Bug 96532

Summary:	[BISECTED: 0955c1250e] 4.7-rc1 oops at drm_connector_cleanup+0x5c/0x1d0
Product:	DRI	Reporter:	George Spelvin <linux>
Component:	DRM/other	Assignee:	Default DRI bug account <dri-devel>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	medium	CC:	airlied, daniel, daniel
Version:	unspecified	Keywords:	bisected, have-backtrace, regression
Hardware:	x86-64 (AMD64)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:

Description George Spelvin 2016-06-14 22:31:56 UTC

Attempting to start X on 4.7-rc1 leads to kernel oops, black screen, and console lockup.  (ssh login still works.)

Problem bisected to 0955c1250e ("drm/crtc: take references to connectors used in a modeset. (v2)").  Reverting that single commit produces working X (which is what I'm running with currently).

Video card is old and non-fancy:
02:00.0 VGA compatible controller [0300]: NVIDIA Corporation GT216 [GeForce 210] [10de:0a23] (rev a2)

In case it matters, I'm running 32-bit userland (Debian/unstable) on a 64-bit kernel.

[  212.149973] nouveau 0000:02:00.0: DRM: DDC responded, but no EDID for VGA-1
[  213.842270] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[  213.842283] IP: [<ffffffff8134767c>] drm_connector_cleanup+0x5c/0x1d0
[  213.842290] PGD 41779c067 PUD 0 
[  213.842294] Oops: 0002 [#1] SMP 
[  213.842297] Modules linked in: nfsd lockd grace sunrpc via_velocity x86_pkg_temp_thermal input_leds crc32_pclmul crc32c_intel led_class [last unloaded: twofish_common]
[  213.842313] CPU: 0 PID: 5362 Comm: Xorg Not tainted 4.6.0-rc3-00678-g0955c125 #541
[  213.842317] Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./X79-UP4, BIOS F7 03/19/2014
[  213.842320] task: ffff880420c42580 ti: ffff880417404000 task.ti: ffff880417404000
[  213.842324] RIP: 0010:[<ffffffff8134767c>]  [<ffffffff8134767c>] drm_connector_cleanup+0x5c/0x1d0
[  213.842329] RSP: 0018:ffff880417407c08  EFLAGS: 00010206
[  213.842331] RAX: 0000000000000000 RBX: ffff8800b9d79000 RCX: ffffea0010acde00
[  213.842511] RDX: dead000000000200 RSI: ffff88042b881078 RDI: 0000000000000007
[  213.842982] RBP: ffff88042b96e800 R08: ffff88042b881078 R09: 0000000180080007
[  213.843459] R10: ffffea0010ae2000 R11: ffff88042d803301 R12: ffff8800b9d79078
[  213.843929] R13: dead000000000200 R14: dead000000000100 R15: 0000000000000000
[  213.844414] FS:  0000000000000000(0000) GS:ffff88043fc00000(0063) knlGS:00000000f708b880
[  213.844896] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[  213.845369] CR2: 0000000000000008 CR3: 0000000417796000 CR4: 00000000001406f0
[  213.845557] Stack:
[  213.845557]  ffff8800b9d79000 0000000000000001 ffff88042b4e3000 ffff8800b9d79000
[  213.845557]  ffff88042b881000 0000000000000001 ffffffff813fda8c ffff88042b96eb88
[  213.845557]  ffffffff81328557 ffff880420c42580 ffff88042c271190 ffff8800b9d79000
[  213.845557] Call Trace:
[  213.845557]  [<ffffffff813fda8c>] ? nouveau_connector_destroy+0x2c/0x50
[  213.845557]  [<ffffffff81328557>] ? drm_crtc_helper_set_config+0xa17/0xce0
[  213.845557]  [<ffffffff8141157c>] ? nouveau_crtc_set_config+0x4c/0x110
[  213.845557]  [<ffffffff8134446c>] ? drm_mode_set_config_internal+0x5c/0x110
[  213.845557]  [<ffffffff81348a5c>] ? drm_mode_setcrtc+0x42c/0x540
[  213.845557]  [<ffffffff8133b3ac>] ? drm_ioctl+0x12c/0x4e0
[  213.845557]  [<ffffffff81348630>] ? drm_mode_setplane+0x1c0/0x1c0
[  213.845557]  [<ffffffff813f4271>] ? nouveau_drm_ioctl+0x61/0xb0
[  213.845557]  [<ffffffff813f64db>] ? nouveau_compat_ioctl+0xb/0x20
[  213.845557]  [<ffffffff81191ec5>] ? compat_SyS_ioctl+0x95/0x1890
[  213.845557]  [<ffffffff8114b40d>] ? SyS_write+0x3d/0x90
[  213.845557]  [<ffffffff810025dd>] ? do_fast_syscall_32+0x8d/0x140
[  213.845557]  [<ffffffff816c2d5f>] ? entry_SYSENTER_compat+0x4f/0x5e
[  213.845557] Code: 48 8b 73 78 4c 8d 63 78 49 be 00 01 00 00 00 00 ad de 49 bd 00 02 00 00 00 00 ad de 48 8b 06 4c 39 e6 49 89 c7 74 2b 48 8b 56 08 <48> 89 50 08 48 89 02 4c 89 36 4c 89 6e 08 48 8b 3b e8 5e 2b 00 
[  213.845557] RIP  [<ffffffff8134767c>] drm_connector_cleanup+0x5c/0x1d0
[  213.845557]  RSP <ffff880417407c08>
[  213.845557] CR2: 0000000000000008
[  213.858256] ---[ end trace e4f18a1100ceeb21 ]---

Comment 1 Thorsten Leemhuis 2016-06-27 21:08:43 UTC

George, have you seen the mail from Lucas, who wrote: "Probably the same bug as 
https://bugzilla.kernel.org/show_bug.cgi?id=119861 and already fixed in
the last -rc." Can you confirm if this issue is fixed?

Comment 2 George Spelvin 2016-06-28 12:46:55 UTC

Confirmed fixed in v4.7-rc5.  Fixed by this patch (in v4.7-rc3):

commit fffc5f59f2c68ca859c3f92b224393ed3adbe1ca
Author: Philipp Zabel <p.zabel@pengutronix.de>
Date:   Thu Jun 2 19:27:51 2016 +0200

    drm/crtc: fix connector reference counting mismatch in drm_crtc_helper_set_config

Duplicate of
https://bugzilla.kernel.org/show_bug.cgi?id=119861

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.