linux-kernel - Re: System freeze on shutdown - bisected to commit 29d08b3efddc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <AANLkTikocY=xaNWHTV5YbRCj1Y2Nn7GH=i0HksjKnyZS@mail.gmail.com>
Date:	Wed, 6 Oct 2010 23:46:24 -0400
From:	Marc Dionne <marc.c.dionne@...il.com>
To:	skeggsb@...il.com
Cc:	Dave Airlie <airlied@...hat.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: System freeze on shutdown - bisected to commit 29d08b3efddc

On Wed, Oct 6, 2010 at 11:38 PM, Ben Skeggs <skeggsb@...il.com> wrote:
> v       gOn Wed, 2010-10-06 at 23:29 -0400, Marc Dionne wrote:
>> On Tue, Oct 5, 2010 at 8:21 PM, Dave Airlie <airlied@...hat.com> wrote:
>> > On Tue, 2010-10-05 at 18:24 -0400, Marc Dionne wrote:
>> >> Hi,
>> >>
>> >> My system has been crashing these past few days when issuing "reboot"
>> >> or hitting the Shut Down button in gnome.  I get a series of stack
>> >> traces scrolling on the console before things freeze up completely.
>> >> The traces that I do see at the end point to kmem_cache_alloc called
>> >> from get_empty_filp, but there are typically various other traces
>> >> above it.
>> >
>> > cc'ing Ben.
>> >
>> > Dave.
>>
>> Some more testing shows that what causes the crash is when
>> drm_gem_object_unreference_unlocked gets called in
>> nouveau_notifier_takedown_channel.  The refcount on the object is
>> always 1 at that point - on entry to nouveau_notifier_takedown I see a
>> handle_count of 0 and a refcount of 1 in most cases, and sometimes a
>> handle_count of 1 and a refcount of 2.  Either way the call to
>> drm_gem_object_unreference_unlocked will bring the refcount to 0.
>> Not sure if that's normal at that point.
>>
>> Commenting out that particular call to
>> drm_gem_object_unreference_unlocked gets rid of the crash.
> How about if you remove the drm_get_object_handle_unreference_unlocked()
> call from that function instead?
>
> Ben.

I had tested that earlier and just retested it now, and yes it also
cures the crash.

Marc
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/