[drm/ttm] Memory corruption problem when ttm_tt_init() fails.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



I'm doing memory allocation failure injection test using 3.19-rc5 and
it seems to me that there is a memory corruption bug in ttm or vmwgfx code.

---------- Crash pattern 1 start ----------
[   80.751971] [TTM] Failed allocating page table
[   83.000393] BUG: unable to handle kernel NULL pointer dereference at           (null)
[   83.004392] IP: [<ffffffff811b65a9>] __fput+0x39/0x1e0
[   83.006944] PGD 7acd2067 PUD 7b0c7067 PMD 0
[   83.009240] Oops: 0000 [#1] SMP
[   83.010940] Modules linked in: stap_fault_injection(OE) ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 ipt_REJECT nf_reject_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables
ip6table_mangle ip6table_raw ip6table_filter ip6_tables iptable_mangle iptable_raw iptable_filter ip_tables coretemp crct10dif_pclmul crc32_pclmul crc32c_intel dm_mirror ghash_clmulni_intel dm_region_hash aesni_intel dm_log glue_helper dm_mod lrw gf128mul ablk_helper cryptd ppdev
vmw_balloon microcode serio_raw pcspkr parport_pc shpchp parport vmw_vmci i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc uinput sd_mod ata_generic pata_acpi mptspi scsi_transport_spi mptscsih ata_piix e1000 mptbase libata floppy
[   83.038033] CPU: 2 PID: 8795 Comm: sh Tainted: G        W  OE  3.19.0-rc5+ #28
[   83.039666] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013
[   83.042110] task: ffff88007a220000 ti: ffff880052048000 task.ti: ffff880052048000
[   83.043865] RIP: 0010:[<ffffffff811b65a9>]  [<ffffffff811b65a9>] __fput+0x39/0x1e0
[   83.045665] RSP: 0018:ffff88005204bea8  EFLAGS: 00010297
[   83.046895] RAX: 0000000000000000 RBX: ffff88007aff3500 RCX: 0000000000000a0a
[   83.048595] RDX: 000000000002801d RSI: 000000000000000a RDI: ffff88007aff3500
[   83.050254] RBP: ffff88005204bee8 R08: ffff88007cbfd000 R09: 0000000180080006
[   83.051848] R10: 0000000000000000 R11: ffffea0001f2fe00 R12: ffffffff81e6c040
[   83.053515] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   83.055156] FS:  0000000000000000(0000) GS:ffff88007fc80000(0000) knlGS:0000000000000000
[   83.057000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   83.058328] CR2: 0000000000000000 CR3: 000000007b0bc000 CR4: 00000000000407e0
[   83.060004] Stack:
[   83.060482]  ffff88007af0de48 ffff88007af0dc00 ffff88007af0de48 0000000000000000
[   83.062285]  ffffffff81e6c040 ffff88007a220610 ffff88007a220000 0000000000000000
[   83.064115]  ffff88005204bef8 ffffffff811b679e ffff88005204bf28 ffffffff81088f6f
[   83.065956] Call Trace:
[   83.066544]  [<ffffffff811b679e>] ____fput+0xe/0x10
[   83.067738]  [<ffffffff81088f6f>] task_work_run+0xaf/0xf0
[   83.068971]  [<ffffffff81013c5a>] do_notify_resume+0x7a/0x90
[   83.070307]  [<ffffffff816a6d87>] int_signal+0x12/0x17
[   83.071464] Code: 55 41 54 53 48 89 fb 48 83 ec 18 4c 8b 7f 18 4c 8b 77 10 4c 8b 6f 20 e8 06 c7 4e 00 8b 53 44 4c 8b 53 20 89 d0 83 e0 02 83 f8 01 <41> 0f b7 02 45 19 e4 41 83 e4 08 41 83 c4 08 44 89 e1 66 25 00
[   83.077450] RIP  [<ffffffff811b65a9>] __fput+0x39/0x1e0
[   83.078729]  RSP <ffff88005204bea8>
[   83.079522] CR2: 0000000000000000

crash> bt -l
PID: 8795   TASK: ffff88007a220000  CPU: 2   COMMAND: "sh"
 #0 [ffff88005204ba70] machine_kexec at ffffffff8104ef62
    /usr/src/linux/arch/x86/kernel/machine_kexec_64.c: 320
 #1 [ffff88005204bac0] crash_kexec at ffffffff810ed983
    /usr/src/linux/kernel/kexec.c: 1482
 #2 [ffff88005204bb90] oops_end at ffffffff810176e8
    /usr/src/linux/arch/x86/kernel/dumpstack.c: 231
 #3 [ffff88005204bbc0] no_context at ffffffff8169af1f
    /usr/src/linux/arch/x86/mm/fault.c: 724
 #4 [ffff88005204bc20] __bad_area_nosemaphore at ffffffff8169aff6
    /usr/src/linux/arch/x86/mm/fault.c: 804
 #5 [ffff88005204bc70] bad_area at ffffffff8169b31f
    /usr/src/linux/arch/x86/mm/fault.c: 833
 #6 [ffff88005204bca0] __do_page_fault at ffffffff81059b37
    /usr/src/linux/arch/x86/mm/fault.c: 1213
 #7 [ffff88005204bdc0] do_page_fault at ffffffff81059c11
    /usr/src/linux/arch/x86/mm/fault.c: 1295
 #8 [ffff88005204bdf0] page_fault at ffffffff816a8a28
    /usr/src/linux/arch/x86/kernel/entry_64.S: 1283
    [exception RIP: __fput+57]
    RIP: ffffffff811b65a9  RSP: ffff88005204bea8  RFLAGS: 00010297
    RAX: 0000000000000000  RBX: ffff88007aff3500  RCX: 0000000000000a0a
    RDX: 000000000002801d  RSI: 000000000000000a  RDI: ffff88007aff3500
    RBP: ffff88005204bee8   R8: ffff88007cbfd000   R9: 0000000180080006
    R10: 0000000000000000  R11: ffffea0001f2fe00  R12: ffffffff81e6c040
    R13: 0000000000000000  R14: 0000000000000000  R15: 0000000000000000
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #9 [ffff88005204bef0] ____fput at ffffffff811b679e
    /usr/src/linux/fs/file_table.c: 245
#10 [ffff88005204bf00] task_work_run at ffffffff81088f6f
    /usr/src/linux/kernel/task_work.c: 125
#11 [ffff88005204bf30] do_notify_resume at ffffffff81013c5a
    /usr/src/linux/include/linux/tracehook.h: 190
#12 [ffff88005204bf50] int_signal at ffffffff816a6d87
    /usr/src/linux/arch/x86/kernel/entry_64.S: 587
    RIP: 00007f1361d5f420  RSP: 00007fff77be5740  RFLAGS: 00000200
    RAX: 0000000000000000  RBX: 0000000000000000  RCX: 0000000000000000
    RDX: 0000000000000000  RSI: 0000000000000000  RDI: 0000000000000000
    RBP: 0000000000000000   R8: 0000000000000000   R9: 0000000000000000
    R10: 0000000000000000  R11: 0000000000000000  R12: 0000000000000000
    R13: 0000000000000000  R14: 0000000000000000  R15: 0000000000000000
    ORIG_RAX: 000000000000003b  CS: 0033  SS: 002b
WARNING: possibly bogus exception frame
---------- Crash pattern 1 end ----------

---------- Crash pattern 2 start ----------
[  227.647021] [TTM] Failed allocating page table
[  227.875795] BUG: unable to handle kernel NULL pointer dereference at           (null)
[  227.877714] IP: [<ffffffff81594c57>] skb_queue_tail+0x37/0x60
[  227.879107] PGD 78adc067 PUD 78ada067 PMD 0
[  227.880186] Oops: 0002 [#1] SMP
[  227.881017] Modules linked in: stap_fault_injection(OE) ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 ipt_REJECT nf_reject_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables
ip6table_mangle ip6table_raw ip6table_filter ip6_tables iptable_mangle iptable_raw iptable_filter ip_tables coretemp crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel dm_mirror aesni_intel dm_region_hash dm_log glue_helper dm_mod lrw gf128mul ablk_helper cryptd ppdev
vmw_balloon microcode parport_pc serio_raw pcspkr parport vmw_vmci shpchp i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc uinput ata_generic pata_acpi sd_mod ata_piix libata mptspi scsi_transport_spi e1000 mptscsih mptbase floppy
[  227.898988] CPU: 2 PID: 610 Comm: Xorg Tainted: G        W  OE  3.19.0-rc5+ #28
[  227.900691] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013
[  227.903162] task: ffff8800788c6040 ti: ffff8800792d8000 task.ti: ffff8800792d8000
[  227.904884] RIP: 0010:[<ffffffff81594c57>]  [<ffffffff81594c57>] skb_queue_tail+0x37/0x60
[  227.906816] RSP: 0018:ffff8800792dbbc8  EFLAGS: 00010046
[  227.908056] RAX: 0000000000000292 RBX: ffff88007cbc6d10 RCX: 0000000000000000
[  227.909718] RDX: 0000000000000000 RSI: 0000000000000292 RDI: ffff88007cbc6d24
[  227.911376] RBP: ffff8800792dbbe8 R08: 0000000000000292 R09: 0180000002800000
[  227.913027] R10: 0000000700020008 R11: 0000000000000000 R12: ffff88007b65aa00
[  227.914690] R13: ffff88007cbc6d24 R14: 0000000000000000 R15: ffff88007cbc6c80
[  227.916356] FS:  00007f3d07740980(0000) GS:ffff88007fc80000(0000) knlGS:0000000000000000
[  227.918232] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  227.919559] CR2: 0000000000000000 CR3: 0000000078add000 CR4: 00000000000407e0
[  227.921261] Stack:
[  227.921744]  0000000000000078 ffff88007b65aa00 0000000000000078 0000000000000000
[  227.923618]  ffff8800792dbca8 ffffffff816491bd ffff88007cbc6d10 ffff8800792dbd10
[  227.925427]  0000007800000000 ffff8800792dbcc8 0000000000000078 ffff88007cbc6f78
[  227.927271] Call Trace:
[  227.927872]  [<ffffffff816491bd>] unix_stream_sendmsg+0x1dd/0x430
[  227.929301]  [<ffffffff8158c0c3>] sock_aio_write+0x103/0x140
[  227.930638]  [<ffffffff811b42ec>] do_sync_readv_writev+0x4c/0x80
[  227.932047]  [<ffffffff811b5c95>] do_readv_writev+0x1e5/0x280
[  227.933406]  [<ffffffff8101fe4b>] ? __restore_xstate_sig+0x8b/0x680
[  227.934865]  [<ffffffff81104424>] ? __audit_syscall_entry+0xb4/0x110
[  227.936371]  [<ffffffff811b5db9>] vfs_writev+0x39/0x50
[  227.937565]  [<ffffffff811b5eea>] SyS_writev+0x4a/0xd0
[  227.938777]  [<ffffffff816a6d6c>] ? int_check_syscall_exit_work+0x34/0x3d
[  227.940364]  [<ffffffff816a6ae9>] system_call_fastpath+0x12/0x17
[  227.941775] Code: 8d 6f 14 41 54 49 89 f4 53 48 89 fb 4c 89 ef 48 83 ec 08 e8 dc 1a 11 00 48 8b 53 08 49 89 1c 24 4c 89 ef 48 89 c6 49 89 54 24 08 <4c> 89 22 83 43 10 01 4c 89 63 08 e8 09 17 11 00 48 83 c4 08 5b
[  227.947880] RIP  [<ffffffff81594c57>] skb_queue_tail+0x37/0x60
[  227.949297]  RSP <ffff8800792dbbc8>
[  227.950112] CR2: 0000000000000000

crash> bt -l
PID: 610    TASK: ffff8800788c6040  CPU: 2   COMMAND: "Xorg"
 #0 [ffff8800792db790] machine_kexec at ffffffff8104ef62
    /usr/src/linux/arch/x86/kernel/machine_kexec_64.c: 320
 #1 [ffff8800792db7e0] crash_kexec at ffffffff810ed983
    /usr/src/linux/kernel/kexec.c: 1482
 #2 [ffff8800792db8b0] oops_end at ffffffff810176e8
    /usr/src/linux/arch/x86/kernel/dumpstack.c: 231
 #3 [ffff8800792db8e0] no_context at ffffffff8169af1f
    /usr/src/linux/arch/x86/mm/fault.c: 724
 #4 [ffff8800792db940] __bad_area_nosemaphore at ffffffff8169aff6
    /usr/src/linux/arch/x86/mm/fault.c: 804
 #5 [ffff8800792db990] bad_area at ffffffff8169b31f
    /usr/src/linux/arch/x86/mm/fault.c: 833
 #6 [ffff8800792db9c0] __do_page_fault at ffffffff81059b37
    /usr/src/linux/arch/x86/mm/fault.c: 1213
 #7 [ffff8800792dbae0] do_page_fault at ffffffff81059c11
    /usr/src/linux/arch/x86/mm/fault.c: 1295
 #8 [ffff8800792dbb10] page_fault at ffffffff816a8a28
    /usr/src/linux/arch/x86/kernel/entry_64.S: 1283
    [exception RIP: skb_queue_tail+55]
    RIP: ffffffff81594c57  RSP: ffff8800792dbbc8  RFLAGS: 00010046
    RAX: 0000000000000292  RBX: ffff88007cbc6d10  RCX: 0000000000000000
    RDX: 0000000000000000  RSI: 0000000000000292  RDI: ffff88007cbc6d24
    RBP: ffff8800792dbbe8   R8: 0000000000000292   R9: 0180000002800000
    R10: 0000000700020008  R11: 0000000000000000  R12: ffff88007b65aa00
    R13: ffff88007cbc6d24  R14: 0000000000000000  R15: ffff88007cbc6c80
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #9 [ffff8800792dbbf0] unix_stream_sendmsg at ffffffff816491bd
    /usr/src/linux/net/unix/af_unix.c: 1711
#10 [ffff8800792dbcb0] sock_aio_write at ffffffff8158c0c3
    /usr/src/linux/net/socket.c: 955
#11 [ffff8800792dbd90] do_sync_readv_writev at ffffffff811b42ec
    /usr/src/linux/fs/read_write.c: 697
#12 [ffff8800792dbe20] do_readv_writev at ffffffff811b5c95
    /usr/src/linux/fs/read_write.c: 851
#13 [ffff8800792dbf20] vfs_writev at ffffffff811b5db9
    /usr/src/linux/fs/read_write.c: 893
#14 [ffff8800792dbf30] sys_writev at ffffffff811b5eea
    /usr/src/linux/fs/read_write.c: 926
#15 [ffff8800792dbf80] system_call_fastpath at ffffffff816a6ae9
    /usr/src/linux/arch/x86/kernel/entry_64.S: 423
    RIP: 00007f3d056223c0  RSP: 00007ffff316be40  RFLAGS: 00003293
    RAX: ffffffffffffffda  RBX: ffffffff816a6ae9  RCX: ffffffffffffffff
    RDX: 0000000000000001  RSI: 00007ffff316af90  RDI: 0000000000000014
    RBP: 0000000001d59be0   R8: 0000000000000000   R9: 0000000000000004
    R10: 00000000ffffffff  R11: 0000000000003293  R12: 00007f3d077406a0
    R13: 0000000000000001  R14: 00007ffff316af90  R15: 0000000000000000
    ORIG_RAX: 0000000000000014  CS: 0033  SS: 002b
---------- Crash pattern 2 end ----------

---------- Crash pattern 3 start ----------
[   88.675004] [TTM] Failed allocating page table
[   88.678152] BUG: unable to handle kernel paging request at ffff8801531d77c0
[   88.679845] IP: [<ffffffff815964b5>] __alloc_skb+0x165/0x2b0
[   88.681221] PGD 1f2b067 PUD 0
[   88.682000] Oops: 0002 [#1] SMP
[   88.682838] Modules linked in: stap_fault_injection(OE) ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 ipt_REJECT nf_reject_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables
ip6table_mangle ip6table_raw ip6table_filter ip6_tables iptable_mangle iptable_raw iptable_filter ip_tables coretemp crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel dm_mirror dm_region_hash aesni_intel dm_log glue_helper dm_mod lrw gf128mul ablk_helper cryptd ppdev
vmw_balloon microcode serio_raw pcspkr parport_pc shpchp vmw_vmci parport i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc uinput sd_mod ata_generic pata_acpi e1000 ata_piix libata mptspi scsi_transport_spi mptscsih mptbase floppy
[   88.701377] CPU: 0 PID: 3904 Comm: gnome-shell Tainted: G        W  OE  3.19.0-rc5+ #31
[   88.703292] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013
[   88.705840] task: ffff880079e05780 ti: ffff88007918c000 task.ti: ffff88007918c000
[   88.707575] RIP: 0010:[<ffffffff815964b5>]  [<ffffffff815964b5>] __alloc_skb+0x165/0x2b0
[   88.709601] RSP: 0018:ffff88007918faa8  EFLAGS: 00010246
[   88.710884] RAX: 00000000ffffffff RBX: ffff8800531d7700 RCX: 00000000ffffffff
[   88.712584] RDX: ffff8801531d77c0 RSI: 0000000000000000 RDI: ffff8800531d77c8
[   88.714260] RBP: ffff88007918faf8 R08: 00000000ffffffc0 R09: 0000000000000200
[   88.715927] R10: ffffffff8159639e R11: ffff88007f803700 R12: ffff8800531d7800
[   88.717648] R13: 00000000ffffffff R14: ffff88007f803700 R15: 0000000000000100
[   88.719327] FS:  00007fcafd8aaa00(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
[   88.721216] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   88.722548] CR2: ffff8801531d77c0 CR3: 00000000790ae000 CR4: 00000000000407f0
[   88.724257] Stack:
[   88.724761]  ffff88007a2cdf00 000000007a01b800 0000000000000246 00ff88007918fcd8
[   88.726741]  ffff88007918fae8 0000000000000003 0000000000000000 ffff88007918fba8
[   88.728578]  ffff88007a01b800 0000000000000000 ffff88007918fb58 ffffffff81596d5c
[   88.730582] Call Trace:
[   88.731243]  [<ffffffff81596d5c>] alloc_skb_with_frags+0x5c/0x1e0
[   88.732725]  [<ffffffff811c99bc>] ? do_sys_poll+0x12c/0x5b0
[   88.734208]  [<ffffffff815910b6>] sock_alloc_send_pskb+0x196/0x250
[   88.735710]  [<ffffffff8159b887>] ? skb_copy_datagram_from_iter+0xe7/0x200
[   88.737361]  [<ffffffff8164ba07>] ? wait_for_unix_gc+0x27/0xa0
[   88.738784]  [<ffffffff8164928a>] unix_stream_sendmsg+0x2aa/0x430
[   88.740213]  [<ffffffff8158c0c3>] sock_aio_write+0x103/0x140
[   88.741610]  [<ffffffff811c8860>] ? poll_select_copy_remaining+0x130/0x130
[   88.743278]  [<ffffffff811b42ec>] do_sync_readv_writev+0x4c/0x80
[   88.744721]  [<ffffffff811b5c95>] do_readv_writev+0x1e5/0x280
[   88.746109]  [<ffffffff8158bf9d>] ? SYSC_recvfrom+0x13d/0x160
[   88.747452]  [<ffffffff81104424>] ? __audit_syscall_entry+0xb4/0x110
[   88.748992]  [<ffffffff811b5db9>] vfs_writev+0x39/0x50
[   88.750192]  [<ffffffff811b5eea>] SyS_writev+0x4a/0xd0
[   88.751423]  [<ffffffff811046b6>] ? __audit_syscall_exit+0x236/0x2e0
[   88.753121]  [<ffffffff816a6ae9>] system_call_fastpath+0x12/0x17
[   88.754650] Code: b6 83 90 00 00 00 83 e0 f7 09 c8 b9 ff ff ff ff 85 f6 88 83 90 00 00 00 b8 ff ff ff ff 66 89 8b c2 00 00 00 66 89 83 c6 00 00 00 <48> c7 02 00 00 00 00 48 c7 42 08 00 00 00 00 48 c7 42 10 00 00
[   88.761554] RIP  [<ffffffff815964b5>] __alloc_skb+0x165/0x2b0
[   88.763077]  RSP <ffff88007918faa8>
[   88.763978] CR2: ffff8801531d77c0

crash> bt -l
PID: 3904   TASK: ffff880079e05780  CPU: 0   COMMAND: "gnome-shell"
 #0 [ffff88007918f690] machine_kexec at ffffffff8104ef62
    /usr/src/linux/arch/x86/kernel/machine_kexec_64.c: 320
 #1 [ffff88007918f6e0] crash_kexec at ffffffff810ed983
    /usr/src/linux/kernel/kexec.c: 1482
 #2 [ffff88007918f7b0] oops_end at ffffffff810176e8
    /usr/src/linux/arch/x86/kernel/dumpstack.c: 231
 #3 [ffff88007918f7e0] no_context at ffffffff8169af1f
    /usr/src/linux/arch/x86/mm/fault.c: 724
 #4 [ffff88007918f840] __bad_area_nosemaphore at ffffffff8169aff6
    /usr/src/linux/arch/x86/mm/fault.c: 804
 #5 [ffff88007918f890] bad_area_nosemaphore at ffffffff8169b162
    /usr/src/linux/arch/x86/mm/fault.c: 812
 #6 [ffff88007918f8a0] __do_page_fault at ffffffff810596f8
    /usr/src/linux/arch/x86/mm/fault.c: 1277
 #7 [ffff88007918f9c0] do_page_fault at ffffffff81059c11
    /usr/src/linux/arch/x86/mm/fault.c: 1295
 #8 [ffff88007918f9f0] page_fault at ffffffff816a8a28
    /usr/src/linux/arch/x86/kernel/entry_64.S: 1283
    [exception RIP: __alloc_skb+357]
    RIP: ffffffff815964b5  RSP: ffff88007918faa8  RFLAGS: 00010246
    RAX: 00000000ffffffff  RBX: ffff8800531d7700  RCX: 00000000ffffffff
    RDX: ffff8801531d77c0  RSI: 0000000000000000  RDI: ffff8800531d77c8
    RBP: ffff88007918faf8   R8: 00000000ffffffc0   R9: 0000000000000200
    R10: ffffffff8159639e  R11: ffff88007f803700  R12: ffff8800531d7800
    R13: 00000000ffffffff  R14: ffff88007f803700  R15: 0000000000000100
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #9 [ffff88007918fb00] alloc_skb_with_frags at ffffffff81596d5c
    /usr/src/linux/net/core/skbuff.c: 4386
#10 [ffff88007918fb60] sock_alloc_send_pskb at ffffffff815910b6
    /usr/src/linux/net/core/sock.c: 1826
#11 [ffff88007918fbf0] unix_stream_sendmsg at ffffffff8164928a
    /usr/src/linux/net/unix/af_unix.c: 1682
#12 [ffff88007918fcb0] sock_aio_write at ffffffff8158c0c3
    /usr/src/linux/net/socket.c: 955
#13 [ffff88007918fd90] do_sync_readv_writev at ffffffff811b42ec
    /usr/src/linux/fs/read_write.c: 697
#14 [ffff88007918fe20] do_readv_writev at ffffffff811b5c95
    /usr/src/linux/fs/read_write.c: 851
#15 [ffff88007918ff20] vfs_writev at ffffffff811b5db9
    /usr/src/linux/fs/read_write.c: 893
#16 [ffff88007918ff30] sys_writev at ffffffff811b5eea
    /usr/src/linux/fs/read_write.c: 926
#17 [ffff88007918ff80] system_call_fastpath at ffffffff816a6ae9
    /usr/src/linux/arch/x86/kernel/entry_64.S: 423
    RIP: 00007fcaf3c273c0  RSP: 00007fffadd91330  RFLAGS: 00000246
    RAX: ffffffffffffffda  RBX: ffffffff816a6ae9  RCX: 00007fffadd91360
    RDX: 0000000000000002  RSI: 00007fffadd914b0  RDI: 0000000000000006
    RBP: 0000000000b5c230   R8: 0000000000000000   R9: 0000000000000000
    R10: 0000000000000000  R11: 0000000000000293  R12: 00007fffadd91428
    R13: 00007fffadd91424  R14: 0000000000b5c248  R15: 0000000000000001
    ORIG_RAX: 0000000000000014  CS: 0033  SS: 002b
---------- Crash pattern 3 end ----------

---------- Failed memory allocation start ----------
0xffffffff81199850 : __kmalloc+0x0/0x280 [kernel]
    /usr/src/linux/mm/slub.c:3247
0xffffffff814676fa : ttm_tt_init+0x8a/0xb0 [kernel]
    /usr/src/linux/include/linux/slab.h:524
    /usr/src/linux/include/linux/slab.h:535
    /usr/src/linux/include/drm/drm_mem_util.h:38
    /usr/src/linux/drivers/gpu/drm/ttm/ttm_tt.c:53
    /usr/src/linux/drivers/gpu/drm/ttm/ttm_tt.c:200
0xffffffff8147caa6 : vmw_ttm_tt_create+0x76/0xb0 [kernel]
    /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c:700
0xffffffff81467b8d : ttm_bo_add_ttm+0x9d/0xe0 [kernel]
    /usr/src/linux/drivers/gpu/drm/ttm/ttm_bo.c:238
0xffffffff8146a2ff : ttm_bo_validate+0x14f/0x1f0 [kernel]
    /usr/src/linux/drivers/gpu/drm/ttm/ttm_bo.c:1067
0xffffffff8146a5d4 : ttm_bo_init+0x234/0x470 [kernel]
    /usr/src/linux/drivers/gpu/drm/ttm/ttm_bo.c:1167
0xffffffff8147ae9e : vmw_dmabuf_init+0x13e/0x240 [kernel]
    /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c:435
0xffffffff8147b0cb : vmw_user_dmabuf_alloc+0x8b/0x120 [kernel]
    /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c:503
0xffffffff8147b202 : vmw_dmabuf_alloc_ioctl+0x52/0xb0 [kernel]
    /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c:698
0xffffffff814497a4 : drm_ioctl+0x1a4/0x630 [kernel]
    /usr/src/linux/drivers/gpu/drm/drm_ioctl.c:727
0xffffffff814773c9 : vmw_generic_ioctl+0x169/0x260 [kernel]
    /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c:1073
0xffffffff814774f5 : vmw_unlocked_ioctl+0x15/0x20 [kernel]
    /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c:1084
0xffffffff811c7c18 : do_vfs_ioctl+0x2f8/0x510 [kernel]
    /usr/src/linux/fs/ioctl.c:44
    /usr/src/linux/fs/ioctl.c:602
0xffffffff811c7e71 : sys_ioctl+0x41/0x80 [kernel]
    /usr/src/linux/include/linux/file.h:38
    /usr/src/linux/fs/ioctl.c:618
    /usr/src/linux/fs/ioctl.c:608
0xffffffff816a6ae9 : system_call_fastpath+0x12/0x17 [kernel]
    /usr/src/linux/arch/x86/kernel/entry_64.S:423
---------- Failed memory allocation end ----------

If I skip ttm_tt_destroy() call, this bug no longer occurs. Therefore,
I guess that this memory corruption is caused by the destroy function
being called with partially initialized ttm object.

--- a/drivers/gpu/drm/ttm/ttm_tt.c
+++ b/drivers/gpu/drm/ttm/ttm_tt.c
@@ -199,8 +199,8 @@ int ttm_tt_init(struct ttm_tt *ttm, struct ttm_bo_device *bdev,
 
 	ttm_tt_alloc_page_directory(ttm);
 	if (!ttm->pages) {
-		ttm_tt_destroy(ttm);
-		pr_err("Failed allocating page table\n");
+		//ttm_tt_destroy(ttm);
+		pr_err("Failed allocating page table, but skip ttm_tt_destroy()\n");
 		return -ENOMEM;
 	}
 	return 0;
 

I can reproduce this problem at least since 3.13.0. I don't know whether
this problem is specific to vmwgfx code or not, for I tested only CentOS 7
with GUI environment on VMware Player 6.

I think you can reproduce this problem by starting a SystemTap script shown
below and then flipping windows using from Ctrl-Alt-F1 to Ctrl-Alt-F7 .

---------- Reproducer start ----------
# stap -g -e 'global is_target%;
probe begin { printf("Probe start!\n"); }
probe module("ttm").function("ttm_tt_init") { is_target[tid()] = 1; }
probe module("ttm").function("ttm_tt_init").return { is_target[tid()] = 0; }
probe kernel.function("__kmalloc") {
  if (($flags & %{ __GFP_NOFAIL | __GFP_WAIT %} ) == %{ __GFP_WAIT %} && is_target[tid()]) {
    print_backtrace();
    $size = 1 << 30;
    exit();
  }
}
probe end { delete is_target; }'
---------- Reproducer end ----------

I can also reproduce below problem using 3.10.0-123.9.3.el7.x86_64 ,
though below problem might be different from above problem.

---------- Crash pattern 4 start ----------
[TTM] Failed allocating page table
------------[ cut here ]------------
WARNING: at lib/list_debug.c:33 __list_add+0xac/0xc0()
list_add corruption. prev->next should be next (ffff88007af4cd98), but was           (null). (prev=ffff88007ac881f0).
Modules linked in: fuse btrfs zlib_deflate raid6_pq xor vfat msdos fat ext4 mbcache jbd2 netconsole ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter
ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul ppdev glue_helper vmw_balloon ablk_helper cryptd serio_raw parport_pc i2c_piix4 parport
vmw_vmci pcspkr dm_mirror shpchp dm_region_hash dm_log mperf dm_mod nfsd auth_rpcgss nfs_acl lockd sunrpc uinput xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif crct10dif_common ata_generic pata_acpi crc32c_intel vmwgfx mptspi ttm scsi_transport_spi mptscsih ahci ata_piix libahci drm mptbase libata e1000 i2c_core floppy [last unloaded: stap_bad36894e80d53e8ee72ce3ee48a27ac_3394]
CPU: 0 PID: 849 Comm: Xorg Tainted: GF       W  O--------------   3.10.0-123.9.3.el7.x86_64 #1
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013
 ffff88007984da10 00000000da42f7a4 ffff88007984d9c8 ffffffff815e239b
 ffff88007984da00 ffffffff8105dee1 ffff88007ac881f0 ffff88007af4cd98
 ffff88007ac881f0 0000000000000282 ffff88007984db98 ffff88007984da68
Call Trace:
 [<ffffffff815e239b>] dump_stack+0x19/0x1b
 [<ffffffff8105dee1>] warn_slowpath_common+0x61/0x80
 [<ffffffff8105df5c>] warn_slowpath_fmt+0x5c/0x80
 [<ffffffff812cfeec>] __list_add+0xac/0xc0
 [<ffffffffa01a56e9>] vmw_fence_create+0xd9/0x130 [vmwgfx]
 [<ffffffffa0197ef8>] vmw_execbuf_fence_commands+0xc8/0x120 [vmwgfx]
 [<ffffffffa01987b8>] vmw_execbuf_process+0x4f8/0xbe0 [vmwgfx]
 [<ffffffff81194585>] ? __kmalloc+0x55/0x230
 [<ffffffffa0199af8>] do_dmabuf_dirty_sou.isra.9+0x328/0x3c0 [vmwgfx]
 [<ffffffffa00da00c>] ? ttm_read_lock+0x2c/0xd0 [ttm]
 [<ffffffffa00d50a1>] ? ttm_bo_add_to_lru+0x51/0xc0 [ttm]
 [<ffffffffa0199d50>] vmw_framebuffer_dmabuf_dirty+0x1c0/0x1f0 [vmwgfx]
 [<ffffffff81194723>] ? __kmalloc+0x1f3/0x230
 [<ffffffffa012d3f0>] drm_mode_dirtyfb_ioctl+0xe0/0x190 [drm]
 [<ffffffffa011cdb2>] drm_ioctl+0x502/0x630 [drm]
 [<ffffffff815edbb4>] ? __do_page_fault+0x204/0x540
 [<ffffffff812c0e64>] ? timerqueue_del+0x24/0x70
 [<ffffffff81089486>] ? __remove_hrtimer+0x46/0xa0
 [<ffffffffa019ca71>] vmw_unlocked_ioctl+0x51/0x80 [vmwgfx]
 [<ffffffff811c2b25>] do_vfs_ioctl+0x2e5/0x4c0
 [<ffffffff810650d6>] ? do_setitimer+0xe6/0x2a0
 [<ffffffff811c2da1>] SyS_ioctl+0xa1/0xc0
 [<ffffffff815f2a99>] system_call_fastpath+0x16/0x1b
---[ end trace a993c155f4775b96 ]---
------------[ cut here ]------------
WARNING: at lib/list_debug.c:36 __list_add+0x8a/0xc0()
list_add double add: new=ffff88007ac881f0, prev=ffff88007ac881f0, next=ffff88007af4cd98.
Modules linked in: fuse btrfs zlib_deflate raid6_pq xor vfat msdos fat ext4 mbcache jbd2 netconsole ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter
ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul ppdev glue_helper vmw_balloon ablk_helper cryptd serio_raw parport_pc i2c_piix4 parport
vmw_vmci pcspkr dm_mirror shpchp dm_region_hash dm_log mperf dm_mod nfsd auth_rpcgss nfs_acl lockd sunrpc uinput xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif crct10dif_common ata_generic pata_acpi crc32c_intel vmwgfx mptspi ttm scsi_transport_spi mptscsih ahci ata_piix libahci drm mptbase libata e1000 i2c_core floppy [last unloaded: stap_bad36894e80d53e8ee72ce3ee48a27ac_3394]
CPU: 0 PID: 849 Comm: Xorg Tainted: GF       W  O--------------   3.10.0-123.9.3.el7.x86_64 #1
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013
 ffff88007984da10 00000000da42f7a4 ffff88007984d9c8 ffffffff815e239b
 ffff88007984da00 ffffffff8105dee1 ffff88007ac881f0 ffff88007af4cd98
 ffff88007ac881f0 0000000000000282 ffff88007984db98 ffff88007984da68
Call Trace:
 [<ffffffff815e239b>] dump_stack+0x19/0x1b
 [<ffffffff8105dee1>] warn_slowpath_common+0x61/0x80
 [<ffffffff8105df5c>] warn_slowpath_fmt+0x5c/0x80
 [<ffffffff812cfeca>] __list_add+0x8a/0xc0
 [<ffffffffa01a56e9>] vmw_fence_create+0xd9/0x130 [vmwgfx]
 [<ffffffffa0197ef8>] vmw_execbuf_fence_commands+0xc8/0x120 [vmwgfx]
 [<ffffffffa01987b8>] vmw_execbuf_process+0x4f8/0xbe0 [vmwgfx]
 [<ffffffff81194585>] ? __kmalloc+0x55/0x230
 [<ffffffffa0199af8>] do_dmabuf_dirty_sou.isra.9+0x328/0x3c0 [vmwgfx]
 [<ffffffffa00da00c>] ? ttm_read_lock+0x2c/0xd0 [ttm]
 [<ffffffffa00d50a1>] ? ttm_bo_add_to_lru+0x51/0xc0 [ttm]
 [<ffffffffa0199d50>] vmw_framebuffer_dmabuf_dirty+0x1c0/0x1f0 [vmwgfx]
 [<ffffffff81194723>] ? __kmalloc+0x1f3/0x230
 [<ffffffffa012d3f0>] drm_mode_dirtyfb_ioctl+0xe0/0x190 [drm]
 [<ffffffffa011cdb2>] drm_ioctl+0x502/0x630 [drm]
 [<ffffffff815edbb4>] ? __do_page_fault+0x204/0x540
 [<ffffffff812c0e64>] ? timerqueue_del+0x24/0x70
 [<ffffffff81089486>] ? __remove_hrtimer+0x46/0xa0
 [<ffffffffa019ca71>] vmw_unlocked_ioctl+0x51/0x80 [vmwgfx]
 [<ffffffff811c2b25>] do_vfs_ioctl+0x2e5/0x4c0
 [<ffffffff810650d6>] ? do_setitimer+0xe6/0x2a0
 [<ffffffff811c2da1>] SyS_ioctl+0xa1/0xc0
 [<ffffffff815f2a99>] system_call_fastpath+0x16/0x1b
---[ end trace a993c155f4775b97 ]---
INFO: rcu_sched detected stalls on CPUs/tasks: { 0} (detected by 1, t=60019 jiffies, g=6722, c=6721, q=0)
sending NMI to all CPUs:
NMI backtrace for cpu 0
CPU: 0 PID: 849 Comm: Xorg Tainted: GF       W  O--------------   3.10.0-123.9.3.el7.x86_64 #1
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013
task: ffff880077655b00 ti: ffff88007984c000 task.ti: ffff88007984c000
RIP: 0010:[<ffffffff8108ece5>]  [<ffffffff8108ece5>] __wake_up_common+0x5/0x90
RSP: 0018:ffff88007984d9d0  EFLAGS: 00000046
RAX: 0000000000000046 RBX: ffff88007ac88220 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff88007ac88220
RBP: ffff88007984da00 R08: 0000000000000000 R09: ffff88007f617320
R10: ffffea000173f700 R11: ffffffffa01a462d R12: 0000000000000046
R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
FS:  00007faaaca78980(0000) GS:ffff88007f600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faaa4b3c000 CR3: 000000007baaf000 CR4: 00000000000407f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Stack:
 ffffffff81090af9 ffff88007af4cd80 ffff88007ac881e0 ffff88007ac881f0
 ffff88007984da48 ffff88007ac881e0 ffff88007984da88 ffffffffa01a524b
 ffffc90008680018 ffff88007af4cda8 ffff88007af4cdd8 0000000000000292
Call Trace:
 [<ffffffff81090af9>] ? __wake_up+0x39/0x50
 [<ffffffffa01a524b>] vmw_fences_update+0x11b/0x220 [vmwgfx]
 [<ffffffffa01a2568>] vmw_update_seqno+0x48/0x50 [vmwgfx]
 [<ffffffffa01a2073>] vmw_fifo_send_fence+0x93/0xe0 [vmwgfx]
 [<ffffffffa0197e85>] vmw_execbuf_fence_commands+0x55/0x120 [vmwgfx]
 [<ffffffffa01987b8>] vmw_execbuf_process+0x4f8/0xbe0 [vmwgfx]
 [<ffffffffa01998d0>] do_dmabuf_dirty_sou.isra.9+0x100/0x3c0 [vmwgfx]
 [<ffffffffa00da00c>] ? ttm_read_lock+0x2c/0xd0 [ttm]
 [<ffffffffa00d50a1>] ? ttm_bo_add_to_lru+0x51/0xc0 [ttm]
 [<ffffffffa0199d50>] vmw_framebuffer_dmabuf_dirty+0x1c0/0x1f0 [vmwgfx]
 [<ffffffff81194723>] ? __kmalloc+0x1f3/0x230
 [<ffffffffa012d3f0>] drm_mode_dirtyfb_ioctl+0xe0/0x190 [drm]
 [<ffffffffa011cdb2>] drm_ioctl+0x502/0x630 [drm]
 [<ffffffff815edbb4>] ? __do_page_fault+0x204/0x540
 [<ffffffff812c0e64>] ? timerqueue_del+0x24/0x70
 [<ffffffff81089486>] ? __remove_hrtimer+0x46/0xa0
 [<ffffffffa019ca71>] vmw_unlocked_ioctl+0x51/0x80 [vmwgfx]
 [<ffffffff811c2b25>] do_vfs_ioctl+0x2e5/0x4c0
 [<ffffffff810650d6>] ? do_setitimer+0xe6/0x2a0
 [<ffffffff811c2da1>] SyS_ioctl+0xa1/0xc0
 [<ffffffff815f2a99>] system_call_fastpath+0x16/0x1b
Code: 49 0f af c0 e9 64 ff ff ff 0f 1f 44 00 00 44 8d 4a ff 31 c0 45 31 c0 4d 63 c9 e9 4e ff ff ff 0f 1f 80 00 00 00 00 66 66 66 66 90 <55> 48 89 e5 41 57 41 89 f7 41 56 41 89 ce 41 55 41 54 4c 8d 67
---------- Crash pattern 4 end ----------
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/dri-devel





[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux