[Bug 1004933] New: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933 Bug ID: 1004933 Summary: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Kernel Assignee: kernel-maintainers@forge.provo.novell.com Reporter: sebastian.kratz@piraten-ahoi.de QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Created attachment 697537 --> http://bugzilla.opensuse.org/attachment.cgi?id=697537&action=edit complete dmesg this prevents me from booting. i've had the apparently terrible idea of putting attached edid in /lib/firmware a couple of weeks ago. if i unplug the monitor i can boot normally and X will detect the monitor on it's own when i replug it. this issue was apparently raised by udev, because i could boot the kernel 4.7.6-1-default before without problem, now i can't. uname -a Linux fxe 4.7.6-1-default #1 SMP PREEMPT Fri Sep 30 12:22:14 UTC 2016 (fb37fcc) x86_64 x86_64 x86_64 GNU/Linux [ 56.392430] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 [ 56.392474] IP: [<ffffffff812195f4>] set_root+0x24/0xb0 [ 56.392503] PGD 0 [ 56.392520] Oops: 0000 [#1] PREEMPT SMP [ 56.392539] Modules linked in: nf_log_ipv6 xt_pkttype nf_log_ipv4 nf_log_common xt_LOG xt_limit af_packet iscsi_ibft iscsi_boot_sysfs msr dm_crypt algif_skcipher af_alg snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep joydev uas usb_storage snd_pcm coretemp r8169 kvm_intel snd_timer iTCO_wdt iTCO_vendor_support kvm gpio_ich mii acpi_cpufreq tpm_tis fjes snd lpc_ich mfd_core soundcore ppdev tpm ip6t_REJECT nf_reject_ipv6 parport_pc parport shpchp i2c_i801 irqbypass button xt_tcpudp nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_raw ipt_REJECT nf_reject_ipv4 iptable_raw xt_CT iptable_filter ip6table_mangle nf_conntrack_netbios_ns nf_conntrack_broadcast nf_conntrack_ipv4 nf_defrag_ipv4 ip_tables xt_conntrack nf_conntrack ip6table_filter ip6_tables [ 56.393141] x_tables btrfs xor hid_generic raid6_pq usbhid ata_generic ata_piix serio_raw ehci_pci amdkfd amd_iommu_v2 radeon i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops uhci_hcd ehci_hcd usbcore ttm usb_common drm sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua [ 56.393381] CPU: 0 PID: 224 Comm: plymouthd Not tainted 4.7.5-1-default #1 [ 56.393410] Hardware name: FUJITSU ESPRIMO P2560 /D3041-A1, BIOS 6.00 R1.02.3041.A1 11/09/2010 [ 56.393451] task: ffff880036d5c100 ti: ffff880036d10000 task.ti: ffff880036d10000 [ 56.393477] RIP: 0010:[<ffffffff812195f4>] [<ffffffff812195f4>] set_root+0x24/0xb0 [ 56.393507] RSP: 0018:ffff880036d13928 EFLAGS: 00010202 [ 56.393533] RAX: ffff880036d5c100 RBX: ffff880036d13a60 RCX: 0000000000000000 [ 56.393557] RDX: ffffffff82220e88 RSI: 0000000000000000 RDI: ffff880036d13a60 [ 56.393580] RBP: ffff880036d13940 R08: 0000000000000048 R09: ffff8800d2495ba0 [ 56.393602] R10: ffff880196bdd000 R11: 0000000000000000 R12: 0000000000000000 [ 56.393626] R13: ffff88019fb0f01c R14: ffff880196bd9780 R15: ffff880198623f00 [ 56.393650] FS: 00007f2c8a81a800(0000) GS:ffff88019fc00000(0000) knlGS:0000000000000000 [ 56.393687] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 56.393706] CR2: 0000000000000008 CR3: 00000000d2984000 CR4: 00000000000406f0 [ 56.393728] Stack: [ 56.393740] ffff880036d13a60 0000000000000040 ffff88019fb0f01c ffff880036d13978 [ 56.393785] ffffffff8121a3b3 ffff88019fb0f000 ffff880036d13b74 ffff880036d13a60 [ 56.393829] ffff880196bd9780 ffff880198623f00 ffff880036d13b74 ffffffff8121dae5 [ 56.393875] Call Trace: [ 56.393895] [<ffffffff8121a3b3>] path_init+0x1e3/0x350 [ 56.393919] [<ffffffff8121dae5>] path_openat+0x65/0x13b0 [ 56.393939] [<ffffffff8121ff5e>] do_filp_open+0x7e/0xe0 [ 56.393960] [<ffffffff8120eb20>] file_open_name+0xf0/0x120 [ 56.393980] [<ffffffff8120eb7c>] filp_open+0x2c/0x50 [ 56.393998] [<ffffffff81215dd4>] kernel_read_file_from_path+0x34/0x70 [ 56.394024] [<ffffffff814ee2fa>] _request_firmware+0x40a/0xad0 [ 56.394046] [<ffffffff814ee9ec>] request_firmware+0x2c/0x40 [ 56.394085] [<ffffffffc01b81fb>] drm_load_edid_firmware+0x28b/0x430 [drm_kms_helper] [ 56.394121] [<ffffffffc01adcd3>] drm_helper_probe_single_connector_modes+0x1e3/0x4d0 [drm_kms_helper] [ 56.394159] [<ffffffffc01bacb5>] drm_fb_helper_hotplug_event+0x95/0x120 [drm_kms_helper] [ 56.394190] [<ffffffffc01bad90>] drm_fb_helper_restore_fbdev_mode_unlocked+0x50/0x70 [drm_kms_helper] [ 56.394268] [<ffffffffc021c426>] radeon_fbdev_restore_mode+0x16/0x40 [radeon] [ 56.394307] [<ffffffffc01f057e>] radeon_driver_lastclose_kms+0xe/0x20 [radeon] [ 56.394360] [<ffffffffc0059cf9>] drm_lastclose+0x29/0x120 [drm] [ 56.394390] [<ffffffffc005a0da>] drm_release+0x2ea/0x4c0 [drm] [ 56.394412] [<ffffffff81211d28>] __fput+0xb8/0x1c0 [ 56.394431] [<ffffffff810996bc>] task_work_run+0x7c/0xa0 [ 56.394452] [<ffffffff81080613>] do_exit+0x2c3/0xb90 [ 56.394471] [<ffffffff81080f5a>] do_group_exit+0x3a/0xa0 [ 56.394490] [<ffffffff81080fd0>] SyS_exit_group+0x10/0x10 [ 56.394512] [<ffffffff816bc276>] entry_SYSCALL_64_fastpath+0x1e/0xa8 [ 56.396002] DWARF2 unwinder stuck at entry_SYSCALL_64_fastpath+0x1e/0xa8 [ 56.396002] Leftover inexact backtrace: [ 56.396002] Code: 1f 84 00 00 00 00 00 66 66 66 66 90 55 65 48 8b 04 25 00 d4 00 00 48 89 e5 41 55 41 54 53 f6 47 38 40 4c 8b a0 d0 06 00 00 74 3b <41> 8b 4c 24 08 f6 c1 01 75 75 49 8b 54 24 20 49 8b 44 24 18 48 [ 56.396002] RIP [<ffffffff812195f4>] set_root+0x24/0xb0 [ 56.396002] RSP <ffff880036d13928> [ 56.396002] CR2: 0000000000000008 [ 56.396002] ---[ end trace b72a0561f3c99686 ]--- -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933#c1
--- Comment #1 from John H.
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933#c5
--- Comment #5 from John H.
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933#c6
--- Comment #6 from John H.
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933#c7
--- Comment #7 from Luis Rodriguez
Created attachment 699490 [details] dmesg with drm.debug=0x4
here you are!
Thanks, this helps a lot. I cannot reproduce this but I should be able to force the situation. Will be working on this and let you know once I have something. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933#c8
--- Comment #8 from John H.
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933#c9
--- Comment #9 from John H.
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933#c10
--- Comment #10 from Luis Rodriguez
soooo, whats the status here? booting seems to work now,
Yay.
although this maybe due to gdn switching to wayland.
Perhaps but how? The issue I saw with this code path which seemed rather racy path with getting EDID info on bootup/suspend. To this end I have had some changes I've made to firmware_class which I'd like you to test. Is it possible for you to test random kernel trees ? If so can you test this branch ? https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux-next.git/log/?h...
just had this while trying to access a tty from X.
How exactly did this happen. You booted up, and after a while you switch to a tty from X ? No suspend / resume at all ?
Mar 15 00:40:56 crest kernel: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 Mar 15 00:40:56 crest kernel: IP: set_root+0x24/0xb0 Mar 15 00:40:56 crest kernel: PGD 0 Mar 15 00:40:56 crest kernel: Mar 15 00:40:56 crest kernel: Oops: 0000 [#1] PREEMPT SMP Mar 15 00:40:56 crest kernel: Modules linked in: cpufreq_userspace overlay crypto_simd glue_helper cryptd aes_x86_64 arc4 md4 md5 nls_utf8 cifs dns_resolver fscache fuse zram nf_log_ipv6 xt_pkttype nf_log_ipv4 nf_log_common xt_LOG xt_limit af_packet iscsi_ibft iscsi_boot_sysfs msr dm_crypt algif_skcipher af_alg snd_hda_codec_realtek snd_hda_codec_generic joydev coretemp iTCO_wdt snd_hda_codec_hdmi iTCO_vendor_support snd_hda_intel gpio_ich snd_hda_codec snd_hda_core kvm_intel snd_hwdep snd_pcm r8169 snd_timer kvm fjes mii lpc_ich mfd_core snd irqbypass soundcore acpi_cpufreq shpchp ppdev tpm_tis parport_pc i2c_i801 tpm_tis_core parport tpm button ip6t_REJECT nf_reject_ipv6 xt_tcpudp nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_raw ipt_REJECT nf_reject_ipv4 iptable_raw xt_CT iptable_filter ip6table_mangle nf_conntrack_netbios_ns Mar 15 00:40:56 crest kernel: nf_conntrack_broadcast nf_conntrack_ipv4 nf_defrag_ipv4 ip_tables xt_conntrack nf_conntrack ip6table_filter ip6_tables x_tables btrfs xor hid_generic usbhid raid6_pq ata_generic ata_piix amdkfd amd_iommu_v2 serio_raw radeon i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm ehci_pci uhci_hcd ehci_hcd usbcore sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua Mar 15 00:40:56 crest kernel: CPU: 0 PID: 5528 Comm: Ethread-feedbac Not tainted 4.10.1-2-default #1 Mar 15 00:40:56 crest kernel: Hardware name: FUJITSU ESPRIMO P2560 /D3041-A1, BIOS 6.00 R1.02.3041.A1 11/09/2010 Mar 15 00:40:56 crest kernel: task: ffff92d7971c2200 task.stack: ffffb21f05a60000 Mar 15 00:40:56 crest kernel: RIP: 0010:set_root+0x24/0xb0 Mar 15 00:40:56 crest kernel: RSP: 0018:ffffb21f05a636c8 EFLAGS: 00010202 Mar 15 00:40:56 crest kernel: RAX: ffff92d7971c2200 RBX: ffffb21f05a63800 RCX: ffff92d79a166100 Mar 15 00:40:56 crest kernel: RDX: ffffffffbb232a48 RSI: 0000000000000000 RDI: ffffb21f05a63800 Mar 15 00:40:56 crest kernel: RBP: ffffb21f05a636e0 R08: 0000000000020d40 R09: ffff92d74db725a0 Mar 15 00:40:56 crest kernel: R10: 0000000000020b80 R11: ffff92d7c097d000 R12: 0000000000000000 Mar 15 00:40:56 crest kernel: R13: ffff92d7b3b6701c R14: 0000000000003a98 R15: ffffb21f05a63914 Mar 15 00:40:56 crest kernel: FS: 00007f7d9b796700(0000) GS:ffff92d81fc00000(0000) knlGS:0000000000000000 Mar 15 00:40:56 crest kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Mar 15 00:40:56 crest kernel: CR2: 0000000000000008 CR3: 0000000030e09000 CR4: 00000000000406f0 Mar 15 00:40:56 crest kernel: Call Trace: Mar 15 00:40:56 crest kernel: path_init+0x1e3/0x350 Mar 15 00:40:56 crest kernel: path_openat+0x69/0x13c0 Mar 15 00:40:56 crest kernel: ? idr_get_empty_slot+0x15a/0x340 Mar 15 00:40:56 crest kernel: ? idr_get_empty_slot+0x15a/0x340 Mar 15 00:40:56 crest kernel: ? ep_poll_callback+0xd9/0x200 Mar 15 00:40:56 crest kernel: do_filp_open+0x7e/0xe0 Mar 15 00:40:56 crest kernel: ? __kmalloc_reserve.isra.32+0x2e/0x80 Mar 15 00:40:56 crest kernel: ? platform_match+0x24/0x90 Mar 15 00:40:56 crest kernel: file_open_name+0xf0/0x120 Mar 15 00:40:56 crest kernel: filp_open+0x2c/0x50 Mar 15 00:40:56 crest kernel: kernel_read_file_from_path+0x34/0x70 Mar 15 00:40:56 crest kernel: _request_firmware+0x266/0xad0 Mar 15 00:40:56 crest kernel: ? platform_device_add+0x10e/0x260 Mar 15 00:40:56 crest kernel: request_firmware+0x32/0x50 Mar 15 00:40:56 crest kernel: drm_load_edid_firmware+0x2a0/0x460 [drm_kms_helper] Mar 15 00:40:56 crest kernel: drm_helper_probe_single_connector_modes+0x15d/0x520 [drm_kms_helper] Mar 15 00:40:56 crest kernel: drm_setup_crtcs+0x7b/0x9f0 [drm_kms_helper] Mar 15 00:40:56 crest kernel: ? drm_modeset_unlock_all+0x31/0x60 [drm] Mar 15 00:40:56 crest kernel: drm_fb_helper_hotplug_event+0xcb/0xf0 [drm_kms_helper] Mar 15 00:40:56 crest kernel: drm_fb_helper_restore_fbdev_mode_unlocked+0x50/0x70 [drm_kms_helper] Mar 15 00:40:56 crest kernel: radeon_fbdev_restore_mode+0x16/0x40 [radeon] Mar 15 00:40:56 crest kernel: radeon_driver_lastclose_kms+0xe/0x20 [radeon] Mar 15 00:40:56 crest kernel: drm_lastclose+0x34/0xf0 [drm] Mar 15 00:40:56 crest kernel: drm_release+0x2ee/0x3a0 [drm] Mar 15 00:40:56 crest kernel: __fput+0xc7/0x1d0 Mar 15 00:40:56 crest kernel: task_work_run+0x79/0xa0 Mar 15 00:40:56 crest kernel: do_exit+0x2bc/0xbb0 Mar 15 00:40:56 crest kernel: do_group_exit+0x3a/0xa0 Mar 15 00:40:56 crest kernel: get_signal+0x261/0x660 Mar 15 00:40:56 crest kernel: do_signal+0x23/0x680 Mar 15 00:40:56 crest kernel: ? hrtimer_try_to_cancel+0xaa/0x110 Mar 15 00:40:56 crest kernel: ? do_nanosleep+0x88/0xe0 Mar 15 00:40:56 crest kernel: ? hrtimer_nanosleep+0xd4/0x210 Mar 15 00:40:56 crest kernel: ? __hrtimer_init+0x90/0x90 Mar 15 00:40:56 crest kernel: exit_to_usermode_loop+0x71/0xb0 Mar 15 00:40:56 crest kernel: syscall_return_slowpath+0x54/0x60 Mar 15 00:40:56 crest kernel: entry_SYSCALL_64_fastpath+0xab/0xad Mar 15 00:40:56 crest kernel: Code: 1f 84 00 00 00 00 00 66 66 66 66 90 55 65 48 8b 04 25 c0 d3 00 00 48 89 e5 41 55 41 54 53 f6 47 38 40 4c 8b a0 c8 06 00 00 74 3b <41> 8b 4c 24 08 f6 c1 01 75 75 49 8b 54 24 20 49 8b 44 24 18 48 Mar 15 00:40:56 crest kernel: RIP: set_root+0x24/0xb0 RSP: ffffb21f05a636c8 Mar 15 00:40:56 crest kernel: CR2: 0000000000000008 Mar 15 00:40:56 crest kernel: ---[ end trace ab563ef3b7ca7d10 ]--- Mar 15 00:40:56 crest kernel: Fixing recursive fault but reboot is needed!
-- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933#c11
--- Comment #11 from John H.
(In reply to John H. from comment #9)
although this maybe due to gdm switching to wayland.
Perhaps but how? The issue I saw with this code path which seemed rather racy path with getting EDID info on bootup/suspend.
yes, i guess a race problem, too. wayland may simply be slower (or later or loading wayland-lib takes longer) then X when requesting information on screens.
To this end I have had some changes I've made to firmware_class which I'd like you to test. Is it possible for you to test random kernel trees ?
If so can you test this branch ?
https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux-next.git/log/ ?h=20170329-driver-data-v2-try2
havn't build a kernel in a while, but i'll try.
just had this while trying to access a tty from X.
How exactly did this happen. You booted up, and after a while you switch to a tty from X ? No suspend / resume at all ?
no suspend / resume. i just wanted to switch to another runlevel so i pressed ctrl + alt + f1 from X and then all rendering stopped because of the above bug. i sshd into the machine and saw i had to reboot... -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933
Luis Rodriguez
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933#c12
--- Comment #12 from Luis Rodriguez
(In reply to Luis Rodriguez from comment #10)
(In reply to John H. from comment #9)
although this maybe due to gdm switching to wayland.
Perhaps but how? The issue I saw with this code path which seemed rather racy path with getting EDID info on bootup/suspend.
yes, i guess a race problem, too. wayland may simply be slower (or later or loading wayland-lib takes longer) then X when requesting information on screens.
Ok since this is no suspend then definitely a race on init, and I've looked at the interal firmware code to know that very well -- I cannot think of any possible modern issue upstream there yet... so the the next step is to review the DRM code use of the API. The only thing I can think of as a possible culprit to the issue would be feeing the firmware before usage, or freeing of the firmware name passed. But to study this its best to use the latest and greatest -- so once you test the latest kernel I suggested we can move forward with that.
To this end I have had some changes I've made to firmware_class which I'd like you to test. Is it possible for you to test random kernel trees ?
If so can you test this branch ?
https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux-next.git/log/ ?h=20170329-driver-data-v2-try2
havn't build a kernel in a while, but i'll try.
It would be appreciated, at this point this is an issue upstream, so we need to engage and fix that there and using upstream kernels will help a lot here. If its hard for you to do this though let me know and I can provide some kernel builds, that will just take time though. Note that using linux-next is very likely to not even boot, not due to a driver issue specific to this issue but also due to many churn in code not yet ironed out in line waiting to get upstream. So thanks for testing -- but if you run into issues with it don't be surprised.
just had this while trying to access a tty from X.
How exactly did this happen. You booted up, and after a while you switch to a tty from X ? No suspend / resume at all ?
no suspend / resume. i just wanted to switch to another runlevel so i pressed ctrl + alt + f1 from X and then all rendering stopped because of the above bug. i sshd into the machine and saw i had to reboot...
Using CTLR + ALT + F1 will not switch run levels, it will just spawn a tty for you. You can also use /usr/bin/chvt for the same these days as some distros do not allow to trap CTRL + ALT + F1 anymore. The equivalent to CTRL + ALT + F1 now: chvt 1 And going back to CTRL + ALT + F7 chvt 7 -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933
http://bugzilla.opensuse.org/show_bug.cgi?id=1004933#c13
--- Comment #13 from John H.
(In reply to John H. from comment #11)
(In reply to Luis Rodriguez from comment #10)
(In reply to John H. from comment #9) To this end I have had some changes I've made to firmware_class which I'd like you to test. Is it possible for you to test random kernel trees ?
If so can you test this branch ?
https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux-next.git/log/ ?h=20170329-driver-data-v2-try2
havn't build a kernel in a while, but i'll try.
It would be appreciated, at this point this is an issue upstream, so we need to engage and fix that there and using upstream kernels will help a lot here.
If its hard for you to do this though let me know and I can provide some kernel builds, that will just take time though.
Note that using linux-next is very likely to not even boot, not due to a driver issue specific to this issue but also due to many churn in code not yet ironed out in line waiting to get upstream. So thanks for testing -- but if you run into issues with it don't be surprised.
boot? let's hope this commit will build (i used `make oldconfig`) :-). i'm away
most of the day, so don't expect a quick reply. if you want me to build a
kernel on a specific commit or specific .config, it's possible :-)
commit 5d920c893fc8ea957aa0489695a9f3dc62b13804
Author: Luis R. Rodriguez
just had this while trying to access a tty from X.
How exactly did this happen. You booted up, and after a while you switch to a tty from X ? No suspend / resume at all ?
no suspend / resume. i just wanted to switch to another runlevel so i pressed ctrl + alt + f1 from X and then all rendering stopped because of the above bug. i sshd into the machine and saw i had to reboot...
Using CTLR + ALT + F1 will not switch run levels, it will just spawn a tty for you. You can also use /usr/bin/chvt for the same these days as some distros do not allow to trap CTRL + ALT + F1 anymore.
The equivalent to CTRL + ALT + F1 now: chvt 1
And going back to CTRL + ALT + F7 chvt 7
yep and from that spawned tty i wanted to do `sudo systemctl isolate multi-user.target` -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com