glxgears crashes radeon driver (kernel 2.6.34-rc6-git3)

[Jean Delvare]

Hi,

With kernels 2.6.34-rc6-git{1,2,3}, glxgears crashes the radeon driver
on my machine. Kernel 2.6.33.3 works fine. Log of the crash:

glxinfo:5192 freeing invalid memtype 40102000-40112000
glxinfo:5192 freeing invalid memtype 40112000-40122000
glxinfo:5192 freeing invalid memtype 40122000-40132000
glxinfo:5192 freeing invalid memtype 40132000-40142000
glxinfo:5192 freeing invalid memtype 40142000-40152000
glxinfo:5192 freeing invalid memtype 40152000-40162000
glxinfo:5192 freeing invalid memtype 40162000-40172000
glxinfo:5192 freeing invalid memtype 40172000-40182000
glxinfo:5192 freeing invalid memtype 40182000-40192000
glxinfo:5192 freeing invalid memtype 40192000-401a2000
glxinfo:5192 freeing invalid memtype 401a2000-401b2000
glxinfo:5192 freeing invalid memtype 401b2000-401c2000
glxinfo:5192 freeing invalid memtype 401c2000-401d2000
glxinfo:5192 freeing invalid memtype 401d2000-401e2000
glxinfo:5192 freeing invalid memtype 401e2000-401f2000
glxinfo:5192 freeing invalid memtype 401f2000-40202000
glxinfo:5192 freeing invalid memtype 40202000-40212000
glxinfo:5192 freeing invalid memtype 40212000-40222000
glxinfo:5192 freeing invalid memtype 40222000-40232000
glxinfo:5192 freeing invalid memtype 40232000-40242000
glxinfo:5192 freeing invalid memtype 40242000-40252000
glxinfo:5192 freeing invalid memtype 40252000-40262000
glxinfo:5192 freeing invalid memtype 40262000-40272000
glxinfo:5192 freeing invalid memtype 40272000-40282000
glxinfo:5192 freeing invalid memtype 40282000-40292000
glxinfo:5192 freeing invalid memtype 40292000-402a2000
glxinfo:5192 freeing invalid memtype 402a2000-402b2000
glxinfo:5192 freeing invalid memtype 402b2000-402c2000
glxinfo:5192 freeing invalid memtype 402c2000-402d2000
glxinfo:5192 freeing invalid memtype 402d2000-402e2000
glxinfo:5192 freeing invalid memtype 402e2000-402f2000
glxinfo:5192 freeing invalid memtype 402f2000-40302000
BUG: unable to handle kernel paging request at 06000001
IP: [<f9ba559e>] radeon_cp_cmdbuf+0x15e/0x1cf0 [radeon]
*pde = 00000000 
Oops: 0000 [#1] PREEMPT SMP 
last sysfs file: /sys/devices/pci0000:00/0000:00:1f.3/i2c-0/0-002e/temp3_alarm
Modules linked in: ip6t_LOG xt_tcpudp xt_pkttype ipt_LOG xt_limit nfsd lockd sunrpc exportfs lm85 hwmon_vid binfmt_misc
 snd_pcm_oss snd_mixer_oss snd_seq snd_seq_device radeon ttm drm_kms_helper drm ip6t_REJECT nf_conntrack_ipv6 ip6table_raw
 xt_NOTRACK ipt_REJECT xt_state iptable_raw iptable_filter ip6table_mangle nf_conntrack_netbios_ns nf_conntrack_ipv4
 nf_conntrack nf_defrag_ipv4 ip_tables ip6table_filter ip6_tables x_tables ipv6 fuse nls_cp437 isofs loop dm_mod dvb_pll
 cx22702 cx88_dvb cx88_vp3054_i2c videobuf_dvb dvb_core snd_intel8x0 snd_ac97_codec cx8802 cx8800 ac97_bus cx88xx iTCO_wdt
 parport_pc v4l2_common snd_pcm parport ir_common i2c_algo_bit tveeprom snd_timer videodev v4l1_compat ir_core i2c_i801
 intel_agp btcx_risc snd videobuf_dma_sg soundcore e100 thermal sr_mod pcspkr processor button mii snd_page_alloc
 videobuf_core i2c_core cdrom agpgart sg usbhid hid uhci_hcd ehci_hcd sd_mod usbcore edd fan thermal_sys hwmon ext3 mbcache
 jbd ide_pci_generic ata_piix piix via82cxxx amd74xx ide_core ata_generic pata_amd libata [last unloaded: i2c_dev]

Pid: 5195, comm: glxgears Not tainted 2.6.34-rc6-git3 #170 D865GBF                        /        
EIP: 0060:[<f9ba559e>] EFLAGS: 00210202 CPU: 0
EIP is at radeon_cp_cmdbuf+0x15e/0x1cf0 [radeon]
EAX: 06000001 EBX: 09da9278 ECX: 06000001 EDX: 00000001
ESI: ffffffea EDI: c2712d80 EBP: f6546e28 ESP: f6546c4c
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process glxgears (pid: 5195, ti=f6546000 task=c41beaa0 task.ti=f6546000)
Stack:
 00000001 f9c38aef f9c25601 f9c38c26 00000000 00000000 08000000 40000000
<0> f6546d40 00040000 00040000 00040000 00040000 c2712d80 f6546e70 f66e0000
<0> f6b16c00 f64a1000 00000001 00000000 e6d0e8e0 f9c80000 0003ffff 00000007
Call Trace:
 [<c10627f9>] ? lock_release_non_nested+0x89/0x2c0
 [<c10627f9>] ? lock_release_non_nested+0x89/0x2c0
 [<c1090632>] ? might_fault+0x42/0x90
 [<c1090632>] ? might_fault+0x42/0x90
 [<c1090632>] ? might_fault+0x42/0x90
 [<c1090678>] ? might_fault+0x88/0x90
 [<c1090632>] ? might_fault+0x42/0x90
 [<f9aa5416>] ? drm_ioctl+0x1d6/0x450 [drm]
 [<f9ba5440>] ? radeon_cp_cmdbuf+0x0/0x1cf0 [radeon]
 [<c1090d10>] ? __do_fault+0x2e0/0x3c0
 [<c1085c7a>] ? __lru_cache_add+0x6a/0xb0
 [<c12553d7>] ? _raw_spin_unlock+0x27/0x40
 [<c1092721>] ? handle_mm_fault+0x301/0x590
 [<f9aa5240>] ? drm_ioctl+0x0/0x450 [drm]
 [<c10b43b8>] ? vfs_ioctl+0x28/0xa0
 [<c10b456a>] ? do_vfs_ioctl+0x6a/0x5e0
 [<c1052326>] ? up_read+0x16/0x30
 [<c1020f26>] ? do_page_fault+0x1e6/0x3b0
 [<c1090632>] ? might_fault+0x42/0x90
 [<c1090678>] ? might_fault+0x88/0x90
 [<c1090632>] ? might_fault+0x42/0x90
 [<c10b4b19>] ? sys_ioctl+0x39/0x70
 [<c1002b90>] ? sysenter_do_call+0x12/0x36
Code: b6 00 00 00 00 8b 85 5c fe ff ff 8b 58 04 8b 43 04 2b 03 83 f8 03 0f 86 f1 16 00 00 ba 04 00 00 00 89 d8 8d 4d f0 e8 02 bd ef ff <0f> b6 10 89 c3 80 fa 09 0f 86 8c 00 00 00 8b 9d 5c fe ff ff 8b 
EIP: [<f9ba559e>] radeon_cp_cmdbuf+0x15e/0x1cf0 [radeon] SS:ESP 0068:f6546c4c
CR2: 0000000006000001
---[ end trace e7edb960ae254470 ]---

The "freeing invalid memtype" messages might be irrelevant, as I get
many of these for Xorg when I stop the machine since months.

Let me know if I can help debugging this by providing extra information
or doing tests. This is low priority for me (I don't normally do 3D on
that machine) but you probably want the bug fixed before 2.6.34-final.

-- 
Jean Delvare