Linaro-mm-sig

linaro-mm-sig@lists.linaro.org

24 participants
2727 discussions

[PATCH 2/2] drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1

by hackyzh002

The type of size is unsigned int, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later. Signed-off-by: hackyzh002 <hackyzh002(a)gmail.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index 08eced097..c17b3af85 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -192,7 +192,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, uint64_t *chunk_array_user; uint64_t *chunk_array; uint32_t uf_offset = 0; - unsigned int size; + uint64_t int size; int ret; int i; @@ -235,7 +235,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, size = p->chunks[i].length_dw; cdata = u64_to_user_ptr(user_chunk.chunk_data); - p->chunks[i].kdata = kvmalloc_array(size, sizeof(uint32_t), + p->chunks[i].kdata = kvcalloc(size, sizeof(uint32_t), GFP_KERNEL); if (p->chunks[i].kdata == NULL) { ret = -ENOMEM; -- 2.34.1

2 years

[PATCH v2 1/2] drm/radeon: Fix integer overflow in radeon_cs_parser_init

by hackyzh002

The type of size is unsigned, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later Signed-off-by: hackyzh002 <hackyzh002(a)gmail.com> --- drivers/gpu/drm/radeon/radeon_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c index 46a27ebf4..8e12b406e 100644 --- a/drivers/gpu/drm/radeon/radeon_cs.c +++ b/drivers/gpu/drm/radeon/radeon_cs.c @@ -270,7 +270,7 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) { struct drm_radeon_cs *cs = data; uint64_t *chunk_array_ptr; - unsigned size, i; + u64 size, i; u32 ring = RADEON_CS_RING_GFX; s32 priority = 0; -- 2.34.1

2 years

[PATCH V2 2/2] drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1

by hackyzh002

The type of size is unsigned int, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later. Signed-off-by: hackyzh002 <hackyzh002(a)gmail.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index 08eced097..c17b3af85 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -192,7 +192,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, uint64_t *chunk_array_user; uint64_t *chunk_array; uint32_t uf_offset = 0; - unsigned int size; + size_t size; int ret; int i; @@ -235,7 +235,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, size = p->chunks[i].length_dw; cdata = u64_to_user_ptr(user_chunk.chunk_data); - p->chunks[i].kdata = kvmalloc_array(size, sizeof(uint32_t), + p->chunks[i].kdata = kvcalloc(size, sizeof(uint32_t), GFP_KERNEL); if (p->chunks[i].kdata == NULL) { ret = -ENOMEM; -- 2.34.1

2 years

[PATCH 1/2] drm/radeon: Fix integer overflow in radeon_cs_parser_init

by hackyzh002

The type of size is unsigned, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later Signed-off-by: hackyzh002 <hackyzh002(a)gmail.com> --- drivers/gpu/drm/radeon/radeon_cs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c index 46a27ebf4..472c29050 100644 --- a/drivers/gpu/drm/radeon/radeon_cs.c +++ b/drivers/gpu/drm/radeon/radeon_cs.c @@ -270,7 +270,7 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) { struct drm_radeon_cs *cs = data; uint64_t *chunk_array_ptr; - unsigned size, i; + u64 size, i; u32 ring = RADEON_CS_RING_GFX; s32 priority = 0; @@ -347,7 +347,7 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) continue; } - p->chunks[i].kdata = kvmalloc_array(size, sizeof(uint32_t), GFP_KERNEL); + p->chunks[i].kdata = kvcalloc(size, sizeof(uint32_t), GFP_KERNEL); size *= sizeof(uint32_t); if (p->chunks[i].kdata == NULL) { return -ENOMEM; -- 2.34.1

2 years

[PATCH RFC 00/18] Rust DRM subsystem abstractions (& preview AGX driver)

by Asahi Lina

Hi everyone! This is my first take on the Rust abstractions for the DRM subsystem. It includes the abstractions themselves, some minor prerequisite changes to the C side, as well as the drm-asahi GPU driver (for reference on how the abstractions are used, but not necessarily intended to land together). These patches apply on top of the tree at [1], which is based on 6.3-rc1 with a large number of Rust abstraction/support commits added on top. Most of these are not prerequisites for the DRM abstractions themselves, but rather only of the driver. * #1-12 introduce the abstractions, module by module, with minor C changes before the dependent abstraction. * Patch 10 is a little addition to drm_sched that I ended up needing, but I can pull it out of the abstraction into its own patch if needed. * #13-14 add a minor feature to drm/gem and its abstraction used by the driver. * #15-16 introduce the (unstable) asahi UAPI. This is obviously not ready for merge yet, but comments are welcome! * #17 adds a Rust helper macro to handle GPU core/firmware differences. This probably belongs in the driver at this point, but right now it has to live in rust/macros since there is no mechanism for per-driver proc macros. * #18 adds the driver proper, in one big commit, for reference purposes. I've been working since mid last year on an Apple AGX GPU driver for Linux, using the (at the time) out-of-tree Rust support. As part of this effort, I've been writing safe Rust abstractions for portions of the DRM subsystem. Now that Rust itself is upstream, I'd like to get all the abstractions upstreamed so we can eventually get the driver upstreamed! These abstractions have been used by the driver since our release in December [2], in a simpler synchronous-submission form: * drm::ioctl * drm::device * drm::drv * drm::file * drm::{gem, gem::shmem} * drm::mm This series adds these too, which are used by the explicit sync refactor of the driver (the version in this series): * drm::syncobj * drm::sched * dma_fence The major dependencies for the DRM abstractions themselves are: * [3] rust: error: Add missing wrappers to convert to/from kernel error codes * [4] rust: Miscellaneous macro improvements * [5] rust: Add a Sealed trait * [6] rust: device: Add a minimal RawDevice trait * [7] rust: Enable the new_uninit feature for kernel and driver crates * [8] rust: ioctl: Add ioctl number manipulation functions * [9] rust: sync: Arc: Any downcasting and assume_init() * rust: Add `container_of` and `offset_of` macros * kernel::sync::mutex and dependencies Most of these (the ones with links) have already been submitted, and I expect all of them to land for 6.4 (the mutex one will likely be last, since there is some refactoring that will happen over the current state to make it more ergonomic to use). The mutex dep is only necessary for drm::mm and dma_fence, and transitively drm::syncobj and drm::sched. Things work! We've had most of the abstractions in production edge kernels with the driver, and the new explicit sync stuff has passed quite a few torture tests (this is how we found the drm_sched issue, patch 11). The abstractions are intended to be safe (safety review very welcome!). While writing them, I tried to avoid making any changes to the C side unless absolutely necessary. I understand that it will probably make sense to adjust the C side to make some things easier, but I wanted to start from this as a baseline. Known issues: - The existing Rust integration does not currently allow building abstractions as modules, so the Rust abstractions are only available for DRM components that are built in. I added some extra Kconfig symbols to deal with this, so a driver built as a module can depende on having those built in. This should go away in the future (but may not be ready in time for submission... I understand this probably shouldn't be a blocker though?). - DRM relies heavily on the "subclassing" pattern for driver objects, and this doesn't map well to Rust. I tried several approaches for various bits, so we can see how they work out. In particular, whether wrapper types should pretend to be smart pointers and Deref to their inner driver-specific types, and whether they should be marked as method receivers (Yuck, internal rustc implementation hacks! But Arc<T> already does the same thing and it makes usage in driver-implemented callbacks as `self` possible) are things I'd love to discuss ^^. - Only what I need for my driver is implemented (plus a small amount of obvious extras where better API completeness makes sense). I think the general idea with Rust abstractions is that we add things as they become necessary. - The plain GEM vs. GEM-shmem duality ended up with quite a hairy type hierarchy. I'd love to figure out how to make this simpler... - drm::mm ends up requiring a built-in mutex in the abstraction, instead of delegating that to the user with the usual Rust mutability rules. This is because nodes can be dropped at any time, and those operations need to be synchronized. We could try to avoid forbidding those drops or mark the node type !Send, but that would make it a lot less ergonomic to use... I'm looking for feedback on the abstractions of all kinds, so we can move towards an upstreamable version. Optimistically, I'd love to get this upstream for 6.5, and the driver for 6.6. Please feel free to ask any questions about the Rust bits, since I know a lot of this is new to many of the C folks! This is a fairly complete driver for Apple AGX G13 and G14 series GPUs. The driver today supports the Apple M1, M1 Pro, M1 Max, M1 Ultra, and M2 SoCs, across two firmware revisions each. It has an explicit sync UAPI heavily inspired by the upcoming Intel Xe UAPI, designed with Vulkan support in mind. On the Mesa side we currently have a Gallium driver that is mostly already upstream (missing the UAPI bits mostly) and passes the dEQP GLES2/EGL tests, with most of GLES3.0 passing in downstream work-in-progress branches. This is a reverse engineered community driver (we have no hardware documentation of any kind, other than some hints from aspects shared with PowerVR). While developing the driver, I tried to make use of Rust's safety and lifetime features to provide not just CPU-side safety, but also partial firmware-ABI safety. Thanks to this, it has turned out to be a very stable driver even though GPU firmware crashes are fatal (no restart capability, need to reboot!) and the FW/driver interface is a huge mess of unsafe shared memory structures with complex pointer chains. There are over 70 ABI types and 3000+ lines of firmware ABI type definitions that vary between firmware builds and GPU cores... In a simpler blocking-submission form, it has been shipping in Asahi Linux edge kernels since December [2], with lots of users and zero (!) reported oopses (and only a couple reports of GPU firmware crashes, though that issue should now be fixed). It has survived OOM scenarios (Rust makes error cleanup easy!), UAPI-level fuzzing, countless broken Mesa builds, uptimes of 40+ days, and more. The explicit sync refactor significantly increases performance (and potential problems), but this version has survived a lot of torture with dEQP/piglit tests and some manual corner case testing. In other words, Rust works! ^^ There are some design notes on the driver and further links at [10]. [1] https://github.com/AsahiLinux/linux.git drm-rfc-base-20230307 [2] https://asahilinux.org/2022/12/gpu-drivers-now-in-asahi-linux/ [3] https://lore.kernel.org/rust-for-linux/20230224-rust-error-v1-0-f8f9a9a8730… [4] https://lore.kernel.org/rust-for-linux/20230224-rust-macros-v1-0-b39fae46e1… [5] https://lore.kernel.org/rust-for-linux/20230224-rust-iopt-rtkit-v1-0-49ced3… [6] https://lore.kernel.org/rust-for-linux/20230224-rust-iopt-rtkit-v1-0-49ced3… [7] https://lore.kernel.org/rust-for-linux/CQV7ZNT6LMXI.1XG4YXSH8I7JK@vincent-a… [8] https://lore.kernel.org/rust-for-linux/61f734d6-1497-755f-3632-3f261b890846… [9] https://lore.kernel.org/rust-for-linux/20230224-rust-arc-v1-0-568eea613a41@… [10] https://github.com/AsahiLinux/docs/wiki/SW:AGX-driver-notes Signed-off-by: Asahi Lina <lina(a)asahilina.net> --- Asahi Lina (18): rust: drm: ioctl: Add DRM ioctl abstraction rust: drm: Add Device and Driver abstractions rust: drm: file: Add File abstraction rust: drm: gem: Add GEM object abstraction drm/gem-shmem: Export VM ops functions rust: drm: gem: shmem: Add DRM shmem helper abstraction rust: drm: mm: Add DRM MM Range Allocator abstraction rust: dma_fence: Add DMA Fence abstraction rust: drm: syncobj: Add DRM Sync Object abstraction drm/scheduler: Add can_run_job callback drm/scheduler: Clean up jobs when the scheduler is torn down rust: drm: sched: Add GPU scheduler abstraction drm/gem: Add a flag to control whether objects can be exported rust: drm: gem: Add set_exportable() method drm/asahi: Add the Asahi driver UAPI [DO NOT MERGE] rust: bindings: Bind the Asahi DRM UAPI rust: macros: Add versions macro drm/asahi: Add the Asahi driver for Apple AGX GPUs drivers/gpu/drm/Kconfig | 19 + drivers/gpu/drm/Makefile | 1 + drivers/gpu/drm/asahi/Kconfig | 35 + drivers/gpu/drm/asahi/Makefile | 3 + drivers/gpu/drm/asahi/alloc.rs | 1046 ++++++++++++++++++++++++++ drivers/gpu/drm/asahi/asahi.rs | 53 ++ drivers/gpu/drm/asahi/buffer.rs | 694 ++++++++++++++++++ drivers/gpu/drm/asahi/channel.rs | 542 ++++++++++++++ drivers/gpu/drm/asahi/debug.rs | 129 ++++ drivers/gpu/drm/asahi/driver.rs | 166 +++++ drivers/gpu/drm/asahi/event.rs | 229 ++++++ drivers/gpu/drm/asahi/file.rs | 718 ++++++++++++++++++ drivers/gpu/drm/asahi/float.rs | 381 ++++++++++ drivers/gpu/drm/asahi/fw/buffer.rs | 170 +++++ drivers/gpu/drm/asahi/fw/channels.rs | 385 ++++++++++ drivers/gpu/drm/asahi/fw/compute.rs | 107 +++ drivers/gpu/drm/asahi/fw/event.rs | 100 +++ drivers/gpu/drm/asahi/fw/fragment.rs | 276 +++++++ drivers/gpu/drm/asahi/fw/initdata.rs | 1264 ++++++++++++++++++++++++++++++++ drivers/gpu/drm/asahi/fw/job.rs | 56 ++ drivers/gpu/drm/asahi/fw/microseq.rs | 384 ++++++++++ drivers/gpu/drm/asahi/fw/mod.rs | 15 + drivers/gpu/drm/asahi/fw/types.rs | 233 ++++++ drivers/gpu/drm/asahi/fw/vertex.rs | 177 +++++ drivers/gpu/drm/asahi/fw/workqueue.rs | 168 +++++ drivers/gpu/drm/asahi/gem.rs | 301 ++++++++ drivers/gpu/drm/asahi/gpu.rs | 1088 +++++++++++++++++++++++++++ drivers/gpu/drm/asahi/hw/mod.rs | 522 +++++++++++++ drivers/gpu/drm/asahi/hw/t600x.rs | 140 ++++ drivers/gpu/drm/asahi/hw/t8103.rs | 80 ++ drivers/gpu/drm/asahi/hw/t8112.rs | 82 +++ drivers/gpu/drm/asahi/initdata.rs | 777 ++++++++++++++++++++ drivers/gpu/drm/asahi/mem.rs | 133 ++++ drivers/gpu/drm/asahi/microseq.rs | 61 ++ drivers/gpu/drm/asahi/mmu.rs | 1249 +++++++++++++++++++++++++++++++ drivers/gpu/drm/asahi/object.rs | 704 ++++++++++++++++++ drivers/gpu/drm/asahi/place.rs | 343 +++++++++ drivers/gpu/drm/asahi/queue/common.rs | 52 ++ drivers/gpu/drm/asahi/queue/compute.rs | 371 ++++++++++ drivers/gpu/drm/asahi/queue/mod.rs | 725 ++++++++++++++++++ drivers/gpu/drm/asahi/queue/render.rs | 1173 +++++++++++++++++++++++++++++ drivers/gpu/drm/asahi/regs.rs | 387 ++++++++++ drivers/gpu/drm/asahi/slotalloc.rs | 292 ++++++++ drivers/gpu/drm/asahi/util.rs | 44 ++ drivers/gpu/drm/asahi/workqueue.rs | 880 ++++++++++++++++++++++ drivers/gpu/drm/drm_gem.c | 1 + drivers/gpu/drm/drm_gem_shmem_helper.c | 9 +- drivers/gpu/drm/drm_prime.c | 5 + drivers/gpu/drm/scheduler/sched_main.c | 37 +- include/drm/drm_gem.h | 8 + include/drm/drm_gem_shmem_helper.h | 3 + include/drm/gpu_scheduler.h | 8 + include/uapi/drm/asahi_drm.h | 556 ++++++++++++++ rust/bindings/bindings_helper.h | 14 + rust/helpers.c | 168 +++++ rust/kernel/dma_fence.rs | 532 ++++++++++++++ rust/kernel/drm/device.rs | 76 ++ rust/kernel/drm/drv.rs | 342 +++++++++ rust/kernel/drm/file.rs | 113 +++ rust/kernel/drm/gem/mod.rs | 384 ++++++++++ rust/kernel/drm/gem/shmem.rs | 381 ++++++++++ rust/kernel/drm/ioctl.rs | 147 ++++ rust/kernel/drm/mm.rs | 309 ++++++++ rust/kernel/drm/mod.rs | 13 + rust/kernel/drm/sched.rs | 358 +++++++++ rust/kernel/drm/syncobj.rs | 77 ++ rust/kernel/lib.rs | 4 + rust/macros/lib.rs | 7 + rust/macros/versions.rs | 267 +++++++ 69 files changed, 20569 insertions(+), 5 deletions(-) --- base-commit: c9eb15274c9861026682a6b3e645891fccf88e07 change-id: 20230307-rust-drm-b5af3c2a9e55 Thank you, ~~ Lina

2 years

[PATCH] dma-buf/dma-resv.c: fix a typo

by Sui Jingfeng

The dma_resv_wait_timeout() function return a value greater than zero on success. Signed-off-by: Sui Jingfeng <suijingfeng(a)loongson.cn> --- drivers/dma-buf/dma-resv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c index 2a594b754af1..b6f71eb00866 100644 --- a/drivers/dma-buf/dma-resv.c +++ b/drivers/dma-buf/dma-resv.c @@ -660,7 +660,7 @@ EXPORT_SYMBOL_GPL(dma_resv_get_singleton); * dma_resv_lock() already * RETURNS * Returns -ERESTARTSYS if interrupted, 0 if the wait timed out, or - * greater than zer on success. + * greater than zero on success. */ long dma_resv_wait_timeout(struct dma_resv *obj, enum dma_resv_usage usage, bool intr, unsigned long timeout) -- 2.25.1

2 years

Re: [PATCH] misc: sram: Add dma-heap-export reserved SRAM area type

by Christian Gmeiner

Hi Andrew > > > Okay, will split for v2. > > Was there a follow-up v2 of this patchset? AFAICT this series did not make it into the mainline kernel. Do you have any plans to work on it? If not I would like to help out as we have a use case where we want to use a dma-buf sram exporter. -- greets -- Christian Gmeiner, MSc https://christian-gmeiner.info/privacypolicy

2 years

Linux 6.2.1 hits a display driver bug (list_del corruption, ffff88811b4af298->next is NULL)

by Ammar Faizi

Hi, Linux 6.2.1 hits a display driver bug (list_del corruption, ffff88811b4af298->next is NULL). Unfortunately, I don't know the last good commit and the first bad commit. Kernel cmdline: BOOT_IMAGE=/boot/vmlinuz-6.2.1-2023-03-02+ root=UUID=7fde1a94-25e3-4995-adfc-654939cc8442 ro mitigations=off pti=off log_buf_len=32M modprobe.blacklist=bluetooth intel_iommu=igfx_off Kernel version: Linux 6.2.1 (with Ubuntu 22.04) Hardware info: integral2 description: Notebook product: HP Laptop 14s-dq2xxx (308Z6PA#AR6) vendor: HP version: Chassis Version serial: 5CD1409WC1 width: 64 bits capabilities: smbios-3.3.0 dmi-3.3.0 smp vsyscall32 configuration: boot=normal chassis=notebook family=103C_5335KV HP Notebook sku=308Z6PA#AR6 uuid=31444335-3034-5739-4331-315730344435 *-display description: VGA compatible controller product: TigerLake-LP GT2 [Iris Xe Graphics] vendor: Intel Corporation physical id: 2 bus info: pci@0000:00:02.0 logical name: /dev/fb0 version: 01 width: 64 bits clock: 33MHz capabilities: pciexpress msi pm vga_controller bus_master cap_list rom fb configuration: depth=32 driver=i915 latency=0 mode=1920x1080 resolution=1920,1080 visual=truecolor xres=1920 yres=1080 resources: iomemory:600-5ff iomemory:400-3ff irq:143 memory:6002000000-6002ffffff memory:4000000000-400fffffff ioport:4000(size=64) memory:c0000-dffff memory:4010000000-4016ffffff memory:4020000000-40ffffffff It hits this bug and it immediately kills the GUI (full dmesg log attached as a file, dmesg.txt): <6>[ 70.743338] Console: switching to colour dummy device 80x25 <4>[ 70.904380] ------------[ cut here ]------------ <4>[ 70.904383] WARNING: CPU: 2 PID: 1256 at drivers/gpu/drm/drm_mode_config.c:505 drm_mode_config_cleanup+0x245/0x310 [drm] <4>[ 70.904409] Modules linked in: nvme_fabrics ccm r8153_ecm cdc_ether usbnet r8152 uas usb_storage mii xt_CHECKSUM xt_MASQUERADE xt_conntrack ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc snd_ctl_led snd_soc_skl_hda_dsp snd_soc_hdac_hdmi snd_soc_intel_hda_dsp_common snd_sof_probes snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_soc_dmic snd_sof_pci_intel_tgl snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda soundwire_intel soundwire_generic_allocation soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp snd_sof rtw88_8822ce rtw88_8822c snd_sof_utils snd_hda_ext_core snd_soc_acpi_intel_match rtw88_pci snd_soc_acpi soundwire_bus rtw88_core snd_soc_core snd_compress mac80211 ac97_bus snd_pcm_dmaengine snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core uvcvideo snd_hwdep snd_pcm <4>[ 70.904460] x86_pkg_temp_thermal intel_powerclamp videobuf2_vmalloc snd_seq_midi coretemp videobuf2_memops snd_seq_midi_event nls_iso8859_1 videobuf2_v4l2 snd_rawmidi kvm_intel videodev processor_thermal_device_pci_legacy snd_seq processor_thermal_device hid_multitouch processor_thermal_rfim crct10dif_pclmul iTCO_wdt crc32_pclmul processor_thermal_mbox snd_seq_device ghash_clmulni_intel intel_pmc_bxt mei_hdcp ee1004 intel_rapl_msr iTCO_vendor_support snd_timer videobuf2_common processor_thermal_rapl btrfs cfg80211 sha512_ssse3 snd mc intel_lpss_pci mei_me i2c_i801 intel_rapl_common intel_lpss serio_raw mei libarc4 soundcore wmi_bmof i2c_smbus idma64 intel_soc_dts_iosf i2c_hid_acpi i2c_hid int3403_thermal int3400_thermal acpi_thermal_rel acpi_pad int340x_thermal_zone dptf_pch_fivr sch_fq_codel kvmgt mdev kvm parport_pc ppdev lp parport ramoops reed_solomon efi_pstore ip_tables x_tables autofs4 raid10 raid456 libcrc32c async_raid6_recov async_pq raid6_pq async_xor xor <4>[ 70.904494] async_memcpy async_tx raid1 raid0 multipath linear dm_mirror dm_region_hash dm_log joydev hid_generic usbhid hid nvme nvme_core i915 drm_buddy i2c_algo_bit ttm drm_display_helper cec rc_core drm_kms_helper sysimgblt syscopyarea sysfillrect aesni_intel drm crypto_simd cryptd xhci_pci input_leds xhci_pci_renesas vmd video wmi pinctrl_tigerlake mac_hid <4>[ 70.904507] CPU: 2 PID: 1256 Comm: rpc-libvirtd Not tainted 6.2.1-2023-03-02+ #1 be1c0ea3c87f9b2d4a6dfee589899950dc18f771 <4>[ 70.904509] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.21 03/21/2022 <4>[ 70.904510] RIP: 0010:drm_mode_config_cleanup+0x245/0x310 [drm] <4>[ 70.904520] Code: 21 3d c3 e1 48 8b 83 b8 01 00 00 48 81 c3 b8 01 00 00 48 39 d8 0f 85 c1 00 00 00 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 <0f> 0b 48 89 1c 24 48 c7 44 24 08 00 00 00 00 49 89 e6 4c 89 f7 e8 <4>[ 70.904521] RSP: 0018:ffff888108e2bc88 EFLAGS: 00010202 <4>[ 70.904522] RAX: ffff888124e18270 RBX: ffff888124e18000 RCX: ffff888126a85020 <4>[ 70.904523] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff888108e2bc30 <4>[ 70.904523] RBP: 0000000000000000 R08: ffff8881073a0000 R09: 0000000000000100 <4>[ 70.904524] R10: 0000000000000100 R11: 0000000000000100 R12: ffff888126a87000 <4>[ 70.904525] R13: ffffffffa072ad40 R14: ffff888108e2bc88 R15: ffff888126a87050 <4>[ 70.904525] FS: 00007fa5985fe640(0000) GS:ffff889036a80000(0000) knlGS:0000000000000000 <4>[ 70.904526] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 70.904527] CR2: 0000560b7d3c33c8 CR3: 0000000108ada002 CR4: 0000000000770ee0 <4>[ 70.904528] PKRU: 55555554 <4>[ 70.904528] Call Trace: <4>[ 70.904530] <TASK> <4>[ 70.904531] ? intel_atomic_global_obj_cleanup+0x4a/0xf0 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.904564] intel_modeset_driver_remove_noirq+0xea/0x160 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.904588] i915_driver_remove+0x155/0x360 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.904616] i915_pci_remove+0x15/0x30 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.904651] pci_device_remove+0x6d/0x110 <4>[ 70.904654] device_release_driver_internal+0x30e/0x520 <4>[ 70.904658] unbind_store+0x17f/0x200 <4>[ 70.904660] ? klist_devices_get+0x10/0x10 <4>[ 70.904662] kernfs_fop_write_iter+0x18b/0x2c0 <4>[ 70.904665] vfs_write+0x324/0x3e0 <4>[ 70.904669] ksys_write+0x50/0xc0 <4>[ 70.904671] do_syscall_64+0x2b/0x50 <4>[ 70.904673] entry_SYSCALL_64_after_hwframe+0x24/0x8e <4>[ 70.904676] RIP: 0033:0x7fa59cf14a6f <4>[ 70.904678] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48 <4>[ 70.904679] RSP: 002b:00007fa5985fd2e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 <4>[ 70.904681] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007fa59cf14a6f <4>[ 70.904682] RDX: 000000000000000c RSI: 00007fa5880461c0 RDI: 000000000000001d <4>[ 70.904682] RBP: 00007fa5880461c0 R08: 0000000000000000 R09: 000000007fffffff <4>[ 70.904683] R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000001d <4>[ 70.904684] R13: 000000000000001d R14: 0000000000000000 R15: 00007fa588048340 <4>[ 70.904685] </TASK> <4>[ 70.904686] ---[ end trace 0000000000000000 ]--- <3>[ 70.904688] [drm:drm_mode_config_cleanup [drm]] *ERROR* connector HDMI-A-1 leaked! <4>[ 70.904745] ------------[ cut here ]------------ <4>[ 70.904745] i915 0000:00:02.0: drm_WARN_ON(plane_state->ggtt_vma) <4>[ 70.904781] WARNING: CPU: 2 PID: 1256 at drivers/gpu/drm/i915/display/intel_atomic_plane.c:134 intel_plane_destroy_state+0x7a/0xd0 [i915] <4>[ 70.904822] Modules linked in: nvme_fabrics ccm r8153_ecm cdc_ether usbnet r8152 uas usb_storage mii xt_CHECKSUM xt_MASQUERADE xt_conntrack ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc snd_ctl_led snd_soc_skl_hda_dsp snd_soc_hdac_hdmi snd_soc_intel_hda_dsp_common snd_sof_probes snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_soc_dmic snd_sof_pci_intel_tgl snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda soundwire_intel soundwire_generic_allocation soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp snd_sof rtw88_8822ce rtw88_8822c snd_sof_utils snd_hda_ext_core snd_soc_acpi_intel_match rtw88_pci snd_soc_acpi soundwire_bus rtw88_core snd_soc_core snd_compress mac80211 ac97_bus snd_pcm_dmaengine snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core uvcvideo snd_hwdep snd_pcm <4>[ 70.904847] x86_pkg_temp_thermal intel_powerclamp videobuf2_vmalloc snd_seq_midi coretemp videobuf2_memops snd_seq_midi_event nls_iso8859_1 videobuf2_v4l2 snd_rawmidi kvm_intel videodev processor_thermal_device_pci_legacy snd_seq processor_thermal_device hid_multitouch processor_thermal_rfim crct10dif_pclmul iTCO_wdt crc32_pclmul processor_thermal_mbox snd_seq_device ghash_clmulni_intel intel_pmc_bxt mei_hdcp ee1004 intel_rapl_msr iTCO_vendor_support snd_timer videobuf2_common processor_thermal_rapl btrfs cfg80211 sha512_ssse3 snd mc intel_lpss_pci mei_me i2c_i801 intel_rapl_common intel_lpss serio_raw mei libarc4 soundcore wmi_bmof i2c_smbus idma64 intel_soc_dts_iosf i2c_hid_acpi i2c_hid int3403_thermal int3400_thermal acpi_thermal_rel acpi_pad int340x_thermal_zone dptf_pch_fivr sch_fq_codel kvmgt mdev kvm parport_pc ppdev lp parport ramoops reed_solomon efi_pstore ip_tables x_tables autofs4 raid10 raid456 libcrc32c async_raid6_recov async_pq raid6_pq async_xor xor <4>[ 70.904868] async_memcpy async_tx raid1 raid0 multipath linear dm_mirror dm_region_hash dm_log joydev hid_generic usbhid hid nvme nvme_core i915 drm_buddy i2c_algo_bit ttm drm_display_helper cec rc_core drm_kms_helper sysimgblt syscopyarea sysfillrect aesni_intel drm crypto_simd cryptd xhci_pci input_leds xhci_pci_renesas vmd video wmi pinctrl_tigerlake mac_hid <4>[ 70.904879] CPU: 2 PID: 1256 Comm: rpc-libvirtd Tainted: G W 6.2.1-2023-03-02+ #1 be1c0ea3c87f9b2d4a6dfee589899950dc18f771 <4>[ 70.904881] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.21 03/21/2022 <4>[ 70.904881] RIP: 0010:intel_plane_destroy_state+0x7a/0xd0 [i915] <4>[ 70.904904] Code: e1 49 8b 0e 48 8b 49 08 48 8b 51 50 48 85 d2 75 03 48 8b 11 48 c7 c7 4e 09 64 a0 48 89 c6 48 c7 c1 bf 4f 65 a0 e8 56 22 b5 e0 <0f> 0b 48 83 bb c8 00 00 00 00 74 97 49 8b 06 48 8b 78 08 e8 fe de <4>[ 70.904905] RSP: 0018:ffff888108e2bc40 EFLAGS: 00010286 <4>[ 70.904905] RAX: 0000000000000035 RBX: ffff88811b4aee00 RCX: 0000000000000027 <4>[ 70.904906] RDX: ffff888108e2bb40 RSI: 00000000ffefffff RDI: ffff889036a9d988 <4>[ 70.904906] RBP: 0000000000000000 R08: 00000000000fffff R09: ffff88907c3fe000 <4>[ 70.904907] R10: 00000000002ffffd R11: 0000000000000004 R12: ffff888126a87000 <4>[ 70.904907] R13: ffffffffa072ad40 R14: ffff888126a89400 R15: ffff888124e18000 <4>[ 70.904908] FS: 00007fa5985fe640(0000) GS:ffff889036a80000(0000) knlGS:0000000000000000 <4>[ 70.904909] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 70.904909] CR2: 0000560b7d3c33c8 CR3: 0000000108ada002 CR4: 0000000000770ee0 <4>[ 70.904910] PKRU: 55555554 <4>[ 70.904910] Call Trace: <4>[ 70.904911] <TASK> <4>[ 70.904912] drm_plane_cleanup+0xe9/0x140 [drm 1ef2a6610e3c2e37712af413a4bba8eff7774cb4] <4>[ 70.904924] intel_plane_destroy+0x9/0x20 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.904947] drm_mode_config_cleanup+0x141/0x310 [drm 1ef2a6610e3c2e37712af413a4bba8eff7774cb4] <4>[ 70.904957] ? intel_atomic_global_obj_cleanup+0x4a/0xf0 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.904980] intel_modeset_driver_remove_noirq+0xea/0x160 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.905003] i915_driver_remove+0x155/0x360 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.905028] i915_pci_remove+0x15/0x30 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.905060] pci_device_remove+0x6d/0x110 <4>[ 70.905061] device_release_driver_internal+0x30e/0x520 <4>[ 70.905063] unbind_store+0x17f/0x200 <4>[ 70.905065] ? klist_devices_get+0x10/0x10 <4>[ 70.905066] kernfs_fop_write_iter+0x18b/0x2c0 <4>[ 70.905068] vfs_write+0x324/0x3e0 <4>[ 70.905070] ksys_write+0x50/0xc0 <4>[ 70.905071] do_syscall_64+0x2b/0x50 <4>[ 70.905073] entry_SYSCALL_64_after_hwframe+0x24/0x8e <4>[ 70.905074] RIP: 0033:0x7fa59cf14a6f <4>[ 70.905075] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48 <4>[ 70.905076] RSP: 002b:00007fa5985fd2e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 <4>[ 70.905077] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007fa59cf14a6f <4>[ 70.905077] RDX: 000000000000000c RSI: 00007fa5880461c0 RDI: 000000000000001d <4>[ 70.905077] RBP: 00007fa5880461c0 R08: 0000000000000000 R09: 000000007fffffff <4>[ 70.905078] R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000001d <4>[ 70.905078] R13: 000000000000001d R14: 0000000000000000 R15: 00007fa588048340 <4>[ 70.905079] </TASK> <4>[ 70.905079] ---[ end trace 0000000000000000 ]--- <4>[ 70.905139] ------------[ cut here ]------------ <4>[ 70.905139] WARNING: CPU: 2 PID: 1256 at drivers/gpu/drm/drm_mode_config.c:539 drm_mode_config_cleanup+0x27a/0x310 [drm] <4>[ 70.905158] Modules linked in: nvme_fabrics ccm r8153_ecm cdc_ether usbnet r8152 uas usb_storage mii xt_CHECKSUM xt_MASQUERADE xt_conntrack ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc snd_ctl_led snd_soc_skl_hda_dsp snd_soc_hdac_hdmi snd_soc_intel_hda_dsp_common snd_sof_probes snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_soc_dmic snd_sof_pci_intel_tgl snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda soundwire_intel soundwire_generic_allocation soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp snd_sof rtw88_8822ce rtw88_8822c snd_sof_utils snd_hda_ext_core snd_soc_acpi_intel_match rtw88_pci snd_soc_acpi soundwire_bus rtw88_core snd_soc_core snd_compress mac80211 ac97_bus snd_pcm_dmaengine snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core uvcvideo snd_hwdep snd_pcm <4>[ 70.905176] x86_pkg_temp_thermal intel_powerclamp videobuf2_vmalloc snd_seq_midi coretemp videobuf2_memops snd_seq_midi_event nls_iso8859_1 videobuf2_v4l2 snd_rawmidi kvm_intel videodev processor_thermal_device_pci_legacy snd_seq processor_thermal_device hid_multitouch processor_thermal_rfim crct10dif_pclmul iTCO_wdt crc32_pclmul processor_thermal_mbox snd_seq_device ghash_clmulni_intel intel_pmc_bxt mei_hdcp ee1004 intel_rapl_msr iTCO_vendor_support snd_timer videobuf2_common processor_thermal_rapl btrfs cfg80211 sha512_ssse3 snd mc intel_lpss_pci mei_me i2c_i801 intel_rapl_common intel_lpss serio_raw mei libarc4 soundcore wmi_bmof i2c_smbus idma64 intel_soc_dts_iosf i2c_hid_acpi i2c_hid int3403_thermal int3400_thermal acpi_thermal_rel acpi_pad int340x_thermal_zone dptf_pch_fivr sch_fq_codel kvmgt mdev kvm parport_pc ppdev lp parport ramoops reed_solomon efi_pstore ip_tables x_tables autofs4 raid10 raid456 libcrc32c async_raid6_recov async_pq raid6_pq async_xor xor <4>[ 70.905194] async_memcpy async_tx raid1 raid0 multipath linear dm_mirror dm_region_hash dm_log joydev hid_generic usbhid hid nvme nvme_core i915 drm_buddy i2c_algo_bit ttm drm_display_helper cec rc_core drm_kms_helper sysimgblt syscopyarea sysfillrect aesni_intel drm crypto_simd cryptd xhci_pci input_leds xhci_pci_renesas vmd video wmi pinctrl_tigerlake mac_hid <4>[ 70.905205] CPU: 2 PID: 1256 Comm: rpc-libvirtd Tainted: G W 6.2.1-2023-03-02+ #1 be1c0ea3c87f9b2d4a6dfee589899950dc18f771 <4>[ 70.905206] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.21 03/21/2022 <4>[ 70.905206] RIP: 0010:drm_mode_config_cleanup+0x27a/0x310 [drm] <4>[ 70.905216] Code: 00 00 00 00 49 89 e6 4c 89 f7 e8 41 4d fe ff 48 85 c0 0f 84 96 00 00 00 48 8b 70 60 48 c7 c7 50 85 31 a0 e8 f8 8f 00 00 eb dd <0f> 0b 4d 8b 75 00 4d 39 ee 0f 84 72 ff ff ff 4c 8d 7c 24 10 4d 8d <4>[ 70.905217] RSP: 0018:ffff888108e2bc88 EFLAGS: 00010287 <4>[ 70.905218] RAX: ffff88811b4af208 RBX: ffff888124e18000 RCX: 0000000000000296 <4>[ 70.905218] RDX: ffffea000451be00 RSI: 0000000000000000 RDI: ffff888100042a00 <4>[ 70.905218] RBP: 0000000000000000 R08: ffffea000410f900 R09: 0000000000000003 <4>[ 70.905219] R10: 0000000000000002 R11: 0000000000000002 R12: ffff888124e183a8 <4>[ 70.905219] R13: ffff888124e18248 R14: ffff8881146fbc10 R15: ffff888124e183a8 <4>[ 70.905220] FS: 00007fa5985fe640(0000) GS:ffff889036a80000(0000) knlGS:0000000000000000 <4>[ 70.905221] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 70.905221] CR2: 0000560b7d3c33c8 CR3: 0000000108ada002 CR4: 0000000000770ee0 <4>[ 70.905222] PKRU: 55555554 <4>[ 70.905222] Call Trace: <4>[ 70.905223] <TASK> <4>[ 70.905223] ? intel_atomic_global_obj_cleanup+0x4a/0xf0 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.905250] intel_modeset_driver_remove_noirq+0xea/0x160 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.905273] i915_driver_remove+0x155/0x360 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.905299] i915_pci_remove+0x15/0x30 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.905334] pci_device_remove+0x6d/0x110 <4>[ 70.905335] device_release_driver_internal+0x30e/0x520 <4>[ 70.905338] unbind_store+0x17f/0x200 <4>[ 70.905339] ? klist_devices_get+0x10/0x10 <4>[ 70.905341] kernfs_fop_write_iter+0x18b/0x2c0 <4>[ 70.905343] vfs_write+0x324/0x3e0 <4>[ 70.905345] ksys_write+0x50/0xc0 <4>[ 70.905347] do_syscall_64+0x2b/0x50 <4>[ 70.905348] entry_SYSCALL_64_after_hwframe+0x24/0x8e <4>[ 70.905350] RIP: 0033:0x7fa59cf14a6f <4>[ 70.905351] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48 <4>[ 70.905352] RSP: 002b:00007fa5985fd2e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 <4>[ 70.905353] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007fa59cf14a6f <4>[ 70.905354] RDX: 000000000000000c RSI: 00007fa5880461c0 RDI: 000000000000001d <4>[ 70.905354] RBP: 00007fa5880461c0 R08: 0000000000000000 R09: 000000007fffffff <4>[ 70.905355] R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000001d <4>[ 70.905356] R13: 000000000000001d R14: 0000000000000000 R15: 00007fa588048340 <4>[ 70.905357] </TASK> <4>[ 70.905357] ---[ end trace 0000000000000000 ]--- <7>[ 70.905358] [leaked fb] framebuffer[362]: <7>[ 70.905359] [leaked fb] allocated by = Xorg <7>[ 70.905360] [leaked fb] refcount=1 <7>[ 70.905361] [leaked fb] format=XR24 little-endian (0x34325258) <7>[ 70.905362] [leaked fb] modifier=0x100000000000001 <7>[ 70.905363] [leaked fb] size=1920x1080 <7>[ 70.905364] [leaked fb] layers: <7>[ 70.905364] [leaked fb] size[0]=1920x1080 <7>[ 70.905366] [leaked fb] pitch[0]=7680 <7>[ 70.905367] [leaked fb] offset[0]=0 <7>[ 70.905367] [leaked fb] obj[0]: <7>[ 70.905368] [leaked fb] name=0 <7>[ 70.905369] [leaked fb] refcount=4 <7>[ 70.905370] [leaked fb] start=00000000 <7>[ 70.905371] [leaked fb] size=8388608 <7>[ 70.905371] [leaked fb] imported=no <4>[ 70.905373] ------------[ cut here ]------------ <4>[ 70.905374] i915 0000:00:02.0: drm_WARN_ON(atomic_read(&front->bits)) <4>[ 70.905399] WARNING: CPU: 2 PID: 1256 at drivers/gpu/drm/i915/display/intel_frontbuffer.c:231 intel_frontbuffer_put+0x133/0x160 [i915] <4>[ 70.905440] Modules linked in: nvme_fabrics ccm r8153_ecm cdc_ether usbnet r8152 uas usb_storage mii xt_CHECKSUM xt_MASQUERADE xt_conntrack ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc snd_ctl_led snd_soc_skl_hda_dsp snd_soc_hdac_hdmi snd_soc_intel_hda_dsp_common snd_sof_probes snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_soc_dmic snd_sof_pci_intel_tgl snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda soundwire_intel soundwire_generic_allocation soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp snd_sof rtw88_8822ce rtw88_8822c snd_sof_utils snd_hda_ext_core snd_soc_acpi_intel_match rtw88_pci snd_soc_acpi soundwire_bus rtw88_core snd_soc_core snd_compress mac80211 ac97_bus snd_pcm_dmaengine snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core uvcvideo snd_hwdep snd_pcm <4>[ 70.905465] x86_pkg_temp_thermal intel_powerclamp videobuf2_vmalloc snd_seq_midi coretemp videobuf2_memops snd_seq_midi_event nls_iso8859_1 videobuf2_v4l2 snd_rawmidi kvm_intel videodev processor_thermal_device_pci_legacy snd_seq processor_thermal_device hid_multitouch processor_thermal_rfim crct10dif_pclmul iTCO_wdt crc32_pclmul processor_thermal_mbox snd_seq_device ghash_clmulni_intel intel_pmc_bxt mei_hdcp ee1004 intel_rapl_msr iTCO_vendor_support snd_timer videobuf2_common processor_thermal_rapl btrfs cfg80211 sha512_ssse3 snd mc intel_lpss_pci mei_me i2c_i801 intel_rapl_common intel_lpss serio_raw mei libarc4 soundcore wmi_bmof i2c_smbus idma64 intel_soc_dts_iosf i2c_hid_acpi i2c_hid int3403_thermal int3400_thermal acpi_thermal_rel acpi_pad int340x_thermal_zone dptf_pch_fivr sch_fq_codel kvmgt mdev kvm parport_pc ppdev lp parport ramoops reed_solomon efi_pstore ip_tables x_tables autofs4 raid10 raid456 libcrc32c async_raid6_recov async_pq raid6_pq async_xor xor <4>[ 70.905491] async_memcpy async_tx raid1 raid0 multipath linear dm_mirror dm_region_hash dm_log joydev hid_generic usbhid hid nvme nvme_core i915 drm_buddy i2c_algo_bit ttm drm_display_helper cec rc_core drm_kms_helper sysimgblt syscopyarea sysfillrect aesni_intel drm crypto_simd cryptd xhci_pci input_leds xhci_pci_renesas vmd video wmi pinctrl_tigerlake mac_hid <4>[ 70.905502] CPU: 2 PID: 1256 Comm: rpc-libvirtd Tainted: G W 6.2.1-2023-03-02+ #1 be1c0ea3c87f9b2d4a6dfee589899950dc18f771 <4>[ 70.905503] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.21 03/21/2022 <4>[ 70.905504] RIP: 0010:intel_frontbuffer_put+0x133/0x160 [i915] <4>[ 70.905538] Code: 49 8b 4e 08 48 8b 49 08 48 8b 51 50 48 85 d2 75 03 48 8b 11 48 c7 c7 4e 09 64 a0 48 89 c6 48 c7 c1 57 7e 67 a0 e8 2d c2 af e0 <0f> 0b e9 fc fe ff ff 4c 89 f7 be 03 00 00 00 e8 c9 03 12 e1 48 85 <4>[ 70.905539] RSP: 0018:ffff888108e2bc58 EFLAGS: 00010282 <4>[ 70.905540] RAX: 0000000000000039 RBX: ffff8881db8cc840 RCX: 0000000000000027 <4>[ 70.905541] RDX: ffff888108e2bb60 RSI: 00000000ffefffff RDI: ffff889036a9d988 <4>[ 70.905542] RBP: ffff888124e18248 R08: 00000000000fffff R09: ffff88907c3fe000 <4>[ 70.905543] R10: 00000000002ffffd R11: 0000000000000004 R12: ffff88811b4af200 <4>[ 70.905544] R13: ffff888124e18248 R14: ffff8881272c9540 R15: ffff888108e2bc98 <4>[ 70.905544] FS: 00007fa5985fe640(0000) GS:ffff889036a80000(0000) knlGS:0000000000000000 <4>[ 70.905545] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 70.905546] CR2: 0000560b7d3c33c8 CR3: 0000000108ada002 CR4: 0000000000770ee0 <4>[ 70.905547] PKRU: 55555554 <4>[ 70.905548] Call Trace: <4>[ 70.905548] <TASK> <4>[ 70.905549] intel_user_framebuffer_destroy+0x62/0x80 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.905588] drm_mode_config_cleanup+0x2ea/0x310 [drm 1ef2a6610e3c2e37712af413a4bba8eff7774cb4] <4>[ 70.905606] ? __drm_printfn_err+0x20/0x20 [drm 1ef2a6610e3c2e37712af413a4bba8eff7774cb4] <4>[ 70.905623] intel_modeset_driver_remove_noirq+0xea/0x160 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.905660] i915_driver_remove+0x155/0x360 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.905697] i915_pci_remove+0x15/0x30 [i915 1a16f678887c5c6625f3e451fd91db00b38001bb] <4>[ 70.905734] pci_device_remove+0x6d/0x110 <4>[ 70.905735] device_release_driver_internal+0x30e/0x520 <4>[ 70.905738] unbind_store+0x17f/0x200 <4>[ 70.905739] ? klist_devices_get+0x10/0x10 <4>[ 70.905741] kernfs_fop_write_iter+0x18b/0x2c0 <4>[ 70.905743] vfs_write+0x324/0x3e0 <4>[ 70.905745] ksys_write+0x50/0xc0 <4>[ 70.905747] do_syscall_64+0x2b/0x50 <4>[ 70.905749] entry_SYSCALL_64_after_hwframe+0x24/0x8e <4>[ 70.905751] RIP: 0033:0x7fa59cf14a6f <4>[ 70.905752] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 19 c0 f7 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c c0 f7 ff 48 <4>[ 70.905753] RSP: 002b:00007fa5985fd2e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 <4>[ 70.905754] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007fa59cf14a6f <4>[ 70.905754] RDX: 000000000000000c RSI: 00007fa5880461c0 RDI: 000000000000001d <4>[ 70.905755] RBP: 00007fa5880461c0 R08: 0000000000000000 R09: 000000007fffffff <4>[ 70.905755] R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000001d <4>[ 70.905756] R13: 000000000000001d R14: 0000000000000000 R15: 00007fa588048340 <4>[ 70.905756] </TASK> <4>[ 70.905757] ---[ end trace 0000000000000000 ]--- <6>[ 71.017755] vfio-pci 0000:00:02.0: vgaarb: deactivate vga console <6>[ 71.017759] vfio-pci 0000:00:02.0: vgaarb: changed VGA decodes: olddecodes=io+mem,decodes=io+mem:owns=io+mem <4>[ 71.017780] vfio-pci: probe of 0000:00:02.0 failed with error -22 <6>[ 71.036734] i915 0000:00:02.0: vgaarb: deactivate vga console <6>[ 71.036796] i915 0000:00:02.0: [drm] Using Transparent Hugepages <6>[ 71.040718] mei_hdcp 0000:00:16.0-b638ab7e-94e2-4ea2-a552-d1c54b627f04: bound 0000:00:02.0 (ops i915_hdcp_component_ops [i915]) <7>[ 71.046344] rfkill: input handler enabled <6>[ 71.055484] i915 0000:00:02.0: [drm] Finished loading DMC firmware i915/tgl_dmc_ver2_12.bin (v2.12) <6>[ 71.308992] [drm] Initialized i915 1.6.0 20201103 for 0000:00:02.0 on minor 1 <6>[ 71.310227] ACPI: video: Video Device [GFX0] (multi-head: yes rom: no post: no) <6>[ 71.310436] input: Video Bus as /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/LNXVIDEO:00/input/input24 <6>[ 71.310556] sof-audio-pci-intel-tgl 0000:00:1f.3: bound 0000:00:02.0 (ops i915_audio_component_bind_ops [i915]) <6>[ 71.348945] fbcon: i915drmfb (fb0) is primary device <6>[ 71.779214] Console: switching to colour frame buffer device 240x67 <6>[ 71.798775] i915 0000:00:02.0: [drm] fb0: i915drmfb frame buffer device <7>[ 75.385307] rfkill: input handler disabled <3>[ 76.067662] list_del corruption, ffff88811b4af298->next is NULL <4>[ 76.067686] ------------[ cut here ]------------ <2>[ 76.067686] kernel BUG at lib/list_debug.c:50! <4>[ 76.067697] invalid opcode: 0000 [#1] PREEMPT SMP <4>[ 76.067705] CPU: 6 PID: 1834 Comm: Xorg:sh0 Tainted: G W 6.2.1-2023-03-02+ #1 be1c0ea3c87f9b2d4a6dfee589899950dc18f771 <4>[ 76.067726] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.21 03/21/2022 <4>[ 76.067737] RIP: 0010:__list_del_entry_valid+0x4c/0xa0 <4>[ 76.067749] Code: 39 48 83 c2 22 48 39 d0 74 3e 48 8b 10 48 39 f2 75 44 48 8b 51 08 48 39 f2 75 4c b0 01 c3 48 c7 c7 b1 1f 45 82 e8 c4 c7 a6 ff <0f> 0b 48 c7 c7 62 a9 4d 82 e8 b6 c7 a6 ff 0f 0b 48 c7 c7 fa 60 4f <4>[ 76.067778] RSP: 0018:ffff8881038a7c50 EFLAGS: 00010286 <4>[ 76.067788] RAX: 0000000000000033 RBX: ffff8881038a7c78 RCX: 0000000000000000 <4>[ 76.067799] RDX: ffff889036ba0cf8 RSI: 00000000ffefffff RDI: ffff889036b9d988 <4>[ 76.067809] RBP: 00000000fff00000 R08: 00000000000fffff R09: ffff88907c3fe000 <4>[ 76.067820] R10: 00000000002ffffd R11: 0000000000000004 R12: ffff8881031d18f8 <4>[ 76.067830] R13: 0000000000000000 R14: ffff8881031d1890 R15: ffff88811b4af298 <4>[ 76.067841] FS: 0000000000000000(0000) GS:ffff889036b80000(0000) knlGS:0000000000000000 <4>[ 76.067854] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 76.067862] CR2: 00007f5930738fa0 CR3: 000000010754d001 CR4: 0000000000770ee0 <4>[ 76.067874] PKRU: 55555554 <4>[ 76.067880] Call Trace: <4>[ 76.067885] <TASK> <4>[ 76.067890] drm_fb_release+0x5c/0x170 [drm 1ef2a6610e3c2e37712af413a4bba8eff7774cb4] <4>[ 76.067914] ? __slab_free+0x54/0x1d0 <4>[ 76.067922] drm_file_free+0x184/0x260 [drm 1ef2a6610e3c2e37712af413a4bba8eff7774cb4] <4>[ 76.067943] drm_release_noglobal+0x68/0x120 [drm 1ef2a6610e3c2e37712af413a4bba8eff7774cb4] <4>[ 76.067966] __fput+0xe9/0x3a0 <4>[ 76.067973] do_exit+0x55c/0xf00 <4>[ 76.067981] do_group_exit+0x73/0x90 <4>[ 76.067987] get_signal+0x6fd/0x7a0 <4>[ 76.067994] arch_do_signal_or_restart+0x15/0x210 <4>[ 76.068002] ? do_futex+0x64/0x110 <4>[ 76.068008] exit_to_user_mode_loop+0x49/0x140 <4>[ 76.068017] exit_to_user_mode_prepare+0x96/0x140 <4>[ 76.068025] syscall_exit_to_user_mode+0x2d/0x120 <4>[ 76.068033] entry_SYSCALL_64_after_hwframe+0x24/0x8e <4>[ 76.068042] RIP: 0033:0x7fb640491197 <4>[ 76.068049] Code: Unable to access opcode bytes at 0x7fb64049116d. <4>[ 76.068058] RSP: 002b:00007fb62fffe840 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca <4>[ 76.068071] RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 00007fb640491197 <4>[ 76.068081] RDX: 0000000000000000 RSI: 0000000000000189 RDI: 0000555845204e78 <4>[ 76.068091] RBP: 0000555845204e50 R08: 0000000000000000 R09: 00000000ffffffff <4>[ 76.068103] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 <4>[ 76.068115] R13: 0000000000000000 R14: 0000000000000020 R15: 0000555845204e78 <4>[ 76.068128] </TASK> <4>[ 76.068132] Modules linked in: nvme_fabrics ccm r8153_ecm cdc_ether usbnet r8152 uas usb_storage mii xt_CHECKSUM xt_MASQUERADE xt_conntrack ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc snd_ctl_led snd_soc_skl_hda_dsp snd_soc_hdac_hdmi snd_soc_intel_hda_dsp_common snd_sof_probes snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_soc_dmic snd_sof_pci_intel_tgl snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda soundwire_intel soundwire_generic_allocation soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp snd_sof rtw88_8822ce rtw88_8822c snd_sof_utils snd_hda_ext_core snd_soc_acpi_intel_match rtw88_pci snd_soc_acpi soundwire_bus rtw88_core snd_soc_core snd_compress mac80211 ac97_bus snd_pcm_dmaengine snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core uvcvideo snd_hwdep snd_pcm <4>[ 76.068156] x86_pkg_temp_thermal intel_powerclamp videobuf2_vmalloc snd_seq_midi coretemp videobuf2_memops snd_seq_midi_event nls_iso8859_1 videobuf2_v4l2 snd_rawmidi kvm_intel videodev processor_thermal_device_pci_legacy snd_seq processor_thermal_device hid_multitouch processor_thermal_rfim crct10dif_pclmul iTCO_wdt crc32_pclmul processor_thermal_mbox snd_seq_device ghash_clmulni_intel intel_pmc_bxt mei_hdcp ee1004 intel_rapl_msr iTCO_vendor_support snd_timer videobuf2_common processor_thermal_rapl btrfs cfg80211 sha512_ssse3 snd mc intel_lpss_pci mei_me i2c_i801 intel_rapl_common intel_lpss serio_raw mei libarc4 soundcore wmi_bmof i2c_smbus idma64 intel_soc_dts_iosf i2c_hid_acpi i2c_hid int3403_thermal int3400_thermal acpi_thermal_rel acpi_pad int340x_thermal_zone dptf_pch_fivr sch_fq_codel kvmgt mdev kvm parport_pc ppdev lp parport ramoops reed_solomon efi_pstore ip_tables x_tables autofs4 raid10 raid456 libcrc32c async_raid6_recov async_pq raid6_pq async_xor xor <4>[ 76.070725] async_memcpy async_tx raid1 raid0 multipath linear dm_mirror dm_region_hash dm_log joydev hid_generic usbhid hid nvme nvme_core i915 drm_buddy i2c_algo_bit ttm drm_display_helper cec rc_core drm_kms_helper sysimgblt syscopyarea sysfillrect aesni_intel drm crypto_simd cryptd xhci_pci input_leds xhci_pci_renesas vmd video wmi pinctrl_tigerlake mac_hid <4>[ 76.075361] ---[ end trace 0000000000000000 ]--- <4>[ 76.180246] RIP: 0010:__list_del_entry_valid+0x4c/0xa0 <4>[ 76.181041] Code: 39 48 83 c2 22 48 39 d0 74 3e 48 8b 10 48 39 f2 75 44 48 8b 51 08 48 39 f2 75 4c b0 01 c3 48 c7 c7 b1 1f 45 82 e8 c4 c7 a6 ff <0f> 0b 48 c7 c7 62 a9 4d 82 e8 b6 c7 a6 ff 0f 0b 48 c7 c7 fa 60 4f <4>[ 76.181825] RSP: 0018:ffff8881038a7c50 EFLAGS: 00010286 <4>[ 76.182654] RAX: 0000000000000033 RBX: ffff8881038a7c78 RCX: 0000000000000000 <4>[ 76.183439] RDX: ffff889036ba0cf8 RSI: 00000000ffefffff RDI: ffff889036b9d988 <4>[ 76.184229] RBP: 00000000fff00000 R08: 00000000000fffff R09: ffff88907c3fe000 <4>[ 76.185070] R10: 00000000002ffffd R11: 0000000000000004 R12: ffff8881031d18f8 <4>[ 76.185864] R13: 0000000000000000 R14: ffff8881031d1890 R15: ffff88811b4af298 <4>[ 76.186663] FS: 0000000000000000(0000) GS:ffff889036b80000(0000) knlGS:0000000000000000 <4>[ 76.187472] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 76.188326] CR2: 00007f5930738fa0 CR3: 000000010754d001 CR4: 0000000000770ee0 <4>[ 76.189128] PKRU: 55555554 <1>[ 76.189931] Fixing recursive fault but reboot is needed! <3>[ 76.190738] BUG: scheduling while atomic: Xorg:sh0/1834/0x00000000 <4>[ 76.191562] Modules linked in: nvme_fabrics ccm r8153_ecm cdc_ether usbnet r8152 uas usb_storage mii xt_CHECKSUM xt_MASQUERADE xt_conntrack ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc snd_ctl_led snd_soc_skl_hda_dsp snd_soc_hdac_hdmi snd_soc_intel_hda_dsp_common snd_sof_probes snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_soc_dmic snd_sof_pci_intel_tgl snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda soundwire_intel soundwire_generic_allocation soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp snd_sof rtw88_8822ce rtw88_8822c snd_sof_utils snd_hda_ext_core snd_soc_acpi_intel_match rtw88_pci snd_soc_acpi soundwire_bus rtw88_core snd_soc_core snd_compress mac80211 ac97_bus snd_pcm_dmaengine snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core uvcvideo snd_hwdep snd_pcm <4>[ 76.191587] x86_pkg_temp_thermal intel_powerclamp videobuf2_vmalloc snd_seq_midi coretemp videobuf2_memops snd_seq_midi_event nls_iso8859_1 videobuf2_v4l2 snd_rawmidi kvm_intel videodev processor_thermal_device_pci_legacy snd_seq processor_thermal_device hid_multitouch processor_thermal_rfim crct10dif_pclmul iTCO_wdt crc32_pclmul processor_thermal_mbox snd_seq_device ghash_clmulni_intel intel_pmc_bxt mei_hdcp ee1004 intel_rapl_msr iTCO_vendor_support snd_timer videobuf2_common processor_thermal_rapl btrfs cfg80211 sha512_ssse3 snd mc intel_lpss_pci mei_me i2c_i801 intel_rapl_common intel_lpss serio_raw mei libarc4 soundcore wmi_bmof i2c_smbus idma64 intel_soc_dts_iosf i2c_hid_acpi i2c_hid int3403_thermal int3400_thermal acpi_thermal_rel acpi_pad int340x_thermal_zone dptf_pch_fivr sch_fq_codel kvmgt mdev kvm parport_pc ppdev lp parport ramoops reed_solomon efi_pstore ip_tables x_tables autofs4 raid10 raid456 libcrc32c async_raid6_recov async_pq raid6_pq async_xor xor <4>[ 76.196067] async_memcpy async_tx raid1 raid0 multipath linear dm_mirror dm_region_hash dm_log joydev hid_generic usbhid hid nvme nvme_core i915 drm_buddy i2c_algo_bit ttm drm_display_helper cec rc_core drm_kms_helper sysimgblt syscopyarea sysfillrect aesni_intel drm crypto_simd cryptd xhci_pci input_leds xhci_pci_renesas vmd video wmi pinctrl_tigerlake mac_hid <4>[ 76.202755] CPU: 6 PID: 1834 Comm: Xorg:sh0 Tainted: G D W 6.2.1-2023-03-02+ #1 be1c0ea3c87f9b2d4a6dfee589899950dc18f771 <4>[ 76.203774] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.21 03/21/2022 <4>[ 76.204765] Call Trace: <4>[ 76.205768] <TASK> <4>[ 76.206771] __schedule_bug+0x6f/0xd0 <4>[ 76.207775] __schedule+0x533/0x1410 <4>[ 76.208768] ? console_unlock+0x186/0x1d0 <4>[ 76.209755] ? vprintk_emit+0x1af/0x2f0 <4>[ 76.210738] ? _printk+0x46/0x50 <4>[ 76.211714] do_task_dead+0x39/0x40 <4>[ 76.212686] make_task_dead+0xe4/0xf0 <4>[ 76.213655] rewind_stack_and_make_dead+0x17/0x20 <4>[ 76.214632] RIP: 0033:0x7fb640491197 <4>[ 76.215609] Code: Unable to access opcode bytes at 0x7fb64049116d. <4>[ 76.216586] RSP: 002b:00007fb62fffe840 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca <4>[ 76.217578] RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 00007fb640491197 <4>[ 76.218581] RDX: 0000000000000000 RSI: 0000000000000189 RDI: 0000555845204e78 <4>[ 76.219578] RBP: 0000555845204e50 R08: 0000000000000000 R09: 00000000ffffffff <4>[ 76.220571] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 <4>[ 76.221565] R13: 0000000000000000 R14: 0000000000000020 R15: 0000555845204e78 <4>[ 76.222557] </TASK> <7>[ 79.937124] rfkill: input handler enabled -- Ammar Faizi

2 years

[PATCH v2 00/23] drm/msm+PM+icc: Make job_run() reclaim-safe

by Rob Clark

From: Rob Clark <robdclark(a)chromium.org> Inspired by https://lore.kernel.org/dri-devel/20200604081224.863494-10-daniel.vetter@ff… it seemed like a good idea to get rid of memory allocation in job_run() fence signaling path, and use lockdep annotations to yell at us about anything that could deadlock against shrinker/reclaim. Anything that can trigger reclaim, or block on any other thread that has triggered reclaim, can block the GPU shrinker from releasing memory if it is waiting the job to complete, causing deadlock. The first patch pre-allocates the hw_fence, splitting allocation and initialization, to avoid allocation in the job_run() path. The next eight decouple the obj lock from job_run(), as the obj lock is required to pin/unpin backing pages (ie. holding an obj lock in job_run() could deadlock the shrinker by blocking forward progress towards pinned buffers becoming idle). Followed by two so that we could idr_preload() in order to avoid memory allocations under locks indirectly connected to the shrinker path. Next are three paths to decouple initialization (where allocations are needed) from GPU runpm and devfreq, to avoid allocations in the fence signaling path. Followed by various PM devfreq/qos and interconnect locking fixes to decouple initialization (allocation) from runtime. And finally, the last patch is a modified version of danvet's patch to add lockdep annotations to gpu scheduler, but does so conditionally so that drivers can opt-in. v2: Switch from embedding hw_fence in submit/job object to preallocating the hw_fence. Rework "fenced unpin" locking to drop obj lock from fence signaling path (ie. the part that was still WIP in the first iteration of the patchset). Adds the final patch to enable fence signaling annotations now that job_run() and job_free() are safe. The PM devfreq/QoS and interconnect patches are unchanged. Rob Clark (23): drm/msm: Pre-allocate hw_fence drm/msm: Move submit bo flags update from obj lock drm/msm/gem: Tidy up VMA API drm/msm: Decouple vma tracking from obj lock drm/msm/gem: Simplify vmap vs LRU tracking drm/gem: Export drm_gem_lru_move_tail_locked() drm/msm/gem: Move update_lru() drm/msm/gem: Protect pin_count/madv by LRU lock drm/msm/gem: Avoid obj lock in job_run() drm/msm: Switch idr_lock to spinlock drm/msm: Use idr_preload() drm/msm/gpu: Move fw loading out of hw_init() path drm/msm/gpu: Move BO allocation out of hw_init drm/msm/a6xx: Move ioremap out of hw_init path PM / devfreq: Drop unneed locking to appease lockdep PM / devfreq: Teach lockdep about locking order PM / QoS: Fix constraints alloc vs reclaim locking PM / QoS: Decouple request alloc from dev_pm_qos_mtx PM / QoS: Teach lockdep about dev_pm_qos_mtx locking order soc: qcom: smd-rpm: Use GFP_ATOMIC in write path interconnect: Fix locking for runpm vs reclaim interconnect: Teach lockdep about icc_bw_lock order drm/sched: Add (optional) fence signaling annotation drivers/base/power/qos.c | 83 +++++++++--- drivers/devfreq/devfreq.c | 52 ++++---- drivers/gpu/drm/drm_gem.c | 11 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 48 ++++--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 18 ++- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 46 ++++--- drivers/gpu/drm/msm/adreno/adreno_device.c | 6 + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 9 +- drivers/gpu/drm/msm/msm_drv.c | 6 +- drivers/gpu/drm/msm/msm_fence.c | 12 +- drivers/gpu/drm/msm/msm_fence.h | 3 +- drivers/gpu/drm/msm/msm_gem.c | 145 ++++++++++++++------- drivers/gpu/drm/msm/msm_gem.h | 29 +++-- drivers/gpu/drm/msm/msm_gem_submit.c | 27 ++-- drivers/gpu/drm/msm/msm_gem_vma.c | 91 ++++++++++--- drivers/gpu/drm/msm/msm_gpu.h | 8 +- drivers/gpu/drm/msm/msm_ringbuffer.c | 9 +- drivers/gpu/drm/msm/msm_submitqueue.c | 2 +- drivers/gpu/drm/scheduler/sched_main.c | 9 ++ drivers/interconnect/core.c | 18 ++- drivers/soc/qcom/smd-rpm.c | 2 +- include/drm/drm_gem.h | 1 + include/drm/gpu_scheduler.h | 2 + 23 files changed, 416 insertions(+), 221 deletions(-) -- 2.39.2

2 years

[syzbot] [dri?] general protection fault in drm_crtc_next_vblank_start

by syzbot

Hello, syzbot found the following issue on: HEAD commit: a6d9e3034536 Add linux-next specific files for 20230330 git tree: linux-next console+strace: https://syzkaller.appspot.com/x/log.txt?x=1001d1cdc80000 kernel config: https://syzkaller.appspot.com/x/.config?x=aceb117f7924508e dashboard link: https://syzkaller.appspot.com/bug?extid=54280c5aea19802490b5 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13435a2ec80000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=139c9c21c80000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/ec1f900ea929/disk-a6d9e303.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/fabbf89c0d22/vmlinux-a6d9e303.… kernel image: https://storage.googleapis.com/syzbot-assets/1ed05d6192fa/bzImage-a6d9e303.… The issue was bisected to: commit d39e48ca80c0960b039cb38633957f0040f63e1a Author: Rob Clark <robdclark(a)chromium.org> Date: Fri Sep 3 18:47:54 2021 +0000 drm/atomic-helper: Set fence deadline for vblank bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12d260c9c80000 final oops: https://syzkaller.appspot.com/x/report.txt?x=11d260c9c80000 console output: https://syzkaller.appspot.com/x/log.txt?x=16d260c9c80000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+54280c5aea19802490b5(a)syzkaller.appspotmail.com Fixes: d39e48ca80c0 ("drm/atomic-helper: Set fence deadline for vblank") [drm] Initialized udl 0.0.1 20120220 for 1-1:0.0 on minor 2 [drm] Initialized udl on minor 2 udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 udl 1-1:0.0: [drm] Cannot find any crtc or sizes general protection fault, probably for non-canonical address 0xdffffc0000000028: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000140-0x0000000000000147] CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.3.0-rc4-next-20230330-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 Workqueue: usb_hub_wq hub_event RIP: 0010:drm_crtc_next_vblank_start+0xb3/0x2b0 drivers/gpu/drm/drm_vblank.c:1003 Code: e8 01 00 00 48 69 db 38 02 00 00 48 b8 00 00 00 00 00 fc ff df 49 03 9d 38 03 00 00 4c 8d ab 44 01 00 00 4c 89 ea 48 c1 ea 03 <0f> b6 14 02 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 67 RSP: 0018:ffffc900000e6bb0 EFLAGS: 00010207 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000028 RSI: ffffffff849f2afb RDI: ffff888079558338 RBP: ffffc900000e6c48 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000010 R12: ffff8880795590d8 R13: 0000000000000144 R14: ffff8880795590d8 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f17191c7688 CR3: 00000000281af000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> set_fence_deadline drivers/gpu/drm/drm_atomic_helper.c:1531 [inline] drm_atomic_helper_wait_for_fences+0x1b4/0x780 drivers/gpu/drm/drm_atomic_helper.c:1578 drm_atomic_helper_commit drivers/gpu/drm/drm_atomic_helper.c:2007 [inline] drm_atomic_helper_commit+0x1bd/0x370 drivers/gpu/drm/drm_atomic_helper.c:1979 drm_atomic_commit+0x20a/0x300 drivers/gpu/drm/drm_atomic.c:1503 drm_client_modeset_commit_atomic+0x69b/0x7e0 drivers/gpu/drm/drm_client_modeset.c:1045 drm_client_modeset_commit_locked+0x149/0x580 drivers/gpu/drm/drm_client_modeset.c:1148 drm_client_modeset_commit+0x51/0x80 drivers/gpu/drm/drm_client_modeset.c:1174 drm_fb_helper_single_fb_probe drivers/gpu/drm/drm_fb_helper.c:1983 [inline] __drm_fb_helper_initial_config_and_unlock+0x118a/0x1510 drivers/gpu/drm/drm_fb_helper.c:2169 drm_fb_helper_initial_config drivers/gpu/drm/drm_fb_helper.c:2259 [inline] drm_fb_helper_initial_config+0x42/0x60 drivers/gpu/drm/drm_fb_helper.c:2251 drm_fbdev_generic_client_hotplug+0x1ab/0x270 drivers/gpu/drm/drm_fbdev_generic.c:281 drm_fbdev_generic_setup+0x127/0x3b0 drivers/gpu/drm/drm_fbdev_generic.c:343 udl_usb_probe+0x120/0x190 drivers/gpu/drm/udl/udl_drv.c:120 usb_probe_interface+0x30f/0x960 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0x240/0xca0 drivers/base/dd.c:658 __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:795 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:825 __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:953 bus_for_each_drv+0x149/0x1d0 drivers/base/bus.c:457 __device_attach+0x1e4/0x4b0 drivers/base/dd.c:1025 bus_probe_device+0x17c/0x1c0 drivers/base/bus.c:532 device_add+0x11c4/0x1c50 drivers/base/core.c:3616 usb_set_configuration+0x10ee/0x1af0 drivers/usb/core/message.c:2171 usb_generic_driver_probe+0xcf/0x130 drivers/usb/core/generic.c:238 usb_probe_device+0xd8/0x2c0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0x240/0xca0 drivers/base/dd.c:658 __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:795 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:825 __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:953 bus_for_each_drv+0x149/0x1d0 drivers/base/bus.c:457 __device_attach+0x1e4/0x4b0 drivers/base/dd.c:1025 bus_probe_device+0x17c/0x1c0 drivers/base/bus.c:532 device_add+0x11c4/0x1c50 drivers/base/core.c:3616 usb_new_device+0xcb2/0x19d0 drivers/usb/core/hub.c:2575 hub_port_connect drivers/usb/core/hub.c:5407 [inline] hub_port_connect_change drivers/usb/core/hub.c:5551 [inline] port_event drivers/usb/core/hub.c:5711 [inline] hub_event+0x2d9e/0x4e40 drivers/usb/core/hub.c:5793 process_one_work+0x99a/0x15e0 kernel/workqueue.c:2405 worker_thread+0x67d/0x10c0 kernel/workqueue.c:2552 kthread+0x33e/0x440 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:drm_crtc_next_vblank_start+0xb3/0x2b0 drivers/gpu/drm/drm_vblank.c:1003 Code: e8 01 00 00 48 69 db 38 02 00 00 48 b8 00 00 00 00 00 fc ff df 49 03 9d 38 03 00 00 4c 8d ab 44 01 00 00 4c 89 ea 48 c1 ea 03 <0f> b6 14 02 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 67 RSP: 0018:ffffc900000e6bb0 EFLAGS: 00010207 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000028 RSI: ffffffff849f2afb RDI: ffff888079558338 RBP: ffffc900000e6c48 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000010 R12: ffff8880795590d8 R13: 0000000000000144 R14: ffff8880795590d8 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f17191c7688 CR3: 000000002b398000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: e8 01 00 00 48 callq 0x48000006 5: 69 db 38 02 00 00 imul $0x238,%ebx,%ebx b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 12: fc ff df 15: 49 03 9d 38 03 00 00 add 0x338(%r13),%rbx 1c: 4c 8d ab 44 01 00 00 lea 0x144(%rbx),%r13 23: 4c 89 ea mov %r13,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction 2e: 4c 89 e8 mov %r13,%rax 31: 83 e0 07 and $0x7,%eax 34: 83 c0 03 add $0x3,%eax 37: 38 d0 cmp %dl,%al 39: 7c 08 jl 0x43 3b: 84 d2 test %dl,%dl 3d: 0f .byte 0xf 3e: 85 .byte 0x85 3f: 67 addr32 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches

2 years

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig