| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 25 Mar 2015 09:56:28 +0100
From: Daniel Vetter <daniel@...ll.ch>
To: Dave Jones <davej@...emonkey.org.uk>,
Josh Boyer <jwboyer@...oraproject.org>,
Dave Airlie <airlied@...ux.ie>,
Damien Lespiau <damien.lespiau@...el.com>,
Xi Ruoyao <xry111@...look.com>,
Linus Torvalds <torvalds@...ux-foundation.org>,
DRI mailing list <dri-devel@...ts.freedesktop.org>,
"Linux-Kernel@...r. Kernel. Org" <linux-kernel@...r.kernel.org>,
Intel Graphics Development <intel-gfx@...ts.freedesktop.org>
Subject: Re: [git pull] drm fixes
On Mon, Mar 23, 2015 at 09:41:20PM -0400, Dave Jones wrote:
> On Mon, Mar 23, 2015 at 11:33:42AM -0400, Josh Boyer wrote:
>
> > I have a machine that no longer boots in a headless manner with -rc5.
> > It's an Celeron based NUC device. I blacklisted the i915 driver and
> > it boots fine, then I ran insmod manually and got the backtrace below.
> > This machine only has HDMI output on it. If I have it connected (even
> > if the monitor is set to display some other input) it will boot fine,
> > but the backtrace is still present. I'm going to guess the machine
> > "hangs" in headless because X causes some further issues in the
> > headless case.
> >
> > Linux v4.0-rc4-199-gb314acaccd7e gets this splat in the headless state:
> >
> > [ +0.000039] WARNING: CPU: 0 PID: 63 at
> > drivers/gpu/drm/i915/i915_gem.c:4525 i915_gem_free_object+0x2e5/0x320
> > [i915]()
> > [ +0.000002] WARN_ON(obj->frontbuffer_bits)
> >
> > which is what I thought one of these commits was supposed to fix. I
> > don't see that in -rc5, but then we have these other issues.
>
>
> > [ +0.000037] WARNING: CPU: 1 PID: 1486 at include/linux/kref.h:47
> > drm_framebuffer_reference+0x7a/0x90 [drm]()
> ..
> > [ +0.000037] WARNING: CPU: 0 PID: 563 at
> > drivers/gpu/drm/drm_atomic.c:482 drm_atomic_check_only+0x33d/0x500
> > [drm]()
>
> I've started seeing this one too as of rc5.
> Along with..
Yeah we're freeing memory too early with these bugs. To get up to the
current debug state can you please cherry-pick
commit f55548b5af87ebfc586ca75748947f1c1b1a4a52
Author: Damien Lespiau <damien.lespiau@...el.com>
Date: Thu Feb 5 18:30:20 2015 +0000
drm/i915: Don't try to reference the fb in get_initial_plane_config()
and
commit fb9981aa675eb7b398849915364916fd98833cfa
Author: Damien Lespiau <damien.lespiau@...el.com>
Date: Thu Feb 5 19:24:25 2015 +0000
drm/i915: Fix atomic state when reusing the firmware fb
from linux-next and then check what's left?
Thanks, Daniel
>
>
> =============================================================================
> BUG kmalloc-192 (Tainted: G W ): Poison overwritten
> -----------------------------------------------------------------------------
> Disabling lock debugging due to kernel taint
> INFO: 0xffff8804277e5c78-0xffff8804277e5c78. First byte 0x6a instead of 0x6b
> INFO: Allocated in ironlake_get_initial_plane_config+0x86/0x390 [i915] age=175 cpu=5 pid=313
> __slab_alloc.constprop.79+0x5a9/0x670
> kmem_cache_alloc_trace+0x21f/0x300
> ironlake_get_initial_plane_config+0x86/0x390 [i915]
> intel_modeset_init+0x9d9/0x1a50 [i915]
> i915_driver_load+0xebf/0x1150 [i915]
> drm_dev_register+0xb5/0x110 [drm]
> drm_get_pci_dev+0x8d/0x200 [drm]
> i915_pci_probe+0x3b/0x60 [i915]
> pci_device_probe+0x8c/0xf0
> driver_probe_device+0x90/0x3e0
> __driver_attach+0xa3/0xb0
> bus_for_each_dev+0x73/0xc0
> driver_attach+0x1e/0x20
> bus_add_driver+0x188/0x260
> driver_register+0x64/0xf0
> __pci_register_driver+0x64/0x70
> INFO: Freed in intel_user_framebuffer_destroy+0x65/0xa0 [i915] age=40 cpu=0 pid=128
> __slab_free+0x19e/0x2c0
> kfree+0x2c1/0x310
> intel_user_framebuffer_destroy+0x65/0xa0 [i915]
> drm_framebuffer_free+0x50/0x60 [drm]
> drm_framebuffer_unreference+0x35/0x70 [drm]
> drm_atomic_helper_plane_destroy_state+0x1f/0x30 [drm_kms_helper]
> intel_plane_destroy_state+0xe/0x10 [i915]
> drm_plane_helper_commit+0xb2/0x2e0 [drm_kms_helper]
> drm_plane_helper_update+0x9a/0xf0 [drm_kms_helper]
> __intel_set_mode+0x8b5/0xb70 [i915]
> intel_crtc_set_config+0xc4b/0x1030 [i915]
> drm_mode_set_config_internal+0x69/0x120 [drm]
> restore_fbdev_mode+0xc8/0xf0 [drm_kms_helper]
> drm_fb_helper_restore_fbdev_mode_unlocked+0x29/0x80 [drm_kms_helper]
> drm_fb_helper_set_par+0x22/0x50 [drm_kms_helper]
> intel_fbdev_set_par+0x1a/0x60 [i915]
> INFO: Slab 0xffffea00109df900 objects=31 used=31 fp=0x (null) flags=0x8000000000004080
> INFO: Object 0xffff8804277e5c70 @offset=7280 fp=0xffff8804277e6288
> Bytes b4 ffff8804277e5c60: 54 7a fb ff 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a Tz......ZZZZZZZZ
> Object ffff8804277e5c70: 6b 6b 6b 6b 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b kkkkkkkkjkkkkkkk
> Object ffff8804277e5c80: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Object ffff8804277e5c90: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Object ffff8804277e5ca0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Object ffff8804277e5cb0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Object ffff8804277e5cc0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Object ffff8804277e5cd0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Object ffff8804277e5ce0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Object ffff8804277e5cf0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Object ffff8804277e5d00: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Object ffff8804277e5d10: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> Object ffff8804277e5d20: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk.
> Redzone ffff8804277e5d30: bb bb bb bb bb bb bb bb ........
> Padding ffff8804277e5e70: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
> CPU: 4 PID: 128 Comm: kworker/u16:4 Tainted: G B W 4.0.0-rc5-backupdebug+ #1
> Workqueue: events_unbound async_run_entry_fn
> ffff8804277e5c70 000000002ebc2945 ffff8800b780f578 ffffffff90780cc3
> 0000000000000000 ffff88042b804900 ffff8800b780f5b8 ffffffff901e76cc
> 0000000000000008 ffff880400000001 ffff8804277e5c79 ffff88042b804900
> Call Trace:
> [<ffffffff90780cc3>] dump_stack+0x4c/0x65
> [<ffffffff901e76cc>] print_trailer+0x14c/0x200
> [<ffffffff901e784f>] check_bytes_and_report+0xcf/0x110
> [<ffffffff901e8717>] check_object+0x1d7/0x250
> [<ffffffffc0335cac>] ? intel_plane_duplicate_state+0x2c/0xa0 [i915]
> [<ffffffff901e8c14>] alloc_debug_processing+0xa4/0x1a0
> [<ffffffff901eb5c9>] __slab_alloc.constprop.79+0x5a9/0x670
> [<ffffffffc0335cac>] ? intel_plane_duplicate_state+0x2c/0xa0 [i915]
> [<ffffffffc0335cac>] ? intel_plane_duplicate_state+0x2c/0xa0 [i915]
> [<ffffffff901edc0e>] __kmalloc_track_caller+0x2ee/0x380
> [<ffffffff901b2e40>] kmemdup+0x20/0x50
> [<ffffffffc0335cac>] intel_plane_duplicate_state+0x2c/0xa0 [i915]
> [<ffffffffc0239be8>] drm_atomic_get_plane_state+0x78/0xf0 [drm]
> [<ffffffffc028d428>] drm_atomic_helper_plane_set_property+0x68/0xd0 [drm_kms_helper]
> [<ffffffffc022824d>] drm_mode_plane_set_obj_prop+0x2d/0x90 [drm]
> [<ffffffffc028ee4b>] restore_fbdev_mode+0x6b/0xf0 [drm_kms_helper]
> [<ffffffffc0290f09>] drm_fb_helper_restore_fbdev_mode_unlocked+0x29/0x80 [drm_kms_helper]
> [<ffffffffc0290f82>] drm_fb_helper_set_par+0x22/0x50 [drm_kms_helper]
> [<ffffffffc0290e91>] drm_fb_helper_hotplug_event+0x91/0xe0 [drm_kms_helper]
> [<ffffffffc0290f2c>] drm_fb_helper_restore_fbdev_mode_unlocked+0x4c/0x80 [drm_kms_helper]
> [<ffffffffc0290f82>] drm_fb_helper_set_par+0x22/0x50 [drm_kms_helper]
> [<ffffffffc03313ba>] intel_fbdev_set_par+0x1a/0x60 [i915]
> [<ffffffff9047e488>] fbcon_init+0x588/0x610
> [<ffffffff90500f4c>] visual_init+0xbc/0x120
> [<ffffffff9050376e>] do_bind_con_driver+0x17e/0x3b0
> [<ffffffff90503ef4>] do_take_over_console+0xb4/0x1e0
> [<ffffffff90479283>] do_fbcon_takeover+0x63/0xd0
> [<ffffffff9047efbd>] fbcon_event_notify+0x6cd/0x7d0
> [<ffffffff9009d0e2>] notifier_call_chain+0x62/0x100
> [<ffffffff9009d391>] __blocking_notifier_call_chain+0x51/0x70
> [<ffffffff9009d3c6>] blocking_notifier_call_chain+0x16/0x20
> [<ffffffff90484f1b>] fb_notifier_call_chain+0x1b/0x20
> [<ffffffff90487267>] register_framebuffer+0x207/0x340
> [<ffffffffc0291214>] drm_fb_helper_initial_config+0x264/0x3c0 [drm_kms_helper]
> [<ffffffffc03326db>] intel_fbdev_initial_config+0x1b/0x20 [i915]
> [<ffffffff9009f69a>] async_run_entry_fn+0x4a/0x150
> [<ffffffff90095819>] process_one_work+0x209/0x810
> [<ffffffff90095780>] ? process_one_work+0x170/0x810
> [<ffffffff90095e8b>] worker_thread+0x6b/0x490
> [<ffffffff90095e20>] ? process_one_work+0x810/0x810
> [<ffffffff9009ba79>] kthread+0x119/0x130
> [<ffffffff9009b960>] ? kthread_create_on_node+0x240/0x240
> [<ffffffff90789888>] ret_from_fork+0x58/0x90
> [<ffffffff9009b960>] ? kthread_create_on_node+0x240/0x240
> FIX kmalloc-192: Restoring 0xffff8804277e5c78-0xffff8804277e5c78=0x6b
> FIX kmalloc-192: Marking all objects used
>
> _______________________________________________
> dri-devel mailing list
> dri-devel@...ts.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists