Subject: Re: [Bugme-new]  New: Kernel OOPSes when suspend/resume

On Tue, 26 Jun 2007 08:22:11 -0700 (PDT) bugme-daemon@bugzilla.kernel.org wrote:

> http://bugzilla.kernel.org/show_bug.cgi?id=8678
> 
>            Summary: Kernel OOPSes when suspend/resume
>            Product: Power Management
>            Version: 2.5
>      KernelVersion: 2.6.21.5
>           Platform: All
>         OS/Version: Linux
>               Tree: Mainline
>             Status: NEW
>           Severity: high
>           Priority: P1
>          Component: Hibernation/Suspend
>         AssignedTo: power-management_other@kernel-bugs.osdl.org
>         ReportedBy: cijoml@volny.cz
> 
> 
> Most recent kernel where this bug did not occur:
> Distribution: Debian Etch
> Hardware Environment: Laptop Prestigio (Pentium M)
> Software Environment: 2.6.21.5, v4l-dvb-b03a5545f8e1
> Problem Description:
> 
> --------------
> Stopping tasks ... done.
> Shrinking memory... done (0 pages freed)
> Freed 0 kbytes in 0.02 seconds (0.00 MB/s)
> Suspending console(s)
> dvb_usb_dib0700 4-1:1.0: no suspend for driver dvb_usb_dib0700?
> eth2: Going into suspend...
> ACPI: PCI interrupt for device 0000:02:0c.0 disabled
> radeonfb (0000:01:00.0): suspending for event: 1...
> ACPI: PCI interrupt for device 0000:00:1f.6 disabled
> ACPI: PCI interrupt for device 0000:00:1f.5 disabled
> ACPI: PCI interrupt for device 0000:00:1d.7 disabled
> ACPI: PCI interrupt for device 0000:00:1d.2 disabled
> ACPI: PCI interrupt for device 0000:00:1d.1 disabled
> ACPI: PCI interrupt for device 0000:00:1d.0 disabled
> swsusp: critical section:
> swsusp: Need to copy 112337 pages
> Intel machine check architecture supported.
> Intel machine check reporting enabled on CPU#0.
> ACPI: PCI Interrupt 0000:00:1d.0[A] -> Link [LNKA] -> GSI 11 (level, low) ->
> IRQ 11
> PCI: Setting latency timer of device 0000:00:1d.0 to 64
> usb usb1: root hub lost power or was reset
> ACPI: PCI Interrupt 0000:00:1d.1[B] -> Link [LNKD] -> GSI 11 (level, low) ->
> IRQ 11
> PCI: Setting latency timer of device 0000:00:1d.1 to 64
> usb usb2: root hub lost power or was reset
> ACPI: PCI Interrupt 0000:00:1d.2[C] -> Link [LNKC] -> GSI 11 (level, low) ->
> IRQ 11
> PCI: Setting latency timer of device 0000:00:1d.2 to 64
> usb usb3: root hub lost power or was reset
> ACPI: PCI Interrupt 0000:00:1d.7[D] -> Link [LNKH] -> GSI 11 (level, low) ->
> IRQ 11
> PCI: Setting latency timer of device 0000:00:1d.7 to 64
> usb usb4: root hub lost power or was reset
> ehci_hcd 0000:00:1d.7: debug port 1
> PCI: cache line size of 32 is not supported by device 0000:00:1d.7
> PCI: Setting latency timer of device 0000:00:1e.0 to 64
> ACPI: PCI Interrupt 0000:00:1f.1[A] -> Link [LNKC] -> GSI 11 (level, low) ->
> IRQ 11
> PM: Writing back config space on device 0000:00:1f.5 at offset 1 (was
> 2900007,
> writing 2900003)
> ACPI: PCI Interrupt 0000:00:1f.5[B] -> Link [LNKB] -> GSI 9 (level, low) ->
> IRQ
> 9
> PCI: Setting latency timer of device 0000:00:1f.5 to 64
> PM: Writing back config space on device 0000:00:1f.6 at offset 1 (was
> 2900005,
> writing 2900001)
> ACPI: PCI Interrupt 0000:00:1f.6[B] -> Link [LNKB] -> GSI 9 (level, low) ->
> IRQ
> 9
> PCI: Setting latency timer of device 0000:00:1f.6 to 64
> radeonfb (0000:01:00.0): resuming from state: 1...
> ohci1394: fw-host0: OHCI-1394 1.1 (PCI): IRQ=[11]  MMIO=[ffdff800-ffdfffff] 
> Max Packet=[2048]  IR/IT contexts=[4/8]
> eth0: link down
> Yenta O2: res at 0x94/0xD4: 00/ea
> Yenta O2: enabling read prefetch/write burst
> eth2: Coming out of suspend...
> ACPI: PCI Interrupt 0000:02:0c.0[A] -> Link [LNKB] -> GSI 9 (level, low) ->
> IRQ
> 9
> pnp: Failed to activate device 00:03.
> pnp: Failed to activate device 00:04.
>  usbdev4.12_ep00: PM: resume from 0, parent 4-1 still 1
> dvb_usb_dib0700 4-1:1.0: PM: resume from 1, parent 4-1 still 1
> i2c_adapter i2c-5: PM: resume from 0, parent 4-1 still 1
>  usbdev4.12_ep01: PM: resume from 0, parent 4-1:1.0 still 1
>  usbdev4.12_ep81: PM: resume from 0, parent 4-1:1.0 still 1
>  usbdev4.12_ep82: PM: resume from 0, parent 4-1:1.0 still 1
>  usbdev4.12_ep83: PM: resume from 0, parent 4-1:1.0 still 1
>  usbdev4.12: PM: resume from 0, parent 4-1 still 1
>  usbdev1.8_ep00: PM: resume from 0, parent 1-2 still 1
> hci_usb 1-2:1.0: PM: resume from 1, parent 1-2 still 1
>  hci0: PM: resume from 0, parent 1-2:1.0 still 1
>  usbdev1.8_ep81: PM: resume from 0, parent 1-2:1.0 still 1
>  usbdev1.8_ep02: PM: resume from 0, parent 1-2:1.0 still 1
>  usbdev1.8_ep82: PM: resume from 0, parent 1-2:1.0 still 1
> hci_usb 1-2:1.1: PM: resume from 1, parent 1-2 still 1
>  usbdev1.8_ep03: PM: resume from 0, parent 1-2:1.1 still 1
>  usbdev1.8_ep83: PM: resume from 0, parent 1-2:1.1 still 1
>  usbdev1.8: PM: resume from 0, parent 1-2 still 1
> Restarting tasks ... done.
> __tx_submit: hci0 tx submit failed urb f22ca854 type 1 err -19
> usb 1-2: USB disconnect, address 8
> agpgart: Found an AGP 2.0 compliant device at 0000:00:00.0.
> agpgart: Putting AGP V2 device at 0000:00:00.0 into 1x mode
> agpgart: Putting AGP V2 device at 0000:01:00.0 into 1x mode
> [drm] Loading R300 Microcode
> BUG: unable to handle kernel NULL pointer dereference at virtual address
> 00000000
>  printing eip:
> c014787a
> *pde = 00000000
> Oops: 0000 [#1]
> PREEMPT
> Modules linked in: michael_mic arc4 ecb blkcipher ieee80211_crypt_tkip
> xt_TCPMSS xt_tcpmss xt_tcpudp iptable_mangle ip_tables x_table
> s ppp_deflate zlib_deflate bsd_comp ppp_async crc_ccitt ppp_generic slhc
> mt2060
> dvb_usb_dib0700 dib7000m dib7000p dvb_usb dvb_core di
> b3000mc dibx000_common bnep rfcomm hidp hid l2cap capability commoncap eeprom
> sr_mod sbp2 scsi_mod 8250_pci 8250 serial_core eth1394
> hci_usb bluetooth snd_intel8x0m snd_intel8x0 snd_ac97_codec snd_seq_oss
> ac97_bus snd_seq_midi_event snd_seq snd_seq_device snd_pcm_os
> s snd_mixer_oss ipw2200 8139too ieee80211 ieee80211_crypt snd_pcm snd_timer
> iTCO_wdt ehci_hcd mii ohci1394 ieee1394 rtc uhci_hcd snd
> snd_page_alloc ide_cd i2c_i801 pcspkr cdrom
> CPU:    0
> EIP:    0060:[<c014787a>]    Not tainted VLI
> EFLAGS: 00010203   (2.6.21 #4)
> EIP is at put_page+0x5/0xb2
> eax: 00000000   ebx: 00000000   ecx: c0317380   edx: f63f70c0
> esi: ea6e2680   edi: f784dd84   ebp: f784de48   esp: f784dd4c
> ds: 007b   es: 007b   fs: 00d8  gs: 0033  ss: 0068
> Process syslogd (pid: 3160, ti=f784c000 task=f7995070 task.ti=f784c000)
> Stack: 00000001 ea6e2680 f784dd84 c02aebed ea6e2680 f784df20 c02aea21
> ea6e26b0
>        c02f58fb 00000036 000001ff f7ca36c0 f7dcfb00 ea6e2680 00000d1f
>        00000000
>        00000000 00000000 00000001 00000000 000001ff 0ac3ac80 00000036
>        c0317380
> Call Trace:
>  [<c02aebed>] skb_release_data+0x4e/0x80
>  [<c02aea21>] kfree_skbmem+0x8/0x61
>  [<c02f58fb>] unix_dgram_recvmsg+0x214/0x239
>  [<c02a9e24>] sock_recvmsg+0xec/0x107
>  [<c0128b23>] autoremove_wake_function+0x0/0x35
>  [<c0166775>] core_sys_select+0x1aa/0x2bc
>  [<c0160a26>] pipe_write+0x356/0x3ed
>  [<c015ae4d>] do_sync_readv_writev+0xc1/0xfe
>  [<c02aad15>] sys_recvfrom+0xd7/0x12b
>  [<c0128b23>] autoremove_wake_function+0x0/0x35
>  [<c02aada0>] sys_recv+0x37/0x3b
>  [<c02ab283>] sys_socketcall+0x19c/0x261
>  [<c0120dc5>] sigprocmask+0x94/0xb1
>  [<c0103cdc>] syscall_call+0x7/0xb
>  =======================
> Code: 42 c0 e8 66 fe ff ff 89 e0 25 00 e0 ff ff ff 48 14 8b 40 08 a8 08 74 05
> e9 18 0f 1b 00 c3 e8 b4 ff ff ff 31 c0 c3 57 56 53 89 c                       
>                                                3 <8b> 00 f6 c4 40 74 0a 89 d8
> 5b 5e 5f e9 e9 fb ff ff ff 4b 04 0f
> EIP: [<c014787a>] put_page+0x5/0xb2 SS:ESP 0068:f784dd4c

Good heavens.

Does it oops every time?  And does the oops trace always look like this?

> usb 4-1: USB disconnect, address 12
> dvb-usb: Leadtek Winfast DTV Dongle (STK7700P based) successfully
> deinitialized
> and disconnected.
> usb 4-1: new high speed USB device using ehci_hcd and address 14
> usb 4-1: configuration #1 chosen from 1 choice
> dvb-usb: found a 'Leadtek Winfast DTV Dongle (STK7700P based)' in cold state,
> will try to load a firmware
> dvb-usb: downloading firmware from file 'dvb-usb-dib0700-01.fw'
> dib0700: firmware started successfully.
> dvb-usb: found a 'Leadtek Winfast DTV Dongle (STK7700P based)' in warm state.
> i2c_adapter i2c-5: SMBus Quick command not supported, can't probe for chips
> dvb-usb: will pass the complete MPEG2 transport stream to the software
> demuxer.
> DVB: registering new adapter (Leadtek Winfast DTV Dongle (STK7700P based))
> i2c_adapter i2c-6: SMBus Quick command not supported, can't probe for chips
> DVB: registering frontend 0 (DiBcom 7000MA/MB/PA/PB/MC)...
> MT2060: successfully identified (IF1 = 1220)
> dvb-usb: Leadtek Winfast DTV Dongle (STK7700P based) successfully initialized
> and connected.
> usb 1-2: new full speed USB device using uhci_hcd and address 9
> usb 1-2: configuration #1 chosen from 1 choice
> 
> 
> ----------------
> Steps to reproduce:
> 
> suspend/resume
> 
> 
> -- 
> Configure bugmail: http://bugzilla.kernel.org/userprefs.cgi?tab=email
> ------- You are receiving this mail because: -------
> You are on the CC list for the bug, or are watching someone who is.

> > BUG: unable to handle kernel NULL pointer dereference at virtual address
> > 00000000
> >  printing eip:
> > c014787a
> > *pde = 00000000
> > Oops: 0000 [#1]
> > PREEMPT
> > Modules linked in: michael_mic arc4 ecb blkcipher ieee80211_crypt_tkip
> > xt_TCPMSS xt_tcpmss xt_tcpudp iptable_mangle ip_tables x_table
> > s ppp_deflate zlib_deflate bsd_comp ppp_async crc_ccitt ppp_generic slhc
> > mt2060 dvb_usb_dib0700 dib7000m dib7000p dvb_usb dvb_core di
> > b3000mc dibx000_common bnep rfcomm hidp hid l2cap capability commoncap
> > eeprom sr_mod sbp2 scsi_mod 8250_pci 8250 serial_core eth1394
> > hci_usb bluetooth snd_intel8x0m snd_intel8x0 snd_ac97_codec snd_seq_oss
> > ac97_bus snd_seq_midi_event snd_seq snd_seq_device snd_pcm_os
> > s snd_mixer_oss ipw2200 8139too ieee80211 ieee80211_crypt snd_pcm
> > snd_timer iTCO_wdt ehci_hcd mii ohci1394 ieee1394 rtc uhci_hcd snd
> > snd_page_alloc ide_cd i2c_i801 pcspkr cdrom
> > CPU:    0
> > EIP:    0060:[<c014787a>]    Not tainted VLI
> > EFLAGS: 00010203   (2.6.21 #4)
> > EIP is at put_page+0x5/0xb2
> > eax: 00000000   ebx: 00000000   ecx: c0317380   edx: f63f70c0
> > esi: ea6e2680   edi: f784dd84   ebp: f784de48   esp: f784dd4c
> > ds: 007b   es: 007b   fs: 00d8  gs: 0033  ss: 0068
> > Process syslogd (pid: 3160, ti=f784c000 task=f7995070 task.ti=f784c000)
> > Stack: 00000001 ea6e2680 f784dd84 c02aebed ea6e2680 f784df20 c02aea21
> > ea6e26b0 c02f58fb 00000036 000001ff f7ca36c0 f7dcfb00 ea6e2680 00000d1f
> > 00000000 00000000 00000000 00000001 00000000 000001ff 0ac3ac80 00000036
> > c0317380 Call Trace:
> >  [<c02aebed>] skb_release_data+0x4e/0x80
> >  [<c02aea21>] kfree_skbmem+0x8/0x61
> >  [<c02f58fb>] unix_dgram_recvmsg+0x214/0x239
> >  [<c02a9e24>] sock_recvmsg+0xec/0x107
> >  [<c0128b23>] autoremove_wake_function+0x0/0x35
> >  [<c0166775>] core_sys_select+0x1aa/0x2bc
> >  [<c0160a26>] pipe_write+0x356/0x3ed
> >  [<c015ae4d>] do_sync_readv_writev+0xc1/0xfe
> >  [<c02aad15>] sys_recvfrom+0xd7/0x12b
> >  [<c0128b23>] autoremove_wake_function+0x0/0x35
> >  [<c02aada0>] sys_recv+0x37/0x3b
> >  [<c02ab283>] sys_socketcall+0x19c/0x261
> >  [<c0120dc5>] sigprocmask+0x94/0xb1
> >  [<c0103cdc>] syscall_call+0x7/0xb
> >  =======================
> > Code: 42 c0 e8 66 fe ff ff 89 e0 25 00 e0 ff ff ff 48 14 8b 40 08 a8 08
> > 74 05 e9 18 0f 1b 00 c3 e8 b4 ff ff ff 31 c0 c3 57 56 53 89 c
> >                                                3 <8b> 00 f6 c4 40 74 0a
> > 89 d8 5b 5e 5f e9 e9 fb ff ff ff 4b 04 0f
> > EIP: [<c014787a>] put_page+0x5/0xb2 SS:ESP 0068:f784dd4c
>
> Good heavens.
>
> Does it oops every time?  And does the oops trace always look like this?

Hi Andrew,

let's guess why I marked it Critical ;)

Michal

Subject: Re: [Bugme-new]  New: Kernel OOPSes when suspend/resume

On Tue, 26 Jun 2007 19:42:14 +0200 CIJOML <cijoml@volny.cz> wrote:

> > > EIP is at put_page+0x5/0xb2
> > > eax: 00000000   ebx: 00000000   ecx: c0317380   edx: f63f70c0
> > > esi: ea6e2680   edi: f784dd84   ebp: f784de48   esp: f784dd4c
> > > ds: 007b   es: 007b   fs: 00d8  gs: 0033  ss: 0068
> > > Process syslogd (pid: 3160, ti=f784c000 task=f7995070 task.ti=f784c000)
> > > Stack: 00000001 ea6e2680 f784dd84 c02aebed ea6e2680 f784df20 c02aea21
> > > ea6e26b0 c02f58fb 00000036 000001ff f7ca36c0 f7dcfb00 ea6e2680 00000d1f
> > > 00000000 00000000 00000000 00000001 00000000 000001ff 0ac3ac80 00000036
> > > c0317380 Call Trace:
> > >  [<c02aebed>] skb_release_data+0x4e/0x80
> > >  [<c02aea21>] kfree_skbmem+0x8/0x61
> > >  [<c02f58fb>] unix_dgram_recvmsg+0x214/0x239
> > >  [<c02a9e24>] sock_recvmsg+0xec/0x107
> > >  [<c0128b23>] autoremove_wake_function+0x0/0x35
> > >  [<c0166775>] core_sys_select+0x1aa/0x2bc
> > >  [<c0160a26>] pipe_write+0x356/0x3ed
> > >  [<c015ae4d>] do_sync_readv_writev+0xc1/0xfe
> > >  [<c02aad15>] sys_recvfrom+0xd7/0x12b
> > >  [<c0128b23>] autoremove_wake_function+0x0/0x35
> > >  [<c02aada0>] sys_recv+0x37/0x3b
> > >  [<c02ab283>] sys_socketcall+0x19c/0x261
> > >  [<c0120dc5>] sigprocmask+0x94/0xb1
> > >  [<c0103cdc>] syscall_call+0x7/0xb
> > >  =======================
> > > Code: 42 c0 e8 66 fe ff ff 89 e0 25 00 e0 ff ff ff 48 14 8b 40 08 a8 08
> > > 74 05 e9 18 0f 1b 00 c3 e8 b4 ff ff ff 31 c0 c3 57 56 53 89 c
> > >                                                3 <8b> 00 f6 c4 40 74 0a
> > > 89 d8 5b 5e 5f e9 e9 fb ff ff ff 4b 04 0f
> > > EIP: [<c014787a>] put_page+0x5/0xb2 SS:ESP 0068:f784dd4c
> >
> > Good heavens.
> >
> > Does it oops every time?  And does the oops trace always look like this?
> 
> Hi Andrew,
> 
> let's guess why I marked it Critical ;)

dayum.  I cannot imagine how a susend/resume can cause a crash in
AF_UNIX code.  Which network device driver(s) are in use?

There are only 2 well known devices Realtek8139 and Intel 2200BG
Only explanation I have is that copy in resume copied in bug/random/accidentionally some memory part to unix socket kernel part memory??

02:0a.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ (rev 10)
        Subsystem: Uniwill Computer Corp Unknown device 9700
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B-
        Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Latency: 64 (8000ns min, 16000ns max)
        Interrupt: pin A routed to IRQ 9
        Region 0: I/O ports at c800 [size=256]
        Region 1: Memory at ffdff400 (32-bit, non-prefetchable) [size=256]
        Capabilities: [50] Power Management version 2
                Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=375mA PME(D0-,D1+,D2+,D3hot+,D3cold+)
                Status: D0 PME-Enable- DSel=0 DScale=0 PME-


02:0c.0 Network controller: Intel Corporation PRO/Wireless 2200BG Network Connection (rev 05)
        Subsystem: Intel Corporation Unknown device 2702
        Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV+ VGASnoop- ParErr- Stepping- SERR+ FastB2B-
        Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
        Latency: 64 (750ns min, 6000ns max), Cache Line Size: 64 bytes
        Interrupt: pin A routed to IRQ 9
        Region 0: Memory at ffdfd000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [dc] Power Management version 2
                Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
                Status: D0 PME-Enable- DSel=0 DScale=1 PME-

Subject: Re: [Bugme-new]  New: Kernel OOPSes when suspend/resume

On Tue, 26 Jun 2007 23:16:14 +0200
CIJOML <cijoml@volny.cz> wrote:

> > Can you please retest without DRM?
> >
> > Greetings,
> > Rafael
> 
> Ehm What is DRM??? Digital Right Management????

Direct-rendering manager: the thing which does accelerated 3d
in X.

Disable CONFIG_DRM in your .config.

I got it again:
Tested your suggestions to switch off 3D acceleration, but without success.

BUG: unable to handle kernel NULL pointer dereference at virtual address 00000000
 printing eip:
c014787a
*pde = 00000000
Oops: 0000 [#2]
PREEMPT
Modules linked in: dvb_usb_dtt200u michael_mic arc4 ecb blkcipher ieee80211_crypt_tkip xt_TCPMSS xt_tcpmss xt_tcpudp iptable_mangle ip_tables x_tables ppp_deflate zlib_deflate bsd_comp ppp_async crc_ccitt ppp_generic slhc mt2060 dvb_usb_dib0700 dib7000m dib7000p dvb_usb dvb_core dib3000mc dibx000_common bnep rfcomm hidp hid l2cap capability commoncap eeprom sr_mod sbp2 scsi_mod 8250_pci 8250 serial_core eth1394 hci_usb bluetooth snd_intel8x0m snd_intel8x0 snd_ac97_codec snd_seq_oss ac97_bus snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss ipw2200 8139too ieee80211 ieee80211_crypt snd_pcm snd_timer iTCO_wdt ehci_hcd mii ohci1394 ieee1394 rtc uhci_hcd snd snd_page_alloc ide_cd i2c_i801 pcspkr cdrom
CPU:    0
EIP:    0060:[<c014787a>]    Not tainted VLI
EFLAGS: 00010203   (2.6.21 #4)
EIP is at put_page+0x5/0xb2
eax: 00000000   ebx: 00000000   ecx: 00000000   edx: e39a1c00
esi: eb4658c0   edi: f60ac294   ebp: f60ac240   esp: f611fddc
ds: 007b   es: 007b   fs: 00d8  gs: 0033  ss: 0068
Process ksysguardd (pid: 3676, ti=f611e000 task=f615fa70 task.ti=f611e000)
Stack: 00000001 eb4658c0 f60ac294 c02aebed eb4658c0 eb4658c0 c02aea21 00000001
       c02f497f 00000000 f611fe9c f611fea4 f60d8e00 00000000 00000001 00000001
       00000001 ffffffa1 7fffffff f611fe84 00000e59 000003e8 000003e8 00000000
Call Trace:
 [<c02aebed>] skb_release_data+0x4e/0x80
 [<c02aea21>] kfree_skbmem+0x8/0x61
 [<c02f497f>] unix_stream_recvmsg+0x34f/0x4c3
 [<c02a95be>] sock_aio_read+0xfc/0x108
 [<c015b05b>] do_sync_read+0xc7/0x10a
 [<c0128b23>] autoremove_wake_function+0x0/0x35
 [<c015b871>] vfs_read+0xba/0x128
 [<c015bba8>] sys_read+0x41/0x67
 [<c0103cdc>] syscall_call+0x7/0xb
 =======================
Code: 42 c0 e8 66 fe ff ff 89 e0 25 00 e0 ff ff ff 48 14 8b 40 08 a8 08 74 05 e9 18 0f 1b 00 c3 e8 b4 ff ff ff 31 c0 c3 57 56 53 89 c3 <8b> 00 f6 c4 40 74 0a 89 d8 5b 5e 5f e9 e9 fb ff ff ff 4b 04 0f
EIP: [<c014787a>] put_page+0x5/0xb2 SS:ESP 0068:f611fddc

Can you please try with a newer kernel, preferably 2.6.23-rc2?

Or 2.6.23-rc4?

Just did it - still same issue, but rarely

Can you attach your current .config, please?

Created attachment 12850 [details]
config.gz 2.6.22.X

config.gz 2.6.22.X

Can you try with CONFIG_NO_HZ unset, please?

Hi, no change :(

Can you unset CONFIG_DRM in turn and retest?

BUG: unable to handle kernel NULL pointer dereference at virtual address 00000000
 printing eip:
c0148df6
*pde = 00000000
Oops: 0000 [#1]
PREEMPT
Modules linked in: nls_iso8859_1 nls_cp437 vfat fat sg sd_mod usb_storage bnep rfcomm hidp hid l2cap capability commoncap michael_mic
 arc4 ecb blkcipher ieee80211_crypt_tkip eeprom sr_mod sbp2 scsi_mod mt2060 hci_usb bluetooth 8250_pci 8250 serial_core dvb_usb_dtt20
0u dvb_usb_dib0700 dib7000p dib7000m dvb_usb firewire_ohci firewire_core dvb_core dib3000mc dibx000_common dib0070 snd_intel8x0m ipw2
200 snd_seq_oss ohci1394 snd_seq_midi_event ieee80211 ieee80211_crypt snd_intel8x0 snd_ac97_codec ieee1394 8139too mii ac97_bus snd_p
cm_oss snd_mixer_oss snd_seq snd_seq_device pcspkr iTCO_wdt i2c_i801 snd_pcm snd_timer ehci_hcd ide_cd rtc uhci_hcd snd snd_page_allo
c cdrom
CPU:    0
EIP:    0060:[<c0148df6>]    Not tainted VLI
EFLAGS: 00010203   (2.6.22.5 #1)
EIP is at put_page+0x5/0xb2
eax: 00000000   ebx: 00000000   ecx: 00000000   edx: f61dab40
esi: f65ca0c0   edi: f4189360   ebp: f4189300   esp: f5315dd8
ds: 007b   es: 007b   fs: 0000  gs: 0033  ss: 0068
Process sim (pid: 11765, ti=f5314000 task=c8ff1400 task.ti=f5314000)
Stack: 00000001 f65ca0c0 f4189360 c02b7724 f65ca0c0 f65ca0c0 c02b755f 00000020
       c02fe4c3 00000000 f5315f6c f5315ea0 f4d60600 00000000 00000020 00000001
       00000001 ffffffa1 00000000 f5315e80 00000d44 00000000 00000000 00000000
Call Trace:
 [<c02b7724>] skb_release_data+0x4e/0x80
 [<c02b755f>] kfree_skbmem+0x8/0x61
 [<c02fe4c3>] unix_stream_recvmsg+0x39c/0x510
 [<c02b1e33>] sock_aio_read+0xfc/0x108
 [<c01c5ec8>] avc_has_perm+0x4e/0x58
 [<c015e20a>] do_sync_read+0xc6/0x109
 [<c0128d4b>] autoremove_wake_function+0x0/0x35
 [<c015ea20>] vfs_read+0xba/0x128
 [<c015ed57>] sys_read+0x41/0x67
 [<c0103c66>] syscall_call+0x7/0xb
 =======================
Code: 42 c0 e8 66 fe ff ff 89 e0 25 00 e0 ff ff ff 48 14 8b 40 08 a8 08 74 05 e9 18 9c 1b 00 c3 e8 b4 ff ff ff 31 c0 c3 57 56 53 89 c
3 <8b> 00 f6 c4 40 74 0a 89 d8 5b 5e 5f e9 04 fc ff ff ff 4b 04 0f
EIP: [<c0148df6>] put_page+0x5/0xb2 SS:ESP 0068:f5315dd8
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Yes still the same

Please apply the patches from:

http://www.sisk.pl/kernel/hibernation_and_suspend/2.6.23-rc8/patches/

on top of 2.6.23-rc8.  Next, please apply the patch from:

http://bugzilla.kernel.org/attachment.cgi?id=12991&action=view

on top of that.  Then, please follow the instructions at:

http://bugzilla.kernel.org/show_bug.cgi?id=7499#c44

and see if you are able to reproduce the problem and in which step.

No response for three months, closing.