lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 11 Nov 2016 17:28:22 +0100 From: Jiri Slaby <jslaby@...e.cz> To: Gerd Hoffmann <kraxel@...hat.com>, "Michael S. Tsirkin" <mst@...hat.com> Cc: virtualization@...ts.linux-foundation.org, Linux kernel mailing list <linux-kernel@...r.kernel.org>, David Airlie <airlied@...ux.ie>, dri-devel@...ts.freedesktop.org Subject: Re: BUG: 'list_empty(&vgdev->free_vbufs)' is true! On 11/09/2016, 09:01 AM, Gerd Hoffmann wrote: > On Di, 2016-11-08 at 22:37 +0200, Michael S. Tsirkin wrote: >> On Mon, Nov 07, 2016 at 09:43:24AM +0100, Jiri Slaby wrote: >>> Hi, >>> >>> I can relatively easily reproduce this bug: > > How? Run dmesg -w in the qemu window (virtio_gpu) to see a lot of output. Run pps [1] without exit(0); on e.g. serial console. Wait a bit. The lot of output causes the BUG. [1] https://github.com/jirislaby/collected_sources/blob/master/pps.c >>> BUG: 'list_empty(&vgdev->free_vbufs)' is true! > >> The following might be helpful for debugging - if kernel still will >> not stop panicing, we are looking at some kind >> of memory corruption. > > Looking carefully through the code I think it isn't impossible to > trigger this, but you need for that: > > (1) command queue full (quite possible), > (2) cursor queue full too (unlikely), and > (3) multiple threads trying to submit commands and waiting for free > space in the command queue (possible with virgl enabled). I use -vga virtio with no -display option, so no virtgl, I suppose: [drm] virgl 3d acceleration not available > Do things improve if you allocate some extra bufs? > > int virtio_gpu_alloc_vbufs(struct virtio_gpu_device *vgdev) > { > struct virtio_gpu_vbuffer *vbuf; > - int i, size, count = 0; > + int i, size, count = 16; This seems to help. thanks, -- js suse labs
Powered by blists - more mailing lists