Re: [REGRESSION] drm/nouveau: NULL pointer dereference in drm_atomic_commit during GP107 initialization

[lyude@redhat.com]

Hi - I'm back! Sorry about this, I've been busy moving and only just
got my machine setup. I will take a look at this tomorrow

On Mon, 2026-11-09 at 08:45 +0100, Thorsten Leemhuis wrote:
> On 11/2/26 13:47, Eric Kim wrote:
> > 
> > On my laptop, which has GP107 GPU with intel graphics and uses
> > nouveau
> > driver, booting kernels after commit
> > 2652aca460dcfdd0d169bbfa358aa15804dc736b causes NULL pointer
> > dereference
> > at initialization.
> 
> Thx for your report. Hmm, no reply yet afaics. Wondering if it would
> have been better to report it at the dedicated place for nouveau
> kernel
> bugs: https://gitlab.freedesktop.org/drm/nouveau/-/work_items/
> 
> You thus might want to at least check if any similar reports are
> found
> there.
> 
> Would also be good to know if reverting 2652aca460dc ontop of latest
> mainline fixes this.
> 
> Ciao, Thorsten
> > [   17.556328] [drm] Initialized nouveau 1.4.3 for 0000:01:00.0 on
> > minor 0
> > [   17.556364] nouveau 0000:01:00.0: [drm] No compatible format
> > found
> > [   17.556792] nouveau 0000:01:00.0: [drm] Cannot find any crtc or
> > sizes
> > [   17.557237] BUG: kernel NULL pointer dereference, address:
> > 0000000000000000
> > [   17.583880] #PF: supervisor instruction fetch in kernel mode
> > [   17.598078] #PF: error_code(0x0010) - not-present page
> > [   17.601475] PGD 0 P4D 0 [   17.608839] Oops: Oops: 0010 [#1] SMP
> > PTI
> > [   17.608914] CPU: 6 UID: 0 PID: 1443 Comm: modprobe Not tainted
> > 7.3.0+
> > #1 PREEMPT(lazy) [   17.608954] Hardware name: SAMSUNG ELECTRONICS
> > CO.,
> > LTD. 800G5M/800G5W/NT800G5M-X78W, BIOS P11RDV.075.170829.XJ
> > 08/29/2017
> > [   17.608990] RIP: 0010:0x0
> > [   17.609090] Code: Unable to access opcode bytes at
> > 0xffffffffffffffd6.
> > [   17.610081] RSP: 0018:ffffca4d86537828 EFLAGS: 00010246
> > [   17.610135] RAX: 0000000000000000 RBX: ffff89b74dcf1180 RCX:
> > ffffffffa97d8091
> > [   17.610172] RDX: 0000000000000000 RSI: ffff89b74dcf1180 RDI:
> > ffff89b74c466800
> > [   17.610207] RBP: ffff89b74c466800 R08: ffff89b74dcf1180 R09:
> > 0000000000000000
> > [   17.610245] R10: 0000000000000010 R11: ffffffffa9b65410 R12:
> > ffff89b74c466800
> > [   17.610283] R13: 0000000000000001 R14: ffff89b74c466800 R15:
> > ffff89b77f1a2400
> > [   17.610320] FS:  00007fc4a888d780(0000)
> > GS:ffff89bac4364000(0000)
> > knlGS:0000000000000000
> > [   17.610357] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [   17.610414] CR2: ffffffffffffffd6 CR3: 0000000144b20004 CR4:
> > 00000000003726f0
> > [   17.610448] Call Trace:
> > [   17.610483]  <TASK>
> > [   17.610521]  drm_atomic_commit+0xb1/0xe0
> > [   17.610558]  ? __pfx___drm_printfn_info+0x10/0x10
> > [   17.610590]  drm_client_modeset_commit_atomic+0x25c/0x2d0
> > [   17.610618]  drm_client_modeset_commit_locked+0x5a/0x170
> > [   17.610647]  ? drm_master_internal_acquire+0x1d/0x40
> > [   17.610675]  drm_client_modeset_commit+0x25/0x40
> > [   17.610700]  drm_fb_helper_single_fb_probe+0x1aa/0x1c0
> > [   17.610729] 
> > __drm_fb_helper_initial_config_and_unlock+0xa8/0x1b0
> > [   17.610754]  drm_fbdev_client_hotplug+0x79/0xb0
> > [   17.610782]  ? drm_client_init+0x13e/0x180
> > [   17.610811]  drm_client_register+0x79/0xc0
> > [   17.610839]  drm_fbdev_client_setup+0xc9/0x1c0
> > [   17.610867]  drm_client_setup+0x6a/0x90
> > [   17.610893]  nouveau_drm_probe+0x15b/0x1e0 [nouveau]
> > [   17.610922]  local_pci_probe+0x4a/0x90
> > [   17.610951]  ? cpu_hotplug_disable+0x15/0x30
> > [   17.610977]  pci_call_probe+0x5a/0x1a0
> > [   17.611009]  pci_device_probe+0xdb/0x180
> > [   17.611060]  call_driver_probe+0x23/0x100
> > [   17.611104]  ? driver_sysfs_add+0x55/0xc0
> > [   17.611137]  really_probe+0xd7/0x2d0
> > [   17.611171]  ? __pm_runtime_resume+0x50/0x60
> > [   17.611220]  __driver_probe_device+0x9c/0x1b0
> > [   17.611261]  driver_probe_device+0x1f/0x80
> > [   17.611297]  ? __pfx___driver_attach+0x10/0x10
> > [   17.611335]  __driver_attach+0xcc/0x200
> > [   17.611373]  ? __pfx___driver_attach+0x10/0x10
> > [   17.611409]  bus_for_each_dev+0x97/0x100
> > [   17.611451]  bus_add_driver+0x1d0/0x280
> > [   17.611493]  ? __pfx_init_module+0x10/0x10 [nouveau]
> > [   17.611530]  ? __pfx_init_module+0x10/0x10 [nouveau]
> > [   17.611567]  driver_register+0x75/0xe0
> > [   17.611602]  nouveau_drm_init+0x60/0xff0 [nouveau]
> > [   17.611633]  do_one_initcall+0x89/0x3d0
> > [   17.611667]  do_init_module+0x8e/0x290
> > [   17.611703]  init_module_from_file+0xc8/0x180
> > [   17.611736]  idempotent_init_module+0x23e/0x360
> > [   17.611773]  __x64_sys_finit_module+0x7f/0x110
> > [   17.611805]  do_syscall_64+0xbe/0x470
> > [   17.611844]  ? do_syscall_64+0x37/0x470
> > [   17.611883]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> > 
> > It boots without this problem when booting with nouveau.atomic=0
> > kernel parameter.
> > 
> > My guess is that atomic_(commit|check) operation is not present in
> > nouveau_mode_config_funcs, and commit
> > 2652aca460dcfdd0d169bbfa358aa15804dc736b enabled
> > atomic modesetting by default for NV50+ gpus caused
> > the problem.
> > 
> > Also, drm_helper_(commit|check) was added to
> > nouveau_mode_config_funcs
> > at commit 604826acb3f53c6648a7ee99a3914ead680ab7fb, but it was
> > reverted at commit 6c65db809796717f0a96cf22f80405dbc1a31a4b due to
> > unreliability.
> > 
> > I hope this problem can be fixed at one of the next releases.
> > 
> > Thanks,
> > Eric Kim
> > 
> > #regzbot introduced: 2652aca460dc