Hello Raj,
On Mon, Jan 21, 2019 at 02:41:03PM +0900, Tomasz Figa wrote:
> On Wed, Jan 16, 2019 at 11:16 AM Mani, Rajmohan <rajmohan.mani@xxxxxxxxx> wrote:
> >> Subject: Re: [PATCH v7 00/16] Intel IPU3 ImgU patchset
> >> On Saturday, 12 January 2019 04:30:49 EET Mani, Rajmohan wrote:
> >>
> >> [snip]
> >>
> >>> I finally managed to reproduce the issue with 4.20-rc6, with KASAN
> >>> enabled and with CONFIG_SLUB_DEBUG_ON with SLAB_STORE_USER.
> >>
> >> Nice ! Thank you for your work.
> >>
> >>> The following line indicates the crash happens when yavta PID 10289
> >>> tries to free the memory.
> >>>
> >>> [ 452.437844] BUG: KASAN: use-after-free in
> >>> ipu3_dmamap_free+0x50/0x9c [ipu3_imgu] [ 452.446123] Read of size 8
> >>> at addr ffff8881503481a0 by task yavta/10289
> >>>
> >>> The above looks to be normal, since it's the same task that allocated
> >>> this memory.
> >>> [ 452.685731] Allocated by task 10289:
> >>>
> >>> Before the above happened, yavta/10187 came in and freed this memory
> >>> per KASAN.
> >>> [ 452.787656] Freed by task 10187:
> >>>
> >>> Is this (one instance of yavta freeing the memory allocated by another
> >>> instance of yavta) expected? Or does it indicate that mmap giving the
> >>> same address across these 2 instances of yavta? I need to debug /
> >>> confirm the latter case.
> >>
> >> KASAN prints the task name (and process ID) to help you debugging the
> >> problem, but this doesn't mean that yavta is freeing the memory. yavta
> >> exercises the V4L2 API exposed by the driver, and internally, down the
> >> call stack, ipu3_dmamap_free() is called by the driver. According to the
> >> backtraces you posted, this is in response to a VIDIOC_STREAMOFF call
> >> from yavta. I would expect VIDIOC_STREAMOFF to free DMA mappings created
> >> for the buffers on the corresponding video nodes, and thus allocated by
> >> the same task.
> >
> > Ack.
> >
> >> The fact
> >> that memory is allocated in one task and freed in another seems weird to me
> >> in this case.
> >>
> >
> > I have instrumented the code around ipu3 dma map code, with a change to skip
> > dma free operations, if the current->pid is not the same as the pid that originally
> > did the dma alloc.
> >
> > There are no crashes in this case, as expected.
> >
> > I also confirmed that STREAM_ON/OFF is the one that results in this crash.
> > I need to spend more time on the alloc / free operations done by the yavta
> > Instances to see where the problem could be.
> >
> > This below line doesn't make sense, as the free call for pid 12986 occurs first,
> > before the alloc calls. Yavta application logs indicate the dma alloc has been
> > done for pid 12986, although I don't see corresponding dma alloc calls from pid 12986.
>
> I wonder if that doesn't mean that for some reason some V4L2 ioctls
> done from a context other than the owner (the one that first allocated
> vb2 buffers) end up triggering some buffer freeing/re-allocation. For
> VB2 buffers that's normally prevented by the core, but possibly we do
> some internal buffer management in non-buffer related V4L2 ioctls in
> the driver?
I had a quick look at the driver, and found the following code in the
VIDIOC_STREAMOFF handler ipu3_vb2_stop_streaming():
/* Was this the first node with streaming disabled? */
if (imgu->streaming && ipu3_all_nodes_streaming(imgu, node)) {
/* Yes, really stop streaming now */
dev_dbg(dev, "IMGU streaming is ready to stop");
r = imgu_s_stream(imgu, false);
if (!r)
imgu->streaming = false;
}
The queue is initialized in ipu3_v4l2_node_setup() with
vbq->lock = &node->lock;
which means that concurrent VIDIOC_STREAMOFF operations on different
nodes can race each other. Could you enable dynamic debugging to get the
"IMGU streaming is ready to stop" message printed to the kernel log, and
see if this could explain the double-free problem ?
In any case this race condition should be handled by proper locking.
Both the imgu->streaming and the ipu3_all_nodes_streaming() tests are
very racy, and can lead to many different problems (failure at
processing start also comes to mind).
> >
> > [ 1604.194264] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> >
> >
> > [ 1603.804102] ipu3_dmamap_alloc: allocated 4096 @ IOVA 0x00000000e530d000 @ VA 00000000a90fcad9 pid: 13281 comm: yavta
> > [ 1603.816015] ipu3_dmamap_alloc: allocated 4096 @ IOVA 0x00000000e530c000 @ VA 00000000a2315b8c pid: 13281 comm: yavta
> > [ 1603.827932] ipu3_dmamap_alloc: allocated 4096 @ IOVA 0x00000000e530b000 @ VA 0000000068fcc232 pid: 13281 comm: yavta
> > [ 1603.839818] ipu3_dmamap_alloc: allocated 4096 @ IOVA 0x00000000e530a000 @ VA 00000000bd8c0fc7 pid: 13281 comm: yavta
> > [ 1603.851904] ipu3_dmamap_alloc: allocated 286720 @ IOVA 0x00000000e52c4000 @ VA 00000000b19ebc35 pid: 13281 comm: yavta
> > [ 1603.864093] ipu3_dmamap_alloc: allocated 286720 @ IOVA 0x00000000e527e000 @ VA 00000000d890dde9 pid: 13281 comm: yavta
> > [ 1603.876335] ipu3_dmamap_alloc: allocated 286720 @ IOVA 0x00000000e5238000 @ VA 0000000032cb057a pid: 13281 comm: yavta
> > [ 1603.888533] ipu3_dmamap_alloc: allocated 286720 @ IOVA 0x00000000e51f2000 @ VA 000000004fdbe7b7 pid: 13281 comm: yavta
> > [ 1603.900747] ipu3_dmamap_alloc: allocated 233472 @ IOVA 0x00000000e51b9000 @ VA 000000001f7481bb pid: 13281 comm: yavta
> > [ 1603.912924] ipu3_dmamap_alloc: allocated 233472 @ IOVA 0x00000000e5180000 @ VA 000000005488930b pid: 13281 comm: yavta
> > [ 1603.925079] ipu3_dmamap_alloc: allocated 233472 @ IOVA 0x00000000e5147000 @ VA 00000000a1ef0f70 pid: 13281 comm: yavta
> > [ 1603.937276] ipu3_dmamap_alloc: allocated 233472 @ IOVA 0x00000000e510e000 @ VA 000000008f127f52 pid: 13281 comm: yavta
> > [ 1603.949461] ipu3_dmamap_alloc: allocated 303104 @ IOVA 0x00000000e50c4000 @ VA 000000002f4ec9a5 pid: 13281 comm: yavta
> > [ 1603.961689] ipu3_dmamap_alloc: allocated 303104 @ IOVA 0x00000000e507a000 @ VA 0000000003233f40 pid: 13281 comm: yavta
> > [ 1603.973868] ipu3_dmamap_alloc: allocated 303104 @ IOVA 0x00000000e5030000 @ VA 0000000069e1621c pid: 13281 comm: yavta
> > [ 1603.986152] ipu3_dmamap_alloc: allocated 303104 @ IOVA 0x00000000e4fe6000 @ VA 00000000b39f1cf0 pid: 13281 comm: yavta
> > [ 1603.998265] ipu3_dmamap_alloc: allocated 4096 @ IOVA 0x00000000e4fe5000 @ VA 000000002bd48bfe pid: 13281 comm: yavta
> > [ 1604.010163] ipu3_dmamap_alloc: allocated 4096 @ IOVA 0x00000000e4fe4000 @ VA 00000000261436cd pid: 13281 comm: yavta
> > [ 1604.022056] ipu3_dmamap_alloc: allocated 4096 @ IOVA 0x00000000e4fe3000 @ VA 00000000375b1a2a pid: 13281 comm: yavta
> > [ 1604.033989] ipu3_dmamap_alloc: allocated 4096 @ IOVA 0x00000000e4fe2000 @ VA 00000000a10eb873 pid: 13281 comm: yavta
> > [ 1604.045873] ipu3_dmamap_alloc: allocated 4096 @ IOVA 0x00000000e4fe1000 @ VA 00000000377717e8 pid: 13281 comm: yavta
> > [ 1604.057767] ipu3_dmamap_alloc: allocated 4096 @ IOVA 0x00000000e4fe0000 @ VA 000000004274cd53 pid: 13281 comm: yavta
> > [ 1604.069648] ipu3_dmamap_alloc: allocated 4096 @ IOVA 0x00000000e4fdf000 @ VA 000000008442a829 pid: 13281 comm: yavta
> > [ 1604.081537] ipu3_dmamap_alloc: allocated 4096 @ IOVA 0x00000000e4fde000 @ VA 000000007bd91d8f pid: 13281 comm: yavta
> > [ 1604.093973] ipu3-imgu 0000:00:05.0: dma buf resized from 3112960 to 7372800
> > [ 1604.101777] SKIPPING ipu3_dmamap_free map pid: 1453 this pid 13281...
> > [ 1604.112144] ipu3_dmamap_alloc: allocated 7372800 @ IOVA 0x00000000e48d6000 @ VA 000000008f3f13db pid: 13281 comm: yavta
> > [ 1604.187741] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.189093] ipu3_dmamap_free: freeing 4096 @ IOVA 0x00000000e530d000 @ VA 00000000a90fcad9 pid: 13281 comm: yavta
> > [ 1604.194264] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194267] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194268] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194270] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194271] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194273] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194275] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194277] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194279] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194280] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194282] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194283] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194285] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194286] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194288] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194289] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194291] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194293] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194294] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194296] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194645] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194647] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194649] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194650] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194652] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194654] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194655] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194657] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 12986...
> > [ 1604.194659] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194661] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194663] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194665] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194667] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194669] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194671] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194672] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194674] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194676] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194678] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194680] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194681] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194683] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194685] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194686] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194688] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194690] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194691] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194693] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194695] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194696] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194698] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194700] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194702] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194703] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194705] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.194707] SKIPPING ipu3_dmamap_free map pid: 0 this pid 12986...
> > [ 1604.195044] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195046] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195048] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195049] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195051] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195053] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195054] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195056] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195058] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195060] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195062] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195063] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195065] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195066] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195067] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195069] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195070] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1604.195071] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1604.195072] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1604.195073] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1604.195075] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195077] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195078] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.195086] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.196725] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196727] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196728] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196730] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196731] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196732] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196733] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196734] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196735] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196736] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196738] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196739] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196740] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196741] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196742] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196744] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196745] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196746] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196747] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196748] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196749] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196751] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196752] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196753] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196754] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196755] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196756] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13182...
> > [ 1604.196757] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196759] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196760] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196761] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196762] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196763] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196764] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196765] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196767] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196768] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196769] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196770] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196771] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196772] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196773] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196775] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196776] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196777] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196778] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196779] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196780] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196781] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196782] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196784] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196785] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196786] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196787] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.196788] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13182...
> > [ 1604.206728] ipu3_dmamap_free: freeing 4096 @ IOVA 0x00000000e530c000 @ VA 00000000a2315b8c pid: 13281 comm: yavta
> > [ 1604.217497] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.221514] ipu3_dmamap_free: freeing 4096 @ IOVA 0x00000000e530b000 @ VA 0000000068fcc232 pid: 13281 comm: yavta
> > [ 1604.230381] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.236134] ipu3_dmamap_free: freeing 4096 @ IOVA 0x00000000e530a000 @ VA 00000000bd8c0fc7 pid: 13281 comm: yavta
> > [ 1604.236171] ipu3_dmamap_free: freeing 286720 @ IOVA 0x00000000e52c4000 @ VA 00000000b19ebc35 pid: 13281 comm: yavta
> > [ 1604.236253] ipu3_dmamap_free: freeing 286720 @ IOVA 0x00000000e527e000 @ VA 00000000d890dde9 pid: 13281 comm: yavta
> > [ 1604.236336] ipu3_dmamap_free: freeing 286720 @ IOVA 0x00000000e5238000 @ VA 0000000032cb057a pid: 13281 comm: yavta
> > [ 1604.236421] ipu3_dmamap_free: freeing 286720 @ IOVA 0x00000000e51f2000 @ VA 000000004fdbe7b7 pid: 13281 comm: yavta
> > [ 1604.244291] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.251102] ipu3_dmamap_free: freeing 233472 @ IOVA 0x00000000e51b9000 @ VA 000000001f7481bb pid: 13281 comm: yavta
> > [ 1604.251190] ipu3_dmamap_free: freeing 233472 @ IOVA 0x00000000e5180000 @ VA 000000005488930b pid: 13281 comm: yavta
> > [ 1604.251279] ipu3_dmamap_free: freeing 233472 @ IOVA 0x00000000e5147000 @ VA 00000000a1ef0f70 pid: 13281 comm: yavta
> > [ 1604.251354] ipu3_dmamap_free: freeing 233472 @ IOVA 0x00000000e510e000 @ VA 000000008f127f52 pid: 13281 comm: yavta
> > [ 1604.251430] ipu3_dmamap_free: freeing 303104 @ IOVA 0x00000000e50c4000 @ VA 000000002f4ec9a5 pid: 13281 comm: yavta
> > [ 1604.251529] ipu3_dmamap_free: freeing 303104 @ IOVA 0x00000000e507a000 @ VA 0000000003233f40 pid: 13281 comm: yavta
> > [ 1604.251623] ipu3_dmamap_free: freeing 303104 @ IOVA 0x00000000e5030000 @ VA 0000000069e1621c pid: 13281 comm: yavta
> > [ 1604.251716] ipu3_dmamap_free: freeing 303104 @ IOVA 0x00000000e4fe6000 @ VA 00000000b39f1cf0 pid: 13281 comm: yavta
> > [ 1604.251821] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.259683] SKIPPING ipu3_dmamap_free map pid: 13281 this pid 13084...
> > [ 1604.266371] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266374] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266376] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266381] ipu3_dmamap_free: freeing 4096 @ IOVA 0x00000000e4fe5000 @ VA 000000002bd48bfe pid: 13281 comm: yavta
> > [ 1604.266438] ipu3_dmamap_free: freeing 4096 @ IOVA 0x00000000e4fe4000 @ VA 00000000261436cd pid: 13281 comm: yavta
> > [ 1604.266477] ipu3_dmamap_free: freeing 4096 @ IOVA 0x00000000e4fe3000 @ VA 00000000375b1a2a pid: 13281 comm: yavta
> > [ 1604.266514] ipu3_dmamap_free: freeing 4096 @ IOVA 0x00000000e4fe2000 @ VA 00000000a10eb873 pid: 13281 comm: yavta
> > [ 1604.266550] ipu3_dmamap_free: freeing 4096 @ IOVA 0x00000000e4fe1000 @ VA 00000000377717e8 pid: 13281 comm: yavta
> > [ 1604.266586] ipu3_dmamap_free: freeing 4096 @ IOVA 0x00000000e4fe0000 @ VA 000000004274cd53 pid: 13281 comm: yavta
> > [ 1604.266623] ipu3_dmamap_free: freeing 4096 @ IOVA 0x00000000e4fdf000 @ VA 000000008442a829 pid: 13281 comm: yavta
> > [ 1604.266659] ipu3_dmamap_free: freeing 4096 @ IOVA 0x00000000e4fde000 @ VA 000000007bd91d8f pid: 13281 comm: yavta
> > [ 1604.266694] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266695] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266697] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266699] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266701] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266702] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266704] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266706] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266707] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266709] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266711] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266712] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266714] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266716] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266717] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266719] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266721] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266722] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266724] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266726] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266728] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266729] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266731] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266733] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266735] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266736] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266738] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.266740] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13281...
> > [ 1604.296912] ipu3-imgu 0000:00:05.0: wait cio gate idle timeout
> > [ 1604.298946] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1604.366931] ipu3-imgu 0000:00:05.0: wait cio gate idle timeout
> > [ 1604.371182] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.722685] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.729641] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.737607] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.744549] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.751506] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.758465] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.765394] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.772447] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.779387] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.787021] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.801912] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.808976] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.816089] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.823311] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.830260] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.837218] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.844203] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.851192] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.858148] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.865073] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.872038] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.878971] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.885905] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.892876] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.899815] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1605.906829] SKIPPING ipu3_dmamap_free map pid: 0 this pid 13084...
> > [ 1606.013925] ipu3-imgu 0000:00:05.0: wait cio gate idle timeout
> >
> >
> >> My guess is that when using multiple instances of yavta the calls to
> >> VIDIOC_STREAMOFF on the different video nodes are asynchronous and
> >> happen in a way that the driver does not expect. Regardless of how the API is
> >> exercised by applications, in a good or bad way, the IPU3 driver must not
> >> crash. It needs to be prepared for all V4L2 ioctls to be called at any time, and
> >> an application could call VIDIOC_STREAMOFF on any video node while the
> >> IPU3 is busy processing images.
> >>
> >>> With the help of local application that operates these pipes in a
> >>> serial fashion, I do not see this issue.
> >>
> >> [snip]
--
Regards,
Laurent Pinchart
