Kernel oops -- IP: [<f85ba9e0>] ttm_bo_mem_put+0x20/0x30 [ttm] (radeon) 3.2.0-30 update

[John S. Gruber]

BUG: unable to handle kernel NULL pointer dereference at 0000000c
Sep 19 09:19:39 gruber-precise-laptop kernel: [ 22.039837] IP: [<f85ba9e0>] ttm_bo_mem_put+0x20/0x30 [ttm]

Consistently cannot sucessfully boot linux-image-3.2.0-30-generic-pae included in the last update. 3.2.0-29-generic-pae boots fine. Was able to ssh into system to collect this information.

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: linux-image (not installed)
ProcVersionSignature: Ubuntu 3.2.0-29.46-generic-pae 3.2.24
Uname: Linux 3.2.0-29-generic-pae i686
AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.24.
AplayDevices:
 **** List of PLAYBACK Hardware Devices ****
 card 0: SB [HDA ATI SB], device 0: ALC268 Analog [ALC268 Analog]
   Subdevices: 1/1
   Subdevice #0: subdevice #0
ApportVersion: 2.0.1-0ubuntu13
Architecture: i386
ArecordDevices:
 **** List of CAPTURE Hardware Devices ****
 card 0: SB [HDA ATI SB], device 0: ALC268 Analog [ALC268 Analog]
   Subdevices: 1/1
   Subdevice #0: subdevice #0
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: gruber 2491 F.... pulseaudio
Card0.Amixer.info:
 Card hw:0 'SB'/'HDA ATI SB at 0xce400000 irq 16'
   Mixer name : 'Realtek ALC268'
   Components : 'HDA:11c11040,11790001,00100200 HDA:10ec0268,1179ff68,00100003'
   Controls : 16
   Simple ctrls : 9
Date: Wed Sep 19 09:31:58 2012
HibernationDevice: RESUME=UUID=ad1901db-1bd6-44e1-a32c-e18e3031d048
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha i386 (20120319)
MachineType: TOSHIBA Satellite L355D
ProcEnviron:
 TERM=xterm
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcFB: 0 radeondrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.2.0-29-generic-pae root=UUID=f9e1e22a-3447-41cd-b809-2cb180ab7e94 ro
RelatedPackageVersions:
 linux-restricted-modules-3.2.0-29-generic-pae N/A
 linux-backports-modules-3.2.0-29-generic-pae N/A
 linux-firmware 1.79.1
RfKill:
 0: phy0: Wireless LAN
  Soft blocked: no
  Hard blocked: no
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 06/04/2009
dmi.bios.vendor: Insyde Corp.
dmi.bios.version: 1.90
dmi.board.asset.tag: Base Board Asset Tag
dmi.board.vendor: TOSHIBA
dmi.board.version: Base Board Version
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: Chassis Manufacturer
dmi.chassis.version: Chassis Version
dmi.modalias: dmi:bvnInsydeCorp.:bvr1.90:bd06/04/2009:svnTOSHIBA:pnSatelliteL355D:pvrPSLE0U-01000R:rvnTOSHIBA:rn:rvrBaseBoardVersion:cvnChassisManufacturer:ct10:cvrChassisVersion:
dmi.product.name: Satellite L355D
dmi.product.version: PSLE0U-01000R
dmi.sys.vendor: TOSHIBA

[Öyvind Sæther (oyvinds)]

my X died and gave me the kernel panic. total scandal. this happened about a minute after returning from suspend to disk, may be related.

Aug 25 20:02:30 [kernel] BUG: unable to handle kernel paging request at ffffea8003185810
Aug 25 20:02:30 [kernel] IP: [<ffffffff813fe293>] ttm_bo_mem_put+0x17/0x30
Aug 25 20:02:30 [kernel] PGD 0
Aug 25 20:02:30 [kernel] Oops: 0000 [#1] PREEMPT SMP
Aug 25 20:02:30 [kernel] CPU 0
Aug 25 20:02:30 [kernel] Modules linked in: fuse nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables ipt_REDIRECT iptable_mangle iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 usblp nfs lockd auth_rpcgss sunrpc rtc_cmos sg usbhid k10temp emu10k1_gp microcode
Aug 25 20:02:30 [kernel] Pid: 6318, comm: X Not tainted 3.5.2-gentoo #1 MICRO-STAR INTERNATIONAL CO.,LTD MS-7576/790GX-G65 (MS-7576)
Aug 25 20:02:30 [kernel] RIP: 0010:[<ffffffff813fe293>] [<ffffffff813fe293>] ttm_bo_mem_put+0x17/0x30
Aug 25 20:02:30 [kernel] RSP: 0018:ffff8801858fda48 EFLAGS: 00010216
Aug 25 20:02:30 [kernel] RAX: 0000007ffff50000 RBX: ffff880105ae2448 RCX: ffffc90011d00000
Aug 25 20:02:30 [kernel] RDX: ffffea00032357c0 RSI: ffff880105ae24a8 RDI: ffff880105ae2448
Aug 25 20:02:30 [kernel] RBP: ffff8801858fdb58 R08: ffff8801858fdb58 R09: 0000000000000000
Aug 25 20:02:30 [kernel] R10: dead000000100100 R11: 00000000000060de R12: ffff8801858fdb58
Aug 25 20:02:30 [kernel] R13: ffff880043f73400 R14: 0000000000000000 R15: ffff8801858fdb00
Aug 25 20:02:30 [kernel] FS: 00007f63286fe880(0000) GS:ffff88018fc00000(0000) knlGS:00000000f6398840
Aug 25 20:02:30 [kernel] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Aug 25 20:02:30 [kernel] CR2: ffffea8003185810 CR3: 0000000184dc6000 CR4: 00000000000007f0
Aug 25 20:02:30 [kernel] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Aug 25 20:02:30 [kernel] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Aug 25 20:02:30 [kernel] Process X (pid: 6318, threadinfo ffff8801858fc000, task ffff8801877020d0)
Aug 25 20:02:30 [kernel] Stack:
Aug 25 20:02:30 [kernel] ffff880105ae2448 ffffffff8140100c ffff880187800560 ffff880105ae2448
Aug 25 20:02:30 [kernel] ffff880187800560 ffff8801858fdb58 0000000000000000 ffffffff813ff691
Aug 25 20:02:30 [kernel] ffff880187800500 0000000000000001 0000000000000000 01ffffff00000001
Aug 25 20:02:30 [kernel] Call Trace:
Aug 25 20:02:30 [kernel] [<ffffffff8140100c>] ? ttm_bo_move_ttm+0x30/0x9c
Aug 25 20:02:30 [kernel] [<ffffffff813ff691>] ? ttm_bo_handle_move_mem+0x1b0/0x313
Aug 25 20:02:30 [kernel] [<ffffffff81111200>] ? cleanup_group_ids+0x34/0x42
Aug 25 20:02:30 [kernel] [<ffffffff8140040f>] ? ttm_bo_move_buffer+0xd0/0x100
Aug 25 20:02:30 [kernel] [<ffffffff813fd9f8>] ? ttm_mem_global_alloc_zone.clone.2+0x113/0x134
Aug 25 20:02:30 [kernel] [<ffffffff814004e9>] ? ttm_bo_validate+0xaa/0xe8
Aug 25 20:02:30 [kernel] [<ffffffff81400886>] ? ttm_bo_init+0x35f/0x39b
Aug 25 20:02:30 [kernel] [<ffffffff8142c202>] ? radeon_bo_create+0x227/0x283
Aug 25 20:02:30 [kernel] [<ffffffff8142bef6>] ? radeon_bo_clear_va+0xa2/0xa2
Aug 25 20:02:30 [kernel] [<ffffffff8143a87b>] ? radeon_gem_object_create+0x50/0xdc
Aug 25 20:02:30 [kernel] [<ffffffff8143ab9e>] ? ra...

[Michel Dänzer (michel-daenzer)]

Likely fixed by https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=676bc2e1e4f9072f7a640d5b7c99ffdf9709a6e7 .

[Luis Henriques (henrix)]

This seems to be related with upstreams commit d1c7871ddb1f588b8eb35affd9ee1a3d5e11cd0c "drm/radeon: fix bo creation retry path", which has already been reverted upstreams.

I'll prepare a test kernel reverting this commit so that you can confirm this.

[John S. Gruber (jsjgruber)]

Upstream bug report suggests the following as a possible patch for this problem:
 https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=676bc2e1e4f9072f7a640d5b7c99ffdf9709a6e7. That commit notes: "This reverts commit d1c7871ddb1f588b8eb35affd9ee1a3d5e11cd0c."

The referenced bad commit, https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d1c7871ddb1f588b8eb35affd9ee1a3d5e11cd0c, is one of the changes in 3.2.0-30.

  * drm/radeon: fix bo creation retry path
    - LP: #1032640

If I understand the kernel teams git repositories, I gather that would be http://kernel.ubuntu.com/git?p=ubuntu/ubuntu-precise.git;a=commit;h=1bd226f88cb88a026841aa9c40251270260ec226

[John S. Gruber (jsjgruber)]

Sorry, Luis, messages crossed.

[Luis Henriques (henrix)]

I've just uploaded a test kernel into:

http://people.canonical.com/~henrix/lp1052933/v1/i386-pae/

Could you please give it a try and report back? Thanks!

[Luis Henriques (henrix)]

Ups, just realised the crossed messages :)
Cool, so we came to the same conclusion I guess. Can you please test the kernel I've uploaded and see if that was actually the problem? thanks

[John S. Gruber (jsjgruber)]

I'll be happy to.

[John S. Gruber (jsjgruber)]

Yes, that does it.

Booted five times without problems. Was never able to boot 3.2.0-30. Thanks for the quick work.

[Luis Henriques (henrix)]

Great, thanks a lot for testing. This fix is already queued for the Precise kernel.

[Luis Henriques (henrix)]

There's a new Precise kernel available in the -proposed pocket and will soon be released. I believe this kernel should close this bug, but I would like you to confirm if possible. Could you please try it and report back? See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[John S. Gruber (jsjgruber)]

I was able to boot linux-image-3.2.0-32-generic (3.2.0-32.51) 6 out of 6 times. (When it fails with other versions it fails each boot).

Looks good here.

[Andrew Austin (andrewaclt)]

I hit this bug (Bug #1060566), and can confirm that linux-image-3.2.0-32-generic (3.2.0-32.51) fixed the issue for me.

[Luis Henriques (henrix)]

Thank you for testing. I'll be tagging this bug as 'fix released' once the Precise kernel is out.