Bug 214375 - 5.14 Regression: Null pointer dereference in radeon_agp_head_init
Summary: 5.14 Regression: Null pointer dereference in radeon_agp_head_init
Status: RESOLVED CODE_FIX
Alias: None
Product: Drivers
Classification: Unclassified
Component: Video(DRI - non Intel) (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: drivers_video-dri
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-09-12 17:48 UTC by Calvin Walton
Modified: 2021-09-18 17:19 UTC (History)
1 user (show)

See Also:
Kernel Version: 5.14.2
Subsystem:
Regression: No
Bisected commit-id:

Attachments
Complete kernel dmesg (49.01 KB, text/plain)
2021-09-12 17:48 UTC, Calvin Walton 		Details
Bug Fix (1.05 KB, application/mbox)
2021-09-13 08:15 UTC, Nirmoy 		Details
Add an attachment (proposed patch, testcase, etc.)

Description Calvin Walton 2021-09-12 17:48:43 UTC 
Created attachment 298753 [details]
Complete kernel dmesg

I have an i586 system (ALi chipset, AMD CPU) running with a Radeon 9200 SE in an AGP slot. This system was working correctly with the 5.13 kernel series, but after switching to 5.14 I no longer have kms graphics output.

The radeon module fails to initialize with the following backtrace:

Sep 12 13:15:53 mai kernel: [drm] radeon kernel modesetting enabled.
Sep 12 13:15:53 mai kernel: radeon 0000:01:00.0: vgaarb: deactivate vga console
Sep 12 13:15:53 mai kernel: Console: switching to colour dummy device 80x25
Sep 12 13:15:53 mai kernel: BUG: kernel NULL pointer dereference, address: 00000008
Sep 12 13:15:53 mai kernel: #PF: supervisor read access in kernel mode
Sep 12 13:15:53 mai kernel: #PF: error_code(0x0000) - not-present page
Sep 12 13:15:53 mai kernel: *pde = 00000000 
Sep 12 13:15:53 mai kernel: Oops: 0000 [#1]
Sep 12 13:15:53 mai kernel: CPU: 0 PID: 288 Comm: systemd-udevd Tainted: G        W         5.14.2 #2
Sep 12 13:15:53 mai kernel: Hardware name: American Megatrends Inc.         Uknown                          /PT-2200                         , BIOS 062710                
Sep 12 13:15:53 mai kernel: EIP: radeon_agp_head_init+0xa/0xa0 [radeon]
Sep 12 13:15:53 mai kernel: Code: 85 fb fe ff 74 d6 84 c9 74 d6 84 c9 ff ff e9 f7 ff ff e9 f7 90 66 90 66 90 66 90 66 55 ba c0 0d 55 ba c0 0d 56 53 8b 70 56 53 <8b> 70 6>
Sep 12 13:15:53 mai kernel: EAX: 00000000 EBX: b3978c00 ECX: b3a21ce8 EDX: 00000dc0
Sep 12 13:15:53 mai kernel: ESI: b493e000 EDI: b1cad000 EBP: b3a21cf8 ESP: b3a21cf0
Sep 12 13:15:53 mai kernel: DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00210202
Sep 12 13:15:53 mai kernel: CR0: 80050033 CR2: 00000008 CR3: 03f86000 CR4: 00000090
Sep 12 13:15:53 mai kernel: Call Trace:
Sep 12 13:15:53 mai kernel:  radeon_driver_load_kms+0x168/0x1a0 [radeon]
Sep 12 13:15:53 mai kernel:  drm_dev_register+0xb5/0x1a0 [drm]
Sep 12 13:15:53 mai kernel:  radeon_pci_probe+0xa1/0xe0 [radeon]
Sep 12 13:15:53 mai kernel:  pci_device_probe+0x88/0x100
Sep 12 13:15:53 mai kernel:  really_probe.part.0+0x78/0x220
Sep 12 13:15:53 mai kernel:  __driver_probe_device+0x7e/0x100
Sep 12 13:15:53 mai kernel:  driver_probe_device+0x19/0xe0
Sep 12 13:15:53 mai kernel:  __driver_attach+0x81/0x140
Sep 12 13:15:53 mai kernel:  ? __device_attach_driver+0xe0/0xe0
Sep 12 13:15:53 mai kernel:  bus_for_each_dev+0x47/0x80
Sep 12 13:15:53 mai kernel:  driver_attach+0x17/0x20
Sep 12 13:15:53 mai kernel:  ? __device_attach_driver+0xe0/0xe0
Sep 12 13:15:53 mai kernel:  bus_add_driver+0xec/0x1a0
Sep 12 13:15:53 mai kernel:  driver_register+0x74/0xc0
Sep 12 13:15:53 mai kernel:  ? 0xf0e5f000
Sep 12 13:15:53 mai kernel:  __pci_register_driver+0x37/0x40
Sep 12 13:15:53 mai kernel:  radeon_module_init+0x65/0x1000 [radeon]
Sep 12 13:15:53 mai kernel:  do_one_initcall+0x33/0x120
Sep 12 13:15:53 mai kernel:  ? kfree+0x151/0x160
Sep 12 13:15:53 mai kernel:  ? __vunmap+0x1d5/0x260
Sep 12 13:15:53 mai kernel:  ? kmem_cache_alloc+0x10a/0x160
Sep 12 13:15:53 mai kernel:  do_init_module+0x45/0x240
Sep 12 13:15:53 mai kernel:  load_module+0x1cc3/0x2020
Sep 12 13:15:53 mai kernel:  ? 0xf0e5f000
Sep 12 13:15:53 mai kernel:  __ia32_sys_finit_module+0x89/0xc0
Sep 12 13:15:53 mai kernel:  do_int80_syscall_32+0x2e/0x80
Sep 12 13:15:53 mai kernel:  entry_INT80_32+0x109/0x109
Sep 12 13:15:53 mai kernel: EIP: 0xa7b66332
Sep 12 13:15:53 mai kernel: Code: 90 66 90 66 90 66 90 90 55 57 56 53 8b 6c 24 2c 8b 7c 24 28 8b 74 24 24 8b 54 24 20 8b 4c 24 1c 8b 5c 24 18 8b 44 24 14 cd 80 <5b> 5e 5>
Sep 12 13:15:53 mai kernel: EAX: ffffffda EBX: 00000016 ECX: a7cbfb05 EDX: 00000000
Sep 12 13:15:53 mai kernel: ESI: 02068a50 EDI: 020677c0 EBP: ffffffff ESP: affc0fcc
Sep 12 13:15:53 mai kernel: DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00200292
Sep 12 13:15:53 mai kernel: Modules linked in: r8169 radeon(+) realtek mdio_devres libphy snd_emu10k1 snd_ac97_codec ac97_bus snd_util_mem i2c_algo_bit snd_hwdep drm_ttm>
Sep 12 13:15:53 mai kernel: CR2: 0000000000000008
Sep 12 13:15:53 mai kernel: ---[ end trace d1e7fe80690cc5a8 ]---
Sep 12 13:15:53 mai kernel: EIP: radeon_agp_head_init+0xa/0xa0 [radeon]
Sep 12 13:15:53 mai kernel: Code: 85 fb fe ff 74 d6 84 c9 74 d6 84 c9 ff ff e9 f7 ff ff e9 f7 90 66 90 66 90 66 90 66 55 ba c0 0d 55 ba c0 0d 56 53 8b 70 56 53 <8b> 70 6>
Sep 12 13:15:53 mai kernel: EAX: 00000000 EBX: b3978c00 ECX: b3a21ce8 EDX: 00000dc0
Sep 12 13:15:53 mai kernel: ESI: b493e000 EDI: b1cad000 EBP: b3a21cf8 ESP: b3a21cf0
Sep 12 13:15:53 mai kernel: DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00210202
Sep 12 13:15:53 mai kernel: CR0: 80050033 CR2: 00000008 CR3: 03f86000 CR4: 00000090

It looks like this issue should be easy to bisect, but the system is pretty slow, so that will take a while. Please let me know if there are any other logs or debug options that you would like me to try. I've attached the full kernel boot log from the boot that this backtrace was taken from.

Note that although I'm running Gentoo, I am using an unpatched upstream kernel.
Comment 1 Nirmoy 2021-09-13 08:15:01 UTC 
Created attachment 298765 [details]
Bug Fix

Please let me know if the above patch fixes your issue. I don't have a card to test but I think the issue is we are passing an uninitialized drm device pointer.
Comment 2 Calvin Walton 2021-09-13 16:06:23 UTC 
Thank you for the quick patch! I've tested it on top of 5.14.2, and the kms driver initialization and fb console are now working correctly.
Comment 3 Calvin Walton 2021-09-18 17:19:24 UTC 
The fix has been merged in for 5.15; cheers! I see it has been tagged for stable, I'll keep an eye out for that.
Note You need to log in before you can comment on or make changes to this bug.