* [REGRESSION] drm/nouveau: NULL pointer dereference in drm_atomic_commit during GP107 initialization
@ 2026-11-02 12:47 Eric Kim
2026-11-09 7:45 ` Thorsten Leemhuis
0 siblings, 1 reply; 3+ messages in thread
From: Eric Kim @ 2026-11-02 12:47 UTC (permalink / raw)
To: regressions
Cc: lyude, dakr, maarten.lankhorst, mripard, tzimmermann, airlied,
simona, nouveau, linux-kernel
Hi,
On my laptop, which has GP107 GPU with intel graphics and uses nouveau
driver, booting kernels after commit
2652aca460dcfdd0d169bbfa358aa15804dc736b causes NULL pointer dereference
at initialization.
[ 17.556328] [drm] Initialized nouveau 1.4.3 for 0000:01:00.0 on minor 0
[ 17.556364] nouveau 0000:01:00.0: [drm] No compatible format found
[ 17.556792] nouveau 0000:01:00.0: [drm] Cannot find any crtc or sizes
[ 17.557237] BUG: kernel NULL pointer dereference, address:
0000000000000000
[ 17.583880] #PF: supervisor instruction fetch in kernel mode
[ 17.598078] #PF: error_code(0x0010) - not-present page
[ 17.601475] PGD 0 P4D 0 [ 17.608839] Oops: Oops: 0010 [#1] SMP PTI
[ 17.608914] CPU: 6 UID: 0 PID: 1443 Comm: modprobe Not tainted 7.3.0+
#1 PREEMPT(lazy) [ 17.608954] Hardware name: SAMSUNG ELECTRONICS CO.,
LTD. 800G5M/800G5W/NT800G5M-X78W, BIOS P11RDV.075.170829.XJ 08/29/2017
[ 17.608990] RIP: 0010:0x0
[ 17.609090] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 17.610081] RSP: 0018:ffffca4d86537828 EFLAGS: 00010246
[ 17.610135] RAX: 0000000000000000 RBX: ffff89b74dcf1180 RCX:
ffffffffa97d8091
[ 17.610172] RDX: 0000000000000000 RSI: ffff89b74dcf1180 RDI:
ffff89b74c466800
[ 17.610207] RBP: ffff89b74c466800 R08: ffff89b74dcf1180 R09:
0000000000000000
[ 17.610245] R10: 0000000000000010 R11: ffffffffa9b65410 R12:
ffff89b74c466800
[ 17.610283] R13: 0000000000000001 R14: ffff89b74c466800 R15:
ffff89b77f1a2400
[ 17.610320] FS: 00007fc4a888d780(0000) GS:ffff89bac4364000(0000)
knlGS:0000000000000000
[ 17.610357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 17.610414] CR2: ffffffffffffffd6 CR3: 0000000144b20004 CR4:
00000000003726f0
[ 17.610448] Call Trace:
[ 17.610483] <TASK>
[ 17.610521] drm_atomic_commit+0xb1/0xe0
[ 17.610558] ? __pfx___drm_printfn_info+0x10/0x10
[ 17.610590] drm_client_modeset_commit_atomic+0x25c/0x2d0
[ 17.610618] drm_client_modeset_commit_locked+0x5a/0x170
[ 17.610647] ? drm_master_internal_acquire+0x1d/0x40
[ 17.610675] drm_client_modeset_commit+0x25/0x40
[ 17.610700] drm_fb_helper_single_fb_probe+0x1aa/0x1c0
[ 17.610729] __drm_fb_helper_initial_config_and_unlock+0xa8/0x1b0
[ 17.610754] drm_fbdev_client_hotplug+0x79/0xb0
[ 17.610782] ? drm_client_init+0x13e/0x180
[ 17.610811] drm_client_register+0x79/0xc0
[ 17.610839] drm_fbdev_client_setup+0xc9/0x1c0
[ 17.610867] drm_client_setup+0x6a/0x90
[ 17.610893] nouveau_drm_probe+0x15b/0x1e0 [nouveau]
[ 17.610922] local_pci_probe+0x4a/0x90
[ 17.610951] ? cpu_hotplug_disable+0x15/0x30
[ 17.610977] pci_call_probe+0x5a/0x1a0
[ 17.611009] pci_device_probe+0xdb/0x180
[ 17.611060] call_driver_probe+0x23/0x100
[ 17.611104] ? driver_sysfs_add+0x55/0xc0
[ 17.611137] really_probe+0xd7/0x2d0
[ 17.611171] ? __pm_runtime_resume+0x50/0x60
[ 17.611220] __driver_probe_device+0x9c/0x1b0
[ 17.611261] driver_probe_device+0x1f/0x80
[ 17.611297] ? __pfx___driver_attach+0x10/0x10
[ 17.611335] __driver_attach+0xcc/0x200
[ 17.611373] ? __pfx___driver_attach+0x10/0x10
[ 17.611409] bus_for_each_dev+0x97/0x100
[ 17.611451] bus_add_driver+0x1d0/0x280
[ 17.611493] ? __pfx_init_module+0x10/0x10 [nouveau]
[ 17.611530] ? __pfx_init_module+0x10/0x10 [nouveau]
[ 17.611567] driver_register+0x75/0xe0
[ 17.611602] nouveau_drm_init+0x60/0xff0 [nouveau]
[ 17.611633] do_one_initcall+0x89/0x3d0
[ 17.611667] do_init_module+0x8e/0x290
[ 17.611703] init_module_from_file+0xc8/0x180
[ 17.611736] idempotent_init_module+0x23e/0x360
[ 17.611773] __x64_sys_finit_module+0x7f/0x110
[ 17.611805] do_syscall_64+0xbe/0x470
[ 17.611844] ? do_syscall_64+0x37/0x470
[ 17.611883] entry_SYSCALL_64_after_hwframe+0x76/0x7e
It boots without this problem when booting with nouveau.atomic=0
kernel parameter.
My guess is that atomic_(commit|check) operation is not present in
nouveau_mode_config_funcs, and commit
2652aca460dcfdd0d169bbfa358aa15804dc736b enabled
atomic modesetting by default for NV50+ gpus caused
the problem.
Also, drm_helper_(commit|check) was added to nouveau_mode_config_funcs
at commit 604826acb3f53c6648a7ee99a3914ead680ab7fb, but it was
reverted at commit 6c65db809796717f0a96cf22f80405dbc1a31a4b due to
unreliability.
I hope this problem can be fixed at one of the next releases.
Thanks,
Eric Kim
#regzbot introduced: 2652aca460dc
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [REGRESSION] drm/nouveau: NULL pointer dereference in drm_atomic_commit during GP107 initialization
2026-11-02 12:47 [REGRESSION] drm/nouveau: NULL pointer dereference in drm_atomic_commit during GP107 initialization Eric Kim
@ 2026-11-09 7:45 ` Thorsten Leemhuis
2026-11-10 0:54 ` lyude
0 siblings, 1 reply; 3+ messages in thread
From: Thorsten Leemhuis @ 2026-11-09 7:45 UTC (permalink / raw)
To: Eric Kim, regressions
Cc: lyude, dakr, maarten.lankhorst, mripard, tzimmermann, airlied,
simona, nouveau, linux-kernel
On 11/2/26 13:47, Eric Kim wrote:
>
> On my laptop, which has GP107 GPU with intel graphics and uses nouveau
> driver, booting kernels after commit
> 2652aca460dcfdd0d169bbfa358aa15804dc736b causes NULL pointer dereference
> at initialization.
Thx for your report. Hmm, no reply yet afaics. Wondering if it would
have been better to report it at the dedicated place for nouveau kernel
bugs: https://gitlab.freedesktop.org/drm/nouveau/-/work_items/
You thus might want to at least check if any similar reports are found
there.
Would also be good to know if reverting 2652aca460dc ontop of latest
mainline fixes this.
Ciao, Thorsten
> [ 17.556328] [drm] Initialized nouveau 1.4.3 for 0000:01:00.0 on minor 0
> [ 17.556364] nouveau 0000:01:00.0: [drm] No compatible format found
> [ 17.556792] nouveau 0000:01:00.0: [drm] Cannot find any crtc or sizes
> [ 17.557237] BUG: kernel NULL pointer dereference, address:
> 0000000000000000
> [ 17.583880] #PF: supervisor instruction fetch in kernel mode
> [ 17.598078] #PF: error_code(0x0010) - not-present page
> [ 17.601475] PGD 0 P4D 0 [ 17.608839] Oops: Oops: 0010 [#1] SMP PTI
> [ 17.608914] CPU: 6 UID: 0 PID: 1443 Comm: modprobe Not tainted 7.3.0+
> #1 PREEMPT(lazy) [ 17.608954] Hardware name: SAMSUNG ELECTRONICS CO.,
> LTD. 800G5M/800G5W/NT800G5M-X78W, BIOS P11RDV.075.170829.XJ 08/29/2017
> [ 17.608990] RIP: 0010:0x0
> [ 17.609090] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
> [ 17.610081] RSP: 0018:ffffca4d86537828 EFLAGS: 00010246
> [ 17.610135] RAX: 0000000000000000 RBX: ffff89b74dcf1180 RCX:
> ffffffffa97d8091
> [ 17.610172] RDX: 0000000000000000 RSI: ffff89b74dcf1180 RDI:
> ffff89b74c466800
> [ 17.610207] RBP: ffff89b74c466800 R08: ffff89b74dcf1180 R09:
> 0000000000000000
> [ 17.610245] R10: 0000000000000010 R11: ffffffffa9b65410 R12:
> ffff89b74c466800
> [ 17.610283] R13: 0000000000000001 R14: ffff89b74c466800 R15:
> ffff89b77f1a2400
> [ 17.610320] FS: 00007fc4a888d780(0000) GS:ffff89bac4364000(0000)
> knlGS:0000000000000000
> [ 17.610357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 17.610414] CR2: ffffffffffffffd6 CR3: 0000000144b20004 CR4:
> 00000000003726f0
> [ 17.610448] Call Trace:
> [ 17.610483] <TASK>
> [ 17.610521] drm_atomic_commit+0xb1/0xe0
> [ 17.610558] ? __pfx___drm_printfn_info+0x10/0x10
> [ 17.610590] drm_client_modeset_commit_atomic+0x25c/0x2d0
> [ 17.610618] drm_client_modeset_commit_locked+0x5a/0x170
> [ 17.610647] ? drm_master_internal_acquire+0x1d/0x40
> [ 17.610675] drm_client_modeset_commit+0x25/0x40
> [ 17.610700] drm_fb_helper_single_fb_probe+0x1aa/0x1c0
> [ 17.610729] __drm_fb_helper_initial_config_and_unlock+0xa8/0x1b0
> [ 17.610754] drm_fbdev_client_hotplug+0x79/0xb0
> [ 17.610782] ? drm_client_init+0x13e/0x180
> [ 17.610811] drm_client_register+0x79/0xc0
> [ 17.610839] drm_fbdev_client_setup+0xc9/0x1c0
> [ 17.610867] drm_client_setup+0x6a/0x90
> [ 17.610893] nouveau_drm_probe+0x15b/0x1e0 [nouveau]
> [ 17.610922] local_pci_probe+0x4a/0x90
> [ 17.610951] ? cpu_hotplug_disable+0x15/0x30
> [ 17.610977] pci_call_probe+0x5a/0x1a0
> [ 17.611009] pci_device_probe+0xdb/0x180
> [ 17.611060] call_driver_probe+0x23/0x100
> [ 17.611104] ? driver_sysfs_add+0x55/0xc0
> [ 17.611137] really_probe+0xd7/0x2d0
> [ 17.611171] ? __pm_runtime_resume+0x50/0x60
> [ 17.611220] __driver_probe_device+0x9c/0x1b0
> [ 17.611261] driver_probe_device+0x1f/0x80
> [ 17.611297] ? __pfx___driver_attach+0x10/0x10
> [ 17.611335] __driver_attach+0xcc/0x200
> [ 17.611373] ? __pfx___driver_attach+0x10/0x10
> [ 17.611409] bus_for_each_dev+0x97/0x100
> [ 17.611451] bus_add_driver+0x1d0/0x280
> [ 17.611493] ? __pfx_init_module+0x10/0x10 [nouveau]
> [ 17.611530] ? __pfx_init_module+0x10/0x10 [nouveau]
> [ 17.611567] driver_register+0x75/0xe0
> [ 17.611602] nouveau_drm_init+0x60/0xff0 [nouveau]
> [ 17.611633] do_one_initcall+0x89/0x3d0
> [ 17.611667] do_init_module+0x8e/0x290
> [ 17.611703] init_module_from_file+0xc8/0x180
> [ 17.611736] idempotent_init_module+0x23e/0x360
> [ 17.611773] __x64_sys_finit_module+0x7f/0x110
> [ 17.611805] do_syscall_64+0xbe/0x470
> [ 17.611844] ? do_syscall_64+0x37/0x470
> [ 17.611883] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> It boots without this problem when booting with nouveau.atomic=0
> kernel parameter.
>
> My guess is that atomic_(commit|check) operation is not present in
> nouveau_mode_config_funcs, and commit
> 2652aca460dcfdd0d169bbfa358aa15804dc736b enabled
> atomic modesetting by default for NV50+ gpus caused
> the problem.
>
> Also, drm_helper_(commit|check) was added to nouveau_mode_config_funcs
> at commit 604826acb3f53c6648a7ee99a3914ead680ab7fb, but it was
> reverted at commit 6c65db809796717f0a96cf22f80405dbc1a31a4b due to
> unreliability.
>
> I hope this problem can be fixed at one of the next releases.
>
> Thanks,
> Eric Kim
>
> #regzbot introduced: 2652aca460dc
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [REGRESSION] drm/nouveau: NULL pointer dereference in drm_atomic_commit during GP107 initialization
2026-11-09 7:45 ` Thorsten Leemhuis
@ 2026-11-10 0:54 ` lyude
0 siblings, 0 replies; 3+ messages in thread
From: lyude @ 2026-11-10 0:54 UTC (permalink / raw)
To: Thorsten Leemhuis, Eric Kim, regressions
Cc: dakr, maarten.lankhorst, mripard, tzimmermann, airlied, simona,
nouveau, linux-kernel
Hi - I'm back! Sorry about this, I've been busy moving and only just
got my machine setup. I will take a look at this tomorrow
On Mon, 2026-11-09 at 08:45 +0100, Thorsten Leemhuis wrote:
> On 11/2/26 13:47, Eric Kim wrote:
> >
> > On my laptop, which has GP107 GPU with intel graphics and uses
> > nouveau
> > driver, booting kernels after commit
> > 2652aca460dcfdd0d169bbfa358aa15804dc736b causes NULL pointer
> > dereference
> > at initialization.
>
> Thx for your report. Hmm, no reply yet afaics. Wondering if it would
> have been better to report it at the dedicated place for nouveau
> kernel
> bugs: https://gitlab.freedesktop.org/drm/nouveau/-/work_items/
>
> You thus might want to at least check if any similar reports are
> found
> there.
>
> Would also be good to know if reverting 2652aca460dc ontop of latest
> mainline fixes this.
>
> Ciao, Thorsten
> > [ 17.556328] [drm] Initialized nouveau 1.4.3 for 0000:01:00.0 on
> > minor 0
> > [ 17.556364] nouveau 0000:01:00.0: [drm] No compatible format
> > found
> > [ 17.556792] nouveau 0000:01:00.0: [drm] Cannot find any crtc or
> > sizes
> > [ 17.557237] BUG: kernel NULL pointer dereference, address:
> > 0000000000000000
> > [ 17.583880] #PF: supervisor instruction fetch in kernel mode
> > [ 17.598078] #PF: error_code(0x0010) - not-present page
> > [ 17.601475] PGD 0 P4D 0 [ 17.608839] Oops: Oops: 0010 [#1] SMP
> > PTI
> > [ 17.608914] CPU: 6 UID: 0 PID: 1443 Comm: modprobe Not tainted
> > 7.3.0+
> > #1 PREEMPT(lazy) [ 17.608954] Hardware name: SAMSUNG ELECTRONICS
> > CO.,
> > LTD. 800G5M/800G5W/NT800G5M-X78W, BIOS P11RDV.075.170829.XJ
> > 08/29/2017
> > [ 17.608990] RIP: 0010:0x0
> > [ 17.609090] Code: Unable to access opcode bytes at
> > 0xffffffffffffffd6.
> > [ 17.610081] RSP: 0018:ffffca4d86537828 EFLAGS: 00010246
> > [ 17.610135] RAX: 0000000000000000 RBX: ffff89b74dcf1180 RCX:
> > ffffffffa97d8091
> > [ 17.610172] RDX: 0000000000000000 RSI: ffff89b74dcf1180 RDI:
> > ffff89b74c466800
> > [ 17.610207] RBP: ffff89b74c466800 R08: ffff89b74dcf1180 R09:
> > 0000000000000000
> > [ 17.610245] R10: 0000000000000010 R11: ffffffffa9b65410 R12:
> > ffff89b74c466800
> > [ 17.610283] R13: 0000000000000001 R14: ffff89b74c466800 R15:
> > ffff89b77f1a2400
> > [ 17.610320] FS: 00007fc4a888d780(0000)
> > GS:ffff89bac4364000(0000)
> > knlGS:0000000000000000
> > [ 17.610357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [ 17.610414] CR2: ffffffffffffffd6 CR3: 0000000144b20004 CR4:
> > 00000000003726f0
> > [ 17.610448] Call Trace:
> > [ 17.610483] <TASK>
> > [ 17.610521] drm_atomic_commit+0xb1/0xe0
> > [ 17.610558] ? __pfx___drm_printfn_info+0x10/0x10
> > [ 17.610590] drm_client_modeset_commit_atomic+0x25c/0x2d0
> > [ 17.610618] drm_client_modeset_commit_locked+0x5a/0x170
> > [ 17.610647] ? drm_master_internal_acquire+0x1d/0x40
> > [ 17.610675] drm_client_modeset_commit+0x25/0x40
> > [ 17.610700] drm_fb_helper_single_fb_probe+0x1aa/0x1c0
> > [ 17.610729]
> > __drm_fb_helper_initial_config_and_unlock+0xa8/0x1b0
> > [ 17.610754] drm_fbdev_client_hotplug+0x79/0xb0
> > [ 17.610782] ? drm_client_init+0x13e/0x180
> > [ 17.610811] drm_client_register+0x79/0xc0
> > [ 17.610839] drm_fbdev_client_setup+0xc9/0x1c0
> > [ 17.610867] drm_client_setup+0x6a/0x90
> > [ 17.610893] nouveau_drm_probe+0x15b/0x1e0 [nouveau]
> > [ 17.610922] local_pci_probe+0x4a/0x90
> > [ 17.610951] ? cpu_hotplug_disable+0x15/0x30
> > [ 17.610977] pci_call_probe+0x5a/0x1a0
> > [ 17.611009] pci_device_probe+0xdb/0x180
> > [ 17.611060] call_driver_probe+0x23/0x100
> > [ 17.611104] ? driver_sysfs_add+0x55/0xc0
> > [ 17.611137] really_probe+0xd7/0x2d0
> > [ 17.611171] ? __pm_runtime_resume+0x50/0x60
> > [ 17.611220] __driver_probe_device+0x9c/0x1b0
> > [ 17.611261] driver_probe_device+0x1f/0x80
> > [ 17.611297] ? __pfx___driver_attach+0x10/0x10
> > [ 17.611335] __driver_attach+0xcc/0x200
> > [ 17.611373] ? __pfx___driver_attach+0x10/0x10
> > [ 17.611409] bus_for_each_dev+0x97/0x100
> > [ 17.611451] bus_add_driver+0x1d0/0x280
> > [ 17.611493] ? __pfx_init_module+0x10/0x10 [nouveau]
> > [ 17.611530] ? __pfx_init_module+0x10/0x10 [nouveau]
> > [ 17.611567] driver_register+0x75/0xe0
> > [ 17.611602] nouveau_drm_init+0x60/0xff0 [nouveau]
> > [ 17.611633] do_one_initcall+0x89/0x3d0
> > [ 17.611667] do_init_module+0x8e/0x290
> > [ 17.611703] init_module_from_file+0xc8/0x180
> > [ 17.611736] idempotent_init_module+0x23e/0x360
> > [ 17.611773] __x64_sys_finit_module+0x7f/0x110
> > [ 17.611805] do_syscall_64+0xbe/0x470
> > [ 17.611844] ? do_syscall_64+0x37/0x470
> > [ 17.611883] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> >
> > It boots without this problem when booting with nouveau.atomic=0
> > kernel parameter.
> >
> > My guess is that atomic_(commit|check) operation is not present in
> > nouveau_mode_config_funcs, and commit
> > 2652aca460dcfdd0d169bbfa358aa15804dc736b enabled
> > atomic modesetting by default for NV50+ gpus caused
> > the problem.
> >
> > Also, drm_helper_(commit|check) was added to
> > nouveau_mode_config_funcs
> > at commit 604826acb3f53c6648a7ee99a3914ead680ab7fb, but it was
> > reverted at commit 6c65db809796717f0a96cf22f80405dbc1a31a4b due to
> > unreliability.
> >
> > I hope this problem can be fixed at one of the next releases.
> >
> > Thanks,
> > Eric Kim
> >
> > #regzbot introduced: 2652aca460dc
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-11-10 0:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-11-02 12:47 [REGRESSION] drm/nouveau: NULL pointer dereference in drm_atomic_commit during GP107 initialization Eric Kim
2026-11-09 7:45 ` Thorsten Leemhuis
2026-11-10 0:54 ` lyude
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®