[kernel 3.14.63] BUG: kernel NULL pointer dereference at radeon_fence_ref

[walt]

This happened 30 minutes after booting kernel 3.14.63 for the first
time.  I was doing nothing but reading a pdf file when the screen froze.
I was able to reboot the machine with Ctrl-Alt-Delete but Ctrl-Alt-Fn
did nothing.

The changelog for kernel 3.14.63 lists several radeon-related commits,
but this one seems most relevant:

commit 50353e6f86eb2ac46ffe3cc0b9f9a11ddc8a9410
Author: Nicolai Hähnle <nicolai.haehnle@>
Date:   Fri Feb 5 14:35:53 2016 -0500

    drm/radeon: hold reference to fences in radeon_sa_bo_new
    
    commit f6ff4f67cdf8455d0a4226eeeaf5af17c37d05eb upstream.
    
    An arbitrary amount of time can pass between spin_unlock and
    radeon_fence_wait_any, so we need to ensure that nobody frees the
    fences from under us.
    
    Based on the analogous fix for amdgpu.
    
    Signed-off-by: Nicolai Hähnle <nicolai.haehnle@>
    Reviewed-by: Christian König <christian.koenig@>
    Signed-off-by: Greg Kroah-Hartman <gregkh@>


This is copied from the output of journalctl:

Mar 05 08:29:58 a6 kernel: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
Mar 05 08:29:58 a6 kernel: IP: [<ffffffffa00c1525>] radeon_fence_ref+0xd/0x3f [radeon]
Mar 05 08:29:59 a6 kernel: PGD b8a15067 PUD b97f9067 PMD 0 
Mar 05 08:29:59 a6 kernel: Oops: 0002 [#1] PREEMPT SMP 
Mar 05 08:29:59 a6 kernel: Modules linked in: tun fuse vboxnetadp(O) vboxnetflt(O) vboxdrv(O) ctr ccm arc4 hid_generic rt2800usb rt2x00usb rt2800lib usbhid usb_storage rt2x00lib mac80211 cfg80
Mar 05 08:29:59 a6 kernel: CPU: 1 PID: 3682 Comm: X Tainted: G           O 3.14.63 #1
Mar 05 08:29:59 a6 kernel: Hardware name: LENOVO Lenovo H415/ , BIOS DZKT26AUS 10/26/2011
Mar 05 08:29:59 a6 kernel: task: ffff8802177bc7e0 ti: ffff8800b9504000 task.ti: ffff8800b9504000
Mar 05 08:29:59 a6 kernel: RIP: 0010:[<ffffffffa00c1525>]  [<ffffffffa00c1525>] radeon_fence_ref+0xd/0x3f [radeon]
Mar 05 08:29:59 a6 kernel: RSP: 0018:ffff8800b9505b08  EFLAGS: 00010212
Mar 05 08:29:59 a6 kernel: RAX: ffff8801ea939aa0 RBX: 0000000000000000 RCX: 0000000000000018
Mar 05 08:29:59 a6 kernel: RDX: 0000000000000001 RSI: ffff8802168a1388 RDI: 0000000000000000
Mar 05 08:29:59 a6 kernel: RBP: ffff8800b9505b10 R08: ffff8802168a1398 R09: 0000000000200000
Mar 05 08:29:59 a6 kernel: R10: 000000000000eee0 R11: 0000000000000246 R12: ffff8800b9505cf0
Mar 05 08:29:59 a6 kernel:  002000000000eee0 0000000000000000 0000000000000000 ffff8802136aef10
Mar 05 08:29:59 a6 kernel:  ffff8802168a0000 ffff8800b9505ba0 ffff8802177bc7e0 0000010001794f80
Mar 05 08:29:59 a6 kernel: Call Trace:
Mar 05 08:29:59 a6 kernel:  [<ffffffffa011163d>] radeon_sa_bo_new+0x29a/0x450 [radeon]
Mar 05 08:29:59 a6 kernel:  [<ffffffffa00d387b>] radeon_ib_get+0x34/0xbc [radeon]
Mar 05 08:29:59 a6 kernel:  [<ffffffffa00d5602>] radeon_cs_ioctl+0x240/0x896 [radeon]
Mar 05 08:29:59 a6 kernel:  [<ffffffffa00c19ec>] ? radeon_sync_obj_signaled+0x9/0xb [radeon]
Mar 05 08:29:59 a6 kernel:  [<ffffffffa00150b0>] drm_ioctl+0x2a7/0x3d6 [drm]
Mar 05 08:29:59 a6 kernel:  [<ffffffffa00d53c2>] ? radeon_cs_parser_init+0x3eb/0x3eb [radeon]
Mar 05 08:29:59 a6 kernel:  [<ffffffff8100a4f2>] ? init_fpu+0x7a/0x88
Mar 05 08:29:59 a6 kernel:  [<ffffffff8100afae>] ? __restore_xstate_sig+0x87/0x43b
Mar 05 08:29:59 a6 kernel:  [<ffffffffa00ad009>] radeon_drm_ioctl+0x9/0xb [radeon]
Mar 05 08:29:59 a6 kernel:  [<ffffffff810dc46e>] do_vfs_ioctl+0x34e/0x3fc
Mar 05 08:29:59 a6 kernel:  [<ffffffff810e4125>] ? __fget+0x6a/0x74
Mar 05 08:29:59 a6 kernel:  [<ffffffff810dc55a>] SyS_ioctl+0x3e/0x5c
Mar 05 08:29:59 a6 kernel:  [<ffffffff813fa482>] system_call_fastpath+0x16/0x1b
Mar 05 08:29:59 a6 kernel: Code: 8b 3b 44 89 e2 48 c7 c6 89 ad 18 a0 31 c0 e8 27 3d 1c e1 31 c0 48 83 c4 30 5b 41 5c 5d c3 55 ba 01 00 00 00 48 89 e5 53 48 89 fb <f0> 0f c1 57 08 ff c2 ff ca 7
Mar 05 08:29:59 a6 kernel: RIP  [<ffffffffa00c1525>] radeon_fence_ref+0xd/0x3f [radeon]
Mar 05 08:29:59 a6 kernel:  RSP <ffff8800b9505b08>
Mar 05 08:29:59 a6 kernel: CR2: 0000000000000008
Mar 05 08:29:59 a6 kernel: ---[ end trace eeb6505fa7069d72 ]---
Mar 05 08:29:59 a6 kernel: note: X[3682] exited with preempt_count 1