci
uhci_hcd ehci_hcd usbcore usb_common
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418642] CPU: 0 PID: 697 Comm:
Xorg Not tainted 3.16.0-4-amd64 #1 Debian 3.16.7-ckt25-1
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418677] Hardware name:
Hewlett-Packard HP Compaq dx2400 Microtower/2A73, BIOS 5.23
04/21/2008
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418716] task: 88007a9db430
ti: 88007a9ec000 task.ti: 88007a9ec000
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418746] RIP:
0010:[]  [] radeon_fence_ref
+0xd/0x50 [radeon]
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418796] RSP:
0018:88007a9efb18  EFLAGS: 00010292
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418820] RAX: 
RBX: 88007961d5f8 RCX: 88007961cd08
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418849] RDX: 0001
RSI:  RDI: 
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418878] RBP: 88007961d550
R08: 88007961c000 R09: 
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418907] R10: 0002
R11: ffec R12: 0020
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418936] R13: 88007a9efbe0
R14: 88007a9efbb0 R15: 88007961d5f8
Apr  3 22:04:45 hpcore2 kernel: [ 3754.418966] FS:
7f1092278980() GS:88007fc0() knlGS:
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419001] CS:  0010 DS:  ES:
 CR0: 80050033
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419024] CR2: 0008
CR3: 7a993000 CR4: 07f0
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419054] Stack:
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419064]  a046c0bc
002c f100 88007a9efcd0
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419106]  88007961c000
88007a9db430 88007a9db430 02e0
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419147]  
  
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419189] Call Trace:
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419217]  [] ?
radeon_sa_bo_new+0x25c/0x460 [radeon]
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419259]  [] ?
radeon_ib_get+0x2e/0xd0 [radeon]
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419301]  [] ?
radeon_cs_ioctl+0x13c/0x730 [radeon]
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419340]  [] ?
drm_ioctl+0x1c7/0x5b0 [drm]
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419371]  [] ?
__do_page_fault+0x1d1/0x4f0
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419407]  [] ?
radeon_drm_ioctl+0x46/0x80 [radeon]
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419437]  [] ?
do_vfs_ioctl+0x2cf/0x4b0
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419463]  [] ?
SyS_ioctl+0x81/0xa0
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419487]  [] ?
page_fault+0x28/0x30
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419513]  [] ?
system_call_fast_compare_end+0x10/0x15
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419543] Code: e4 48 8b 3b 89 c1
89 ea 48 c7 c6 80 b6 4f a0 31 c0 e8 68 57 f9 e0 eb cb 66 0f 1f 44 00 00
66 66 66 66 90 48 89 f8 ba 01 00 00 00  0f c1 57 08 83 c2 01 83 fa
01 7e 01 c3 80 3d 0e 43 11 00 00 
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419839] RIP  []
radeon_fence_ref+0xd/0x50 [radeon]
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419883]  RSP 
Apr  3 22:04:45 hpcore2 kernel: [ 3754.419898] CR2: 0008
Apr  3 22:04:45 hpcore2 kernel: [ 3754.430323] ---[ end trace
6f078410004efac7 ]---

Regards
Patrice

Bug#819881: radeon_fence_ref BUG: unable to handle kernel NULL pointer dereference

[Peter Palfrader]

Ben Hutchings schrieb am Sonntag, dem 03. April 2016:

> > with the latest jessie kernel, my system freezes when I visit certain
> > webpages in iceweasel (such as the system upgrade page from my
> > mikrotik
> > router).

> All three call traces are very similar and, based on the functions
> listed, I believe the attached patch (taken from the next 3.16.7-ckt
> stable update) should fix the bug.  Please test that, following the
> instructions at


That seems to do it.  Thanks for the quick turnaround.


> 

(nice documentation too!)

Cheers,
weasel
-- 
|  .''`.   ** Debian **
  Peter Palfrader   | : :' :  The  universal
 https://www.palfrader.org/ | `. `'  Operating System
|   `-https://www.debian.org/

Bug#819881: radeon_fence_ref BUG: unable to handle kernel NULL pointer dereference

[Ben Hutchings]

Control: tag -1 upstream patch

On Sun, 2016-04-03 at 14:38 +0200, Peter Palfrader wrote:
> Package: src:linux
> Version: 3.16.7-ckt25-1
> Severity: serious
> 
> Hi,
> 
> with the latest jessie kernel, my system freezes when I visit certain
> webpages in iceweasel (such as the system upgrade page from my
> mikrotik
> router).
> 
> This issue is not present in 3.16.7-ckt20-1+deb8u4.
[...]

Sorry about this.  There was one earlier similar report which I meant
to investigate but didn't find time before the point release.

All three call traces are very similar and, based on the functions
listed, I believe the attached patch (taken from the next 3.16.7-ckt
stable update) should fix the bug.  Please test that, following the
instructions at


Ben.

-- 
Ben Hutchings
The two most common things in the universe are hydrogen and stupidity.
From: Luis Henriques 
Date: Wed, 9 Mar 2016 13:58:27 +
Subject: Revert "drm/radeon: hold reference to fences in radeon_sa_bo_new"
Origin: http://kernel.ubuntu.com/git/ubuntu/linux.git/commit?id=f80be5a9b1ccf679415676f761bc9efdc3ad13b5

This reverts commit 73187980dfefe5198aadcfdf0a377e461eed2bfa, which was
commit f6ff4f67cdf8455d0a4226eeeaf5af17c37d05eb upstream.

This patch was triggering a Oops in stable kernel 3.10.99.  Christian
agrees that the patch is correct but "assumes that radeon_fence_unref()
can safely take NULL as the fence which is not the case for older
kernels."

Reported-by: Erik Andersen 
Acked-by: Christian König 
Cc: Nicolai Hähnle 
Signed-off-by: Luis Henriques 
---
 drivers/gpu/drm/radeon/radeon_sa.c | 5 -
 1 file changed, 5 deletions(-)

diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c
index 15fd57296081..adcf3e2f07da 100644
--- a/drivers/gpu/drm/radeon/radeon_sa.c
+++ b/drivers/gpu/drm/radeon/radeon_sa.c
@@ -349,13 +349,8 @@ int radeon_sa_bo_new(struct radeon_device *rdev,
 			/* see if we can skip over some allocations */
 		} while (radeon_sa_bo_next_hole(sa_manager, fences, tries));
 
-		for (i = 0; i < RADEON_NUM_RINGS; ++i)
-			radeon_fence_ref(fences[i]);
-
 		spin_unlock(_manager->wq.lock);
 		r = radeon_fence_wait_any(rdev, fences, false);
-		for (i = 0; i < RADEON_NUM_RINGS; ++i)
-			radeon_fence_unref([i]);
 		spin_lock(_manager->wq.lock);
 		/* if we have nothing to wait for block */
 		if (r == -ENOENT) {


signature.asc
Description: This is a digitally signed message part

Processed: Re: Bug#819881: radeon_fence_ref BUG: unable to handle kernel NULL pointer dereference

[Debian Bug Tracking System]

Processing control commands:

> tag -1 upstream patch
Bug #819881 [src:linux] radeon_fence_ref BUG: unable to handle kernel NULL 
pointer dereference
Bug #817874 [src:linux] linux-image-3.16.0-4-amd64: 3.16.7-ckt25-1 freeze with 
radeon driver
Added tag(s) patch and upstream.
Added tag(s) upstream and patch.

-- 
817874: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=817874
819881: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819881
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems