[RESEND BISECTED] 4.7-rc1 oops at drm_connector_cleanup+0x5c/0x1d0

[George Spelvin]

(Re-send since it's been a week.)

I bisected it to commit 0955c1250e ("drm/crtc: take references to
connectors used in a modeset. (v2)").  The commit before that (6e86d58be3)
gives me working X.  0955c1250e produces a kernel oops and a blank screen.

4.7-rc1 with 0955c1250e reverted also works, which seems definitive.

The oops is:

[  212.149973] nouveau 0000:02:00.0: DRM: DDC responded, but no EDID for VGA-1
[  213.842270] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[  213.842283] IP: [<ffffffff8134767c>] drm_connector_cleanup+0x5c/0x1d0
[  213.842290] PGD 41779c067 PUD 0 
[  213.842294] Oops: 0002 [#1] SMP 
[  213.842297] Modules linked in: nfsd lockd grace sunrpc via_velocity x86_pkg_temp_thermal input_leds crc32_pclmul crc32c_intel led_class [last unloaded: twofish_common]
[  213.842313] CPU: 0 PID: 5362 Comm: Xorg Not tainted 4.6.0-rc3-00678-g0955c125 #541
[  213.842317] Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./X79-UP4, BIOS F7 03/19/2014
[  213.842320] task: ffff880420c42580 ti: ffff880417404000 task.ti: ffff880417404000
[  213.842324] RIP: 0010:[<ffffffff8134767c>]  [<ffffffff8134767c>] drm_connector_cleanup+0x5c/0x1d0
[  213.842329] RSP: 0018:ffff880417407c08  EFLAGS: 00010206
[  213.842331] RAX: 0000000000000000 RBX: ffff8800b9d79000 RCX: ffffea0010acde00
[  213.842511] RDX: dead000000000200 RSI: ffff88042b881078 RDI: 0000000000000007
[  213.842982] RBP: ffff88042b96e800 R08: ffff88042b881078 R09: 0000000180080007
[  213.843459] R10: ffffea0010ae2000 R11: ffff88042d803301 R12: ffff8800b9d79078
[  213.843929] R13: dead000000000200 R14: dead000000000100 R15: 0000000000000000
[  213.844414] FS:  0000000000000000(0000) GS:ffff88043fc00000(0063) knlGS:00000000f708b880
[  213.844896] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[  213.845369] CR2: 0000000000000008 CR3: 0000000417796000 CR4: 00000000001406f0
[  213.845557] Stack:
[  213.845557]  ffff8800b9d79000 0000000000000001 ffff88042b4e3000 ffff8800b9d79000
[  213.845557]  ffff88042b881000 0000000000000001 ffffffff813fda8c ffff88042b96eb88
[  213.845557]  ffffffff81328557 ffff880420c42580 ffff88042c271190 ffff8800b9d79000
[  213.845557] Call Trace:
[  213.845557]  [<ffffffff813fda8c>] ? nouveau_connector_destroy+0x2c/0x50
[  213.845557]  [<ffffffff81328557>] ? drm_crtc_helper_set_config+0xa17/0xce0
[  213.845557]  [<ffffffff8141157c>] ? nouveau_crtc_set_config+0x4c/0x110
[  213.845557]  [<ffffffff8134446c>] ? drm_mode_set_config_internal+0x5c/0x110
[  213.845557]  [<ffffffff81348a5c>] ? drm_mode_setcrtc+0x42c/0x540
[  213.845557]  [<ffffffff8133b3ac>] ? drm_ioctl+0x12c/0x4e0
[  213.845557]  [<ffffffff81348630>] ? drm_mode_setplane+0x1c0/0x1c0
[  213.845557]  [<ffffffff813f4271>] ? nouveau_drm_ioctl+0x61/0xb0
[  213.845557]  [<ffffffff813f64db>] ? nouveau_compat_ioctl+0xb/0x20
[  213.845557]  [<ffffffff81191ec5>] ? compat_SyS_ioctl+0x95/0x1890
[  213.845557]  [<ffffffff8114b40d>] ? SyS_write+0x3d/0x90
[  213.845557]  [<ffffffff810025dd>] ? do_fast_syscall_32+0x8d/0x140
[  213.845557]  [<ffffffff816c2d5f>] ? entry_SYSENTER_compat+0x4f/0x5e
[  213.845557] Code: 48 8b 73 78 4c 8d 63 78 49 be 00 01 00 00 00 00 ad de 49 bd 00 02 00 00 00 00 ad de 48 8b 06 4c 39 e6 49 89 c7 74 2b 48 8b 56 08 <48> 89 50 08 48 89 02 4c 89 36 4c 89 6e 08 48 8b 3b e8 5e 2b 00 
[  213.845557] RIP  [<ffffffff8134767c>] drm_connector_cleanup+0x5c/0x1d0
[  213.845557]  RSP <ffff880417407c08>
[  213.845557] CR2: 0000000000000008
[  213.858256] ---[ end trace e4f18a1100ceeb21 ]---

One interesting detail I noticed during bisection, but didn't stop to
investigate in detail, is that it sometimes the display doesn't come
back after a reboot (!).

Userland is 32-bit, on a 64-bit kernel.  The GPU is an old nVidia one
that's not doing anything more complex then VLC.

02:00.0 VGA compatible controller [0300]: NVIDIA Corporation GT216 [GeForce 210] [10de:0a23] (rev a2)


This is a personal machine, so it's easy to test patches, modulo
saving all my work in progress before rebooting.