[oops] 2.6.20-smp: GPF in firegl_unbind_pcie+0x1b6/0x210

[Paweł Sikora]

100% reproducible.
glxgears works fine but e.g. glxinfo triggers an oops on PCI-E card.

kernel-smp-2.6.20-0.6.x86_64

kernel-smp-video-firegl-8.33.6-1 w 2.6.20_0.6.x86_64
(+ xorg-driver-video-fglrx-2.6.20-restore_syscalls.patch @ cvs)

xorg-driver-video-fglrx-8.33.6-1.x86_64
xorg-xserver-server-1.2.0-1.x86_64


general protection fault: 0000 [1] SMP
CPU 0
Modules linked in: wlan_ccmp fglrx(P) binfmt_misc wlan_tkip wlan_xauth 
xt_tcpudp xt_conntrack xt_state iptable_filter ipt_MASQUERADE 
iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack nfnetlink ip_tables 
ip6table_filter ip6_tables x_tables ipv6 ext2 mbcache raid1 f71805f 
eeprom i2c_dev thermal powernow_k8 freq_table processor evdev msr cpuid 
usbmouse wlan_scan_ap ath_rate_sample usbhid usbkbd hid ff_memless 
ath_pci wlan ide_cd snd_intel8x0 snd_ac97_codec cdrom ath_hal(P) psmouse 
ac97_bus serio_raw snd_pcm k8temp pcspkr hwmon snd_timer snd soundcore 
forcedeth ohci_hcd ehci_hcd i2c_nforce2 snd_page_alloc usbcore i2c_core 
sd_mod raid0 md_mod xfs sata_nv libata scsi_mod amd74xx ide_core

Pid: 7796, comm: glxinfo Tainted: P      2.6.20-0.6smp #1
RIP: 0010:[<ffffffff884064b6>]  [<ffffffff884064b6>] 
:fglrx:firegl_unbind_pcie+0x1b6/0x210
RSP: 0018:ffff81003808bdc8  EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000000aa0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff81002e7e12a0 RDI: ffff81003922a728
RBP: ffff8100280d9000 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffff883f434d R11: 0000000000000000 R12: ffffffff884820c0
R13: 0000000040186441 R14: 6b6b6b6b6b6b6b6b R15: ffffc20010331000
FS:  00002aee3de962d0(0000) GS:ffffffff80555000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00002aee3c6456d0 CR3: 000000000a7a7000 CR4: 00000000000006e0
Process glxinfo (pid: 7796, threadinfo ffff81003808a000, task 
ffff810021521100)
Stack:  ffff81003808beb0 0000000000000aa0 00000000000008f0 ffff81002e7e12a0
  ffffffff884820c0 ffff810032c55db0 0000000000000000 ffffffff884820c0
  0000000040186441 ffff810033d9bd00 ffffffff88482108 ffffffff884009be
Call Trace:
  [<ffffffff884009be>] :fglrx:firegl_free_buffer_queue+0x12e/0x270
  [<ffffffff8840115b>] :fglrx:firegl_free_bufs+0xab/0x180
  [<ffffffff884010b0>] :fglrx:firegl_free_bufs+0x0/0x180
  [<ffffffff883fd243>] :fglrx:firegl_ioctl+0x1c3/0x230
  [<ffffffff80245a59>] do_ioctl+0x69/0xa0
  [<ffffffff802326eb>] vfs_ioctl+0x2ab/0x2e0
  [<ffffffff80250fcc>] sys_ioctl+0x6c/0xb0
  [<ffffffff8026311e>] system_call+0x7e/0x83


Code: 41 c6 46 38 00 48 83 c4 28 31 c0 5b 5d 41 5c 41 5d 41 5e 41
RIP  [<ffffffff884064b6>] :fglrx:firegl_unbind_pcie+0x1b6/0x210
  RSP <ffff81003808bdc8>