https://bugzilla.kernel.org/show_bug.cgi?id=49531

Summary: Powering down inactive GPU while running X causes NULL pointer dereference Product: Drivers Version: 2.5 Kernel Version: 3.7.0-rc2+ Platform: All OS/Version: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: Video(DRI - non Intel) AssignedTo: drivers_video-dri@kernel-bugs.osdl.org ReportedBy: e-mail@date.by CC: alexdeucher@gmail.com Regression: No

Created an attachment (id=84841) --> (https://bugzilla.kernel.org/attachment.cgi?id=84841) /var/log/syslog

On my muxed hybrid system (Lenovo IdeaPad U455) vga_switcheroo works fine if X is not running. But if both GPUs are powered and X is running, then when i try to power down inactive GPU with

# echo OFF > /sys/kernel/debug/vgaswitcheroo/switch

kernel crashes after a couple of minutes. There is an error message in the /var/log/syslog:

BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffffa046812b>] r600_pcie_gart_tlb_flush+0xeb/0x110 [radeon] PGD 8d24c067 PUD 8d24b067 PMD 0 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss ipv6 pcmcia pcmcia_core xfs exportfs ext2 mbcache cpufreq_ondemand mperf lp parport_pc parport fuse uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_core videodev media btusb bluetooth joydev brcmsmac radeon cordic brcmutil mac80211 ttm drm_kms_helper snd_hda_codec_hdmi snd_hda_codec_conexant drm cfg80211 snd_hda_intel agpgart snd_hda_codec snd_hwdep sp5100_tco ohci_hcd i2c_piix4 powernow_k8 ideapad_laptop i2c_algo_bit psmouse sparse_keymap snd_pcm ehci_hcd i2c_core processor freq_table rfkill thermal bcma rtc_cmos atl1c snd_page_alloc serio_raw k8temp thermal_sys snd_timer shpchp button battery snd soundcore hwmon evdev ac loop btrfs [last unloaded: pcmcia_core] CPU 0 Pid: 2291, comm: X Not tainted 3.7.0-rc2+ #70 LENOVO 20046 /AMD CRB RIP: 0010:[<ffffffffa046812b>] [<ffffffffa046812b>] r600_pcie_gart_tlb_flush+0xeb/0x110 [radeon] RSP: 0018:ffff8800894d1918 EFLAGS: 00010282 RAX: ffffc90001322f34 RBX: 0000000000000000 RCX: 00000000aadfb000 RDX: 0000000000000000 RSI: 0000000000002f34 RDI: ffff8800aad18000 RBP: ffff8800894d1928 R08: 00000000dfffffff R09: 00000000000000d0 R10: 0000000000031cd5 R11: 0000000000000000 R12: ffff8800aad18000 R13: 0000000000000219 R14: 0000000000000219 R15: 0000000000000000 FS: 00007f8819d618c0(0000) GS:ffff8800afa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000008d18d000 CR4: 00000000000007f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process X (pid: 2291, threadinfo ffff8800894d0000, task ffff88008d128000) Stack: ffff8800aad18000 0000000000000219 ffff8800894d1958 ffffffffa043d365 ffff8800896f1580 ffff8800894d1bc8 0000000000000000 ffff8800894d1bc8 ffff8800894d1968 ffffffffa043a98a ffff8800894d1988 ffffffffa01ef097 Call Trace: [<ffffffffa043d365>] radeon_gart_unbind+0xa5/0xe0 [radeon] [<ffffffffa043a98a>] radeon_ttm_backend_unbind+0x1a/0x20 [radeon] [<ffffffffa01ef097>] ttm_tt_unbind+0x27/0x40 [ttm] [<ffffffffa01f36e6>] ttm_bo_move_memcpy+0x266/0x580 [ttm] [<ffffffffa043b693>] radeon_bo_move+0xd3/0x180 [radeon] [<ffffffffa01f0f46>] ttm_bo_handle_move_mem+0x216/0x3f0 [ttm] [<ffffffffa01f1d10>] ? ttm_bo_mem_space+0x180/0x360 [ttm] [<ffffffffa01f2032>] ttm_bo_move_buffer+0x142/0x150 [ttm] [<ffffffffa01f20dc>] ttm_bo_validate+0x9c/0x120 [ttm] [<ffffffffa043c24a>] radeon_bo_pin_restricted+0x10a/0x1b0 [radeon] [<ffffffffa0449eab>] radeon_crtc_cursor_set+0x9b/0x4a0 [radeon] [<ffffffffa037e788>] ? drm_mode_object_find+0x68/0x90 [drm] [<ffffffffa0382425>] drm_mode_cursor_ioctl+0x105/0x160 [drm] [<ffffffffa0372443>] drm_ioctl+0x4c3/0x570 [drm] [<ffffffffa0382320>] ? drm_mode_setcrtc+0x5a0/0x5a0 [drm] [<ffffffff8154b07c>] ? __do_page_fault+0x25c/0x4b0 [<ffffffff8115e7e0>] do_vfs_ioctl+0x90/0x570 [<ffffffff8114d71b>] ? rw_verify_area+0x4b/0xf0 [<ffffffff81057d67>] ? __set_task_blocked+0x37/0x80 [<ffffffff8154748e>] ? _raw_spin_unlock_irq+0xe/0x20 [<ffffffff8105a322>] ? __set_current_blocked+0x52/0x60 [<ffffffff8115ed51>] sys_ioctl+0x91/0xb0 [<ffffffff8154f899>] system_call_fastpath+0x16/0x1b Code: c1 e8 04 83 f8 02 74 2a 85 c0 74 cc 5b 41 5c 5d c3 0f 1f 80 00 00 00 00 31 d2 be 34 2f 00 00 48 8b 9f 98 03 00 00 e8 e5 37 ff ff <8b> 03 e9 4a ff ff ff 48 c7 c7 f0 9f 4b a0 31 c0 e8 f3 5d 0d e1 RIP [<ffffffffa046812b>] r600_pcie_gart_tlb_flush+0xeb/0x110 [radeon] RSP <ffff8800894d1918> CR2: 0000000000000000 ---[ end trace 4363d7f2115bb109 ]---