linux-kernel - Re: [git pull] drm fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150324014119.GA14736@codemonkey.org.uk>
Date:	Mon, 23 Mar 2015 21:41:20 -0400
From:	Dave Jones <davej@...emonkey.org.uk>
To:	Josh Boyer <jwboyer@...oraproject.org>
Cc:	Dave Airlie <airlied@...ux.ie>,
	Damien Lespiau <damien.lespiau@...el.com>,
	Xi Ruoyao <xry111@...look.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	DRI mailing list <dri-devel@...ts.freedesktop.org>,
	"Linux-Kernel@...r. Kernel. Org" <linux-kernel@...r.kernel.org>,
	Intel Graphics Development <intel-gfx@...ts.freedesktop.org>
Subject: Re: [git pull] drm fixes

On Mon, Mar 23, 2015 at 11:33:42AM -0400, Josh Boyer wrote:
 
 > I have a machine that no longer boots in a headless manner with -rc5.
 > It's an Celeron based NUC device.  I blacklisted the i915 driver and
 > it boots fine, then I ran insmod manually and got the backtrace below.
 > This machine only has HDMI output on it.  If I have it connected (even
 > if the monitor is set to display some other input) it will boot fine,
 > but the backtrace is still present.  I'm going to guess the machine
 > "hangs" in headless because X causes some further issues in the
 > headless case.
 > 
 > Linux v4.0-rc4-199-gb314acaccd7e gets this splat in the headless state:
 > 
 > [  +0.000039] WARNING: CPU: 0 PID: 63 at
 > drivers/gpu/drm/i915/i915_gem.c:4525 i915_gem_free_object+0x2e5/0x320
 > [i915]()
 > [  +0.000002] WARN_ON(obj->frontbuffer_bits)
 > 
 > which is what I thought one of these commits was supposed to fix.  I
 > don't see that in -rc5, but then we have these other issues.
 

 > [  +0.000037] WARNING: CPU: 1 PID: 1486 at include/linux/kref.h:47
 > drm_framebuffer_reference+0x7a/0x90 [drm]()
 ..
 > [  +0.000037] WARNING: CPU: 0 PID: 563 at
 > drivers/gpu/drm/drm_atomic.c:482 drm_atomic_check_only+0x33d/0x500
 > [drm]()

I've started seeing this one too as of rc5.
Along with..

 
=============================================================================
BUG kmalloc-192 (Tainted: G        W      ): Poison overwritten
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: 0xffff8804277e5c78-0xffff8804277e5c78. First byte 0x6a instead of 0x6b
INFO: Allocated in ironlake_get_initial_plane_config+0x86/0x390 [i915] age=175 cpu=5 pid=313
	__slab_alloc.constprop.79+0x5a9/0x670
	kmem_cache_alloc_trace+0x21f/0x300
	ironlake_get_initial_plane_config+0x86/0x390 [i915]
	intel_modeset_init+0x9d9/0x1a50 [i915]
	i915_driver_load+0xebf/0x1150 [i915]
	drm_dev_register+0xb5/0x110 [drm]
	drm_get_pci_dev+0x8d/0x200 [drm]
	i915_pci_probe+0x3b/0x60 [i915]
	pci_device_probe+0x8c/0xf0
	driver_probe_device+0x90/0x3e0
	__driver_attach+0xa3/0xb0
	bus_for_each_dev+0x73/0xc0
	driver_attach+0x1e/0x20
	bus_add_driver+0x188/0x260
	driver_register+0x64/0xf0
	__pci_register_driver+0x64/0x70
INFO: Freed in intel_user_framebuffer_destroy+0x65/0xa0 [i915] age=40 cpu=0 pid=128
	__slab_free+0x19e/0x2c0
	kfree+0x2c1/0x310
	intel_user_framebuffer_destroy+0x65/0xa0 [i915]
	drm_framebuffer_free+0x50/0x60 [drm]
	drm_framebuffer_unreference+0x35/0x70 [drm]
	drm_atomic_helper_plane_destroy_state+0x1f/0x30 [drm_kms_helper]
	intel_plane_destroy_state+0xe/0x10 [i915]
	drm_plane_helper_commit+0xb2/0x2e0 [drm_kms_helper]
	drm_plane_helper_update+0x9a/0xf0 [drm_kms_helper]
	__intel_set_mode+0x8b5/0xb70 [i915]
	intel_crtc_set_config+0xc4b/0x1030 [i915]
	drm_mode_set_config_internal+0x69/0x120 [drm]
	restore_fbdev_mode+0xc8/0xf0 [drm_kms_helper]
	drm_fb_helper_restore_fbdev_mode_unlocked+0x29/0x80 [drm_kms_helper]
	drm_fb_helper_set_par+0x22/0x50 [drm_kms_helper]
	intel_fbdev_set_par+0x1a/0x60 [i915]
INFO: Slab 0xffffea00109df900 objects=31 used=31 fp=0x          (null) flags=0x8000000000004080
INFO: Object 0xffff8804277e5c70 @offset=7280 fp=0xffff8804277e6288
Bytes b4 ffff8804277e5c60: 54 7a fb ff 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a  Tz......ZZZZZZZZ
Object ffff8804277e5c70: 6b 6b 6b 6b 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkjkkkkkkk
Object ffff8804277e5c80: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ffff8804277e5c90: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ffff8804277e5ca0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ffff8804277e5cb0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ffff8804277e5cc0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ffff8804277e5cd0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ffff8804277e5ce0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ffff8804277e5cf0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ffff8804277e5d00: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ffff8804277e5d10: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ffff8804277e5d20: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  kkkkkkkkkkkkkkk.
Redzone ffff8804277e5d30: bb bb bb bb bb bb bb bb                          ........
Padding ffff8804277e5e70: 5a 5a 5a 5a 5a 5a 5a 5a                          ZZZZZZZZ
CPU: 4 PID: 128 Comm: kworker/u16:4 Tainted: G    B   W       4.0.0-rc5-backupdebug+ #1
Workqueue: events_unbound async_run_entry_fn
 ffff8804277e5c70 000000002ebc2945 ffff8800b780f578 ffffffff90780cc3
 0000000000000000 ffff88042b804900 ffff8800b780f5b8 ffffffff901e76cc
 0000000000000008 ffff880400000001 ffff8804277e5c79 ffff88042b804900
Call Trace:
 [<ffffffff90780cc3>] dump_stack+0x4c/0x65
 [<ffffffff901e76cc>] print_trailer+0x14c/0x200
 [<ffffffff901e784f>] check_bytes_and_report+0xcf/0x110
 [<ffffffff901e8717>] check_object+0x1d7/0x250
 [<ffffffffc0335cac>] ? intel_plane_duplicate_state+0x2c/0xa0 [i915]
 [<ffffffff901e8c14>] alloc_debug_processing+0xa4/0x1a0
 [<ffffffff901eb5c9>] __slab_alloc.constprop.79+0x5a9/0x670
 [<ffffffffc0335cac>] ? intel_plane_duplicate_state+0x2c/0xa0 [i915]
 [<ffffffffc0335cac>] ? intel_plane_duplicate_state+0x2c/0xa0 [i915]
 [<ffffffff901edc0e>] __kmalloc_track_caller+0x2ee/0x380
 [<ffffffff901b2e40>] kmemdup+0x20/0x50
 [<ffffffffc0335cac>] intel_plane_duplicate_state+0x2c/0xa0 [i915]
 [<ffffffffc0239be8>] drm_atomic_get_plane_state+0x78/0xf0 [drm]
 [<ffffffffc028d428>] drm_atomic_helper_plane_set_property+0x68/0xd0 [drm_kms_helper]
 [<ffffffffc022824d>] drm_mode_plane_set_obj_prop+0x2d/0x90 [drm]
 [<ffffffffc028ee4b>] restore_fbdev_mode+0x6b/0xf0 [drm_kms_helper]
 [<ffffffffc0290f09>] drm_fb_helper_restore_fbdev_mode_unlocked+0x29/0x80 [drm_kms_helper]
 [<ffffffffc0290f82>] drm_fb_helper_set_par+0x22/0x50 [drm_kms_helper]
 [<ffffffffc0290e91>] drm_fb_helper_hotplug_event+0x91/0xe0 [drm_kms_helper]
 [<ffffffffc0290f2c>] drm_fb_helper_restore_fbdev_mode_unlocked+0x4c/0x80 [drm_kms_helper]
 [<ffffffffc0290f82>] drm_fb_helper_set_par+0x22/0x50 [drm_kms_helper]
 [<ffffffffc03313ba>] intel_fbdev_set_par+0x1a/0x60 [i915]
 [<ffffffff9047e488>] fbcon_init+0x588/0x610
 [<ffffffff90500f4c>] visual_init+0xbc/0x120
 [<ffffffff9050376e>] do_bind_con_driver+0x17e/0x3b0
 [<ffffffff90503ef4>] do_take_over_console+0xb4/0x1e0
 [<ffffffff90479283>] do_fbcon_takeover+0x63/0xd0
 [<ffffffff9047efbd>] fbcon_event_notify+0x6cd/0x7d0
 [<ffffffff9009d0e2>] notifier_call_chain+0x62/0x100
 [<ffffffff9009d391>] __blocking_notifier_call_chain+0x51/0x70
 [<ffffffff9009d3c6>] blocking_notifier_call_chain+0x16/0x20
 [<ffffffff90484f1b>] fb_notifier_call_chain+0x1b/0x20
 [<ffffffff90487267>] register_framebuffer+0x207/0x340
 [<ffffffffc0291214>] drm_fb_helper_initial_config+0x264/0x3c0 [drm_kms_helper]
 [<ffffffffc03326db>] intel_fbdev_initial_config+0x1b/0x20 [i915]
 [<ffffffff9009f69a>] async_run_entry_fn+0x4a/0x150
 [<ffffffff90095819>] process_one_work+0x209/0x810
 [<ffffffff90095780>] ? process_one_work+0x170/0x810
 [<ffffffff90095e8b>] worker_thread+0x6b/0x490
 [<ffffffff90095e20>] ? process_one_work+0x810/0x810
 [<ffffffff9009ba79>] kthread+0x119/0x130
 [<ffffffff9009b960>] ? kthread_create_on_node+0x240/0x240
 [<ffffffff90789888>] ret_from_fork+0x58/0x90
 [<ffffffff9009b960>] ? kthread_create_on_node+0x240/0x240
FIX kmalloc-192: Restoring 0xffff8804277e5c78-0xffff8804277e5c78=0x6b
FIX kmalloc-192: Marking all objects used

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/