Bug 31772

Summary:	NULL pointer dereference after loging in to KDE
Product:	Process Management	Reporter:	Hans de Bruin (jmdebruin)
Component:	Other	Assignee:	process_other
Status:	CLOSED UNREPRODUCIBLE
Severity:	normal	CC:	chris, florian
Priority:	P1
Hardware:	All
OS:	Linux
Kernel Version:	2.6.38+	Subsystem:
Regression:	Yes	Bisected commit-id:
Attachments:	lspci

Description Hans de Bruin 2011-03-23 22:16:40 UTC

Directly after loging in to kde the kernel reports a:  unable to handle kernel NULL pointer dereference.

-----------------------------------------------------------------------
BUG: unable to handle kernel NULL pointer dereference at   (null)
IP: [<c10627f0>] futex_wake+0x9e/0xdc
*pde = 00000000 
Oops: 0000 [#1] PREEMPT 
last sysfs file: /sys/devices/LNXSYSTM:00/device:00/PNP0C0A:00/power_supply/BAT0/charge_full
Modules linked in:

Pid: 1935, comm: console-kit-dae Tainted: G        W   2.6.38+ #46 Dell Inc. Latitude D430                   /0XW455
EIP: 0060:[<c10627f0>] EFLAGS: 00010283 CPU: 0
EIP is at futex_wake+0x9e/0xdc
EAX: c154eafc EBX: fffffff4 ECX: 4bb06e6c EDX: 00000001
ESI: 00000000 EDI: c15c7b5c EBP: f5581ee8 ESP: f5581ecc
 DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
Process console-kit-dae (pid: 1935, ti=f5580000 task=f603aa40 task.ti=f5580000)
Stack:
 00000001 08346000 f58d8e00 000007e0 00000001 00000000 083467e0 f5581f64
 c1063df2 ffffffff f58d8e00 b7471ffc f59161c4 f5bd2b74 b7471ffc f58d8e00
 f5581f30 c108b09f f59161c4 f5bd2b74 00000009 00000001 083467e0 f5a36058
Call Trace:
 [<c1063df2>] do_futex+0x84/0x75d
 [<c108b09f>] ? handle_mm_fault+0x72/0x84
 [<c103adc1>] ? do_page_fault+0x0/0x328
 [<c103b0bf>] ? do_page_fault+0x2fe/0x328
 [<c10645ac>] sys_futex+0xe1/0xf5
 [<c139e4e1>] syscall_call+0x7/0xb
Code: 55 ec 75 27 8b 50 24 3b 55 f0 75 1f 83 78 28 00 75 2a 83 78 2c 00 75 24 8b 55 08 85 50 34 74 0b e8 24 ff ff ff 46 3b 75 e4 7d 16 <8b> 53 0c 89 d8 8d 5a f4 8d 50 0c 39 d7 75 b5 eb 05 be ea ff ff 
EIP: [<c10627f0>] futex_wake+0x9e/0xdc SS:ESP 0068:f5581ecc
CR2: 0000000000000000
BUG: scheduling while atomic: console-kit-dae/1935/0x00000002
Modules linked in:
Pid: 1935, comm: console-kit-dae Tainted: G        W   2.6.38+ #46
Call Trace:
 [<c103f4ca>] __schedule_bug+0x47/0x4c
 [<c139cbb6>] schedule+0x5a/0x39d
 [<c114930d>] ? number+0x151/0x223
 [<c10990d0>] ? kfree+0xa7/0xb0
 [<c11da1b4>] ? i915_gem_retire_requests_ring+0xb6/0x175
 [<c11da0fa>] ? i915_gem_object_move_to_inactive+0xb8/0xbc
 [<c11e19a8>] ? intel_update_fbc+0x27/0x224
 [<c139d4ac>] schedule_timeout+0x123/0x141
 [<c104c713>] ? process_timeout+0x0/0xa
 [<c139d4de>] schedule_timeout_uninterruptible+0x14/0x16
 [<c104caf6>] msleep+0x10/0x16
 [<c11e238b>] intel_wait_for_vblank+0x4e/0x7c
 [<c11e7245>] intel_pipe_set_base+0x169/0x1d8
 [<c114a6f5>] ? snprintf+0x15/0x17
 [<c11be105>] ? drm_crtc_helper_set_config+0x4a8/0x757
 [<c11be2a0>] drm_crtc_helper_set_config+0x643/0x757
 [<c1146331>] ? kobject_action_type+0x58/0x6b
 [<c11afea2>] ? wait_for_xmitr+0x19/0x6f
 [<c11bc598>] drm_fb_helper_pan_display+0x60/0x90
 [<c115fc38>] fb_pan_display+0xbb/0xf9
 [<c116b0cd>] bit_update_start+0x15/0x31
 [<c1168826>] fbcon_switch+0x47c/0x481
 [<c11aa77a>] redraw_screen+0xfd/0x1c7
 [<c1168318>] fbcon_blank+0x1e3/0x275
 [<c11b041a>] ? serial8250_console_write+0xaa/0xe1
 [<c11b0370>] ? serial8250_console_write+0x0/0xe1
 [<c1044380>] ? __call_console_drivers+0x3b/0x48
 [<c10443e0>] ? _call_console_drivers+0x53/0x57
 [<c11aa910>] do_unblank_screen+0xcc/0x12f
 [<c11aa97d>] unblank_screen+0xa/0xc
 [<c114c890>] bust_spinlocks+0x14/0x30
 [<c10272b3>] oops_end+0x10/0x6d
 [<c103ab7e>] no_context+0x10f/0x119
 [<c103ac6f>] __bad_area_nosemaphore+0xe7/0xef
 [<c103adc1>] ? do_page_fault+0x0/0x328
 [<c103ac84>] bad_area_nosemaphore+0xd/0x10
 [<c103af10>] do_page_fault+0x14f/0x328
 [<c107dc88>] ? __alloc_pages_nodemask+0xd2/0x4b8
 [<c107dc88>] ? __alloc_pages_nodemask+0xd2/0x4b8
 [<c103adc1>] ? do_page_fault+0x0/0x328
 [<c139e870>] error_code+0x58/0x60
 [<c106007b>] ? pc_clock_gettime+0xa/0x3d
 [<c103adc1>] ? do_page_fault+0x0/0x328
 [<c10627f0>] ? futex_wake+0x9e/0xdc
 [<c1063df2>] do_futex+0x84/0x75d
 [<c108b09f>] ? handle_mm_fault+0x72/0x84
 [<c103adc1>] ? do_page_fault+0x0/0x328
 [<c103b0bf>] ? do_page_fault+0x2fe/0x328
 [<c10645ac>] sys_futex+0xe1/0xf5
 [<c139e4e1>] syscall_call+0x7/0xb
---[ end trace 9118e103706e1bcd ]---
note: console-kit-dae[1935] exited with preempt_count 1

----------------------------------------

The patch at https://patchwork.kernel.org/patch/636001/ is already in my tree

Comment 1 Hans de Bruin 2011-03-23 22:18:16 UTC

Created attachment 51832 [details]
lspci

Comment 2 Chris Wilson 2011-03-24 08:21:22 UTC

The bug is in the futex code.

Comment 3 Hans de Bruin 2011-03-30 15:22:34 UTC

The bisect I did was a total failure. The bug has disappeared in rc1.

Comment 4 Florian Mickler 2011-04-06 09:49:03 UTC

A patch referencing this bug report has been merged in 1:

commit 9f01b25048ad12b5d71f4f7d3b62ef737639a08d
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Thu Mar 24 11:37:03 2011 +0000

    drm/i915: Busy-spin wait_for condition in atomic contexts

Comment 5 Chris Wilson 2011-04-06 10:13:37 UTC

(In reply to comment #4)
> A patch referencing this bug report has been merged in 1:
> 
> commit 9f01b25048ad12b5d71f4f7d3b62ef737639a08d
> Author: Chris Wilson <chris@chris-wilson.co.uk>
> Date:   Thu Mar 24 11:37:03 2011 +0000
> 
>     drm/i915: Busy-spin wait_for condition in atomic contexts

Note that this was only for the subsequent warning and not the original oops.

Comment 6 Florian Mickler 2011-04-06 19:41:39 UTC

Ok, I'm closing this as unreproducible then.

[The message #4 is just me test-driving a script which posts these messages to bugzilla (and noting just now that I screwed up the 'git tag --contains' stance to produce only a '1' where it should have been the tag :) )]

Comment 7 Chris Wilson 2011-04-06 19:48:28 UTC

And I just thought you were being remarkably efficient! :)