oops in nv_post_event(), x86_64 linux driver 1.0-6106

[johnb]

I would like to mention a problem that we are seeing with the linux
version 1.0-6106 of the nVidia driver for x86_64, in case maybe someone
else has seen this type of scenario too.

We are using 2.6.6-based linux kernels on a x86_64 (AMD64) system with
an AGP nVidia graphics card.

Most graphics applications are working just fine.

However, when we run SGI's OpenGL Performer demo (OpenGL
Performer 3.1.1 for Linux (demo edition) downloaded from
http://www.sgi.com/software/performer/downloads.html), the system will
usually panic/oops when we click the 'quit' button to exit the demo.

(We usually just run 'perfly town.perfly', wait a bit, and then
click the 'quit' button.)


The problem occurs in the nv_post_event() routine. It seems that the
binary port of the nvidia driver is passing in a NULL value for the
event parameter when the panic/oops occurs.

We have currently worked around this problem by changing the
nv_post_event() routine to check for a NULL event parameter, and to
simply return back to the caller when the event parameter is NULL:


--- NVIDIA-Linux-x86-1.0-6106-pkg1/usr/src/nv/nv.c 2004-06-23 11:51:51.000000000 -0400
+++ patch/usr/src/nv/nv.c 2004-08-02 14:29:18.547284374 -0400
@@ -3184,12 +3184,18 @@
U032 index
)
{
- struct file *file = (struct file *) event->file;
- nv_file_private_t *nvfp = NV_GET_NVFP(file);
+ struct file *file;
+ nv_file_private_t *nvfp;
unsigned long eflags;

- nv_printf(NV_DBG_EVENTINFO, "NVRM: posting event on 0x%x:0x%x\n",
- event, nvfp);
+ if (!event) {
+ nv_printf(NV_DBG_ERRORS, "NVRM: nv_post_event() event is NULL!!!\n");
+ return;
+ }
+ file = (struct file *) event->file;
+ nvfp = NV_GET_NVFP(file);
+
+ nv_printf(NV_DBG_EVENTINFO, "NVRM: posting event on %p:%p\n", event, nvfp);

nv_lock_irq(nvfp->fp_lock, eflags);



------------------------------------------------

It would appear that this problem occurs when a 0xc0384641 ioctl(2)
command is passed into the nVidia driver, but we are not 100% sure that
this is the only time that the problem could occur.

A stack walkback from this oops occurence is shown below.

------------------------------------------------

Unable to handle kernel NULL pointer dereference at 0000000000000010 RIP:
<ffffffffa0022c6c>{:nvidia:nv_post_event+28}PML4 3d9df067 PGD 3d53b067 PMD 0
Oops: 0000 [1] PREEMPT SMP
CPU 0
Pid: 2001, comm: X Tainted: P 2.6.6-RedHawk-2.2-debug
RIP: 0010:[<ffffffffa0022c6c>] <ffffffffa0022c6c>{:nvidia:nv_post_event+28}
RSP: 0018:000001003d8c1ad8 EFLAGS: 00010216
RAX: 00000000eee00004 RBX: 00000100395165a0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000100 R09: 0000000000000000
R10: 000001003fc7c6d8 R11: 0000000000003246 R12: 0000000000000000
R13: 000001003d75ab98 R14: 00000000beef0402 R15: 0000000000000000
FS: 0000002a95f59940(0000) GS:ffffffff80855d40(0000) knlGS:0000000058b42bc0
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000010 CR3: 0000000000101000 CR4: 00000000000006e0
Process X (pid: 2001, stackpage=1007da19c40)
Stack: 000001003d75ab98 00000100395165a0 0000000000000000 0000000000000000
000001003d75ab98 000001003ca30000 0000000000000000 ffffffffa004413d
0000000000000100 000001007d8e6a40
Call Trace:
<ffffffffa004413d>{:nvidia:_nv001559rm+137}
<ffffffffa00f496d>{:nvidia:_nv003454rm+173}
<ffffffffa0145779>{:nvidia:_nv004112rm+1349}
<ffffffffa01350fd>{:nvidia:_nv001985rm+51}
<ffffffffa0133b56>{:nvidia:_nv001925rm+112}
<ffffffffa0184a93>{:nvidia:_nv002300rm+133}
<ffffffffa012ad5a>{:nvidia:_nv002797rm+1804}
<ffffffffa0030bbe>{:nvidia:_nv001156rm+460}
<ffffffffa0030e5b>{:nvidia:_nv001155rm+629}
<ffffffffa002ac58>{:nvidia:_nv003418rm+144}
<ffffffffa004a37c>{:nvidia:_nv001138rm+792}
<ffffffffa004923c>{:nvidia:rm_ioctl+58}
<ffffffffa002113c>{:nvidia:nv_kern_ioctl+812}
<ffffffff801a8318>{sys_ioctl+1016}
<ffffffff80119131>{ccur_syscall64_enter+33}
<ffffffff8010f011>{tracesys+240}


Code: 48 8b 46 10 48 c7 c6 58 80 21 a0 48 8b 98 d8 00 00 00 31 c0
RIP <ffffffffa0022c6c>{:nvidia:nv_post_event+28} RSP <000001003d8c1ad8>
LKCD not yet configured, can't take dump now
CR2: 0000000000000010

------------------------------------------------