Message-ID: <b919b550-6da8-f9f0-a0eb-0fd8af513817@amd.com>
Date:   Wed, 8 Mar 2023 07:17:38 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.7.1
Subject: Re: [BUG 6.3-rc1] Bad lock in ttm_bo_delayed_delete()
Content-Language: en-US
To:     Steven Rostedt <rostedt@goodmis.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Linus Torvalds <torvalds@linux-foundation.org>
Cc:     linux-media@vger.kernel.org, intel-gfx@lists.freedesktop.org,
        dri-devel@lists.freedesktop.org, amd-gfx@lists.freedesktop.org,
        Felix Kuehling <Felix.Kuehling@amd.com>,
        Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
References: <20230307212223.7e49384a@gandalf.local.home>
 <20230307212615.7a099103@gandalf.local.home>
From:   =?UTF-8?Q?Christian_K=c3=b6nig?= <christian.koenig@amd.com>
In-Reply-To: <20230307212615.7a099103@gandalf.local.home>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?TkU0NmNjRFdTYnFFN0hJUlViYjQ5N3NmUkRTQ0N3N3ZicDN3M3M2c0s4aVJX?=
 =?utf-8?B?SEZWZjYyekh1MTlPRXNnZ01xejVVZUJpaEptMHk4Z2pzQUIzbmRLbEQ3VGhM?=
 =?utf-8?B?RFZXSnpkOUhaWDRrb1J4ZFNmT1U3eVE2T0tweHg3M0VaQmcyQW5LM0lCS0c2?=
 =?utf-8?B?QjF5dnZhc1JoSi9jN0h5N0wybmZYd3FKaVVaQmRSeTVMZkNlU0lSZDM0c0NH?=
 =?utf-8?B?RzgrekVqaWZTSEh3Q0pPaUgyc25mQmpORmpqd2hvYkFSUElKR2l4eU5rR2JS?=
 =?utf-8?B?NGFSc0w2VUhHZ3lsK0dYbFlkNi9sdDFjSU9BRDkvQy9jZEVxWDBXRk01SFNr?=
 =?utf-8?B?c0pQYXhkakZjczNQb05EODlxYllQODlvUy9jTWZtM01FSEhXdmVQZG1SYWFE?=
 =?utf-8?B?aHZXNnRtQVJneFRmbHlLNnl3bURod0NBRkJRdGNQclB3TXFyQlIwTFVCa2Va?=
 =?utf-8?B?YlJwV3UyMG1YaGZ2b0J1cHRRUGxZY2RKTVpWazBCYTZpYURHckRCRDN1bWRY?=
 =?utf-8?B?VUlIbUM1emNuWmpiREFUNTlsVjVLMnQ5VDJOYzlKQU9XeUlnaDRNRjJObENr?=
 =?utf-8?B?bjFObENWNmp5MnFUWHRSRVY2YjNLbFNPRUFDeWsxY3gzdHZydWlZU1Bic2dj?=
 =?utf-8?B?ODFTMXQ3bG9HQ3VwVy9FRFF5bVNmV25RTWZxZUNyUFFmRUpMVlo2YVFWU1Qy?=
 =?utf-8?B?L2tSWHdZSXdERitlYjUzdE9XT3dyMThNWGRqRkxrbXhoREs3Z2lCY3MwUlVm?=
 =?utf-8?B?UFNKVWNPdkJWTFBDcFZWRENUTEhDSTZqZm1xZUUxUTFTNE9QVTB2K2REY01X?=
 =?utf-8?B?ajJ6MlVwSEZldXN0NEJVRHhYQWhDVUZ4R2kzVmN3WE9VTlNqNjE4OW9FVWpY?=
 =?utf-8?B?allLZWN1U3RwWEFRTk5IcGZCSDA0d0ZLQTZ3ak9SMTc1aU1La1QzZmtDb0RR?=
 =?utf-8?B?alF5Z29mWlBBTExWbmZNYXJCNW9ubFVsM1F3UlM1RThNU3RsSGpseHVPR3hX?=
 =?utf-8?B?N3ZKTVpaR3FlTzQxcFFJVjRDOXdiLzlBYVFrNDlHQjhKZldNWjJiekg3UkY1?=
 =?utf-8?B?Nks5TFdwVks1cFVHNUJ4aDZNU0dVN3lQc1VSTW80alhkNmZFQnNTaVJDZTlW?=
 =?utf-8?B?VWpveU91RTNZNDg0OEdxdERuc1JvTWVCaStSalFJSEpKdWpXS1VZQ1V4ODJt?=
 =?utf-8?B?VGd0eGxUUEcyendOa1VSRHFZd1ZNVHhsOHNGekNXSWlPVytJWlJkUjRwdXFy?=
 =?utf-8?B?ZjRIbEU2czhwREtiQ3FHdEZXVnZCZmhRK3I5ak5DMk05TVJPelJKbzMvWVFk?=
 =?utf-8?B?b3BHa3NlUDMvRFVMcFZ5aVA1bXNWN2x5UzFIcThWNCt0VzlDS2RTR3dCY0t2?=
 =?utf-8?B?bzdGQTNING8xcmdrNGxTTlpmUUVjbmhFZFA4aFN2Vk9URTl4RUhZVmRzVmU5?=
 =?utf-8?B?RU4rRzhKY3hMUC9pcHhpczJ6czBlalZab0luM2FJZHcxMnNTRTJjZFR0aEtN?=
 =?utf-8?B?Smo1MkhEMVJqYVVCR0NJN21pNnd3eTBrY1NWUWdqSzVURnJ2cnFsNjlkRzU4?=
 =?utf-8?B?a0wzYjNyRGloTStuLytUa1ZkM1VxQVRoTm9aVVFwbjNVVWNUSE5UaFFTSXhU?=
 =?utf-8?B?RS92bmxneWswdW40cVZ5NElhZXZTTEkzR0t6MkRidzVPdFN4Z3IvMzlvN0k2?=
 =?utf-8?B?bGt0OXB2Yi9ON2NhSGNNWW5qdHJvVkZQUlZ2V0FDdnd2YWgzLytMNHFicTBX?=
 =?utf-8?B?OTFzL2ZFWVltYlVQRlBEWHEvZ1pCRkJBbVJSMnFSbGZTRFcwTGlJMzl3S0FC?=
 =?utf-8?B?WFlKeStOZjNDUm5zYmVqZFRmS3Z2dVFFVGVRbjkxVXdKOVZVaFdsdnlXZ2FO?=
 =?utf-8?B?ZG53NWRlK01kZExJZmMzMGNoYnROdE9kNzdkOW9rZzBFbUdXUFRQZDRVaXFE?=
 =?utf-8?B?SXJraUQyczFJV0dZaTRXWThhZ0dyNFJDN1Vqa1ZCMkNsQ3YrMVN0TjBTOTQ1?=
 =?utf-8?B?RmwwNTc2ZU1MZDNGU2JMOGpRQk83SEZ6TllBWVZzM2xZS2lLVjJqejZrVEVQ?=
 =?utf-8?B?RC9jR3VPdlUvR2NKRW13OWgySDl3eEsvYThWZ0tlc1NaTlVFSW8zYWJETndC?=
 =?utf-8?B?NEJHbzRMWFd2Z2lReUtNWmxMRlBkaVFoNlp2dWFjZmFFTUd0WHBGNk5vMGRH?=
 =?utf-8?Q?vDpD+iHXvIQmbljKAk0vVXLdnW8dQKEMguuIhHqeBALc?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: afce9442-c4d7-4b3a-d69f-08db1f9cd4a0
X-MS-Exchange-CrossTenant-AuthSource: BN8PR12MB3587.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Mar 2023 06:17:44.8382
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: yf1r68iPfWEHOyiZjRLe9j1cknwTHJl92mOOc1eZiZzWhUbpfUP419XgLKZLPpe7
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR12MB4149
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Am 08.03.23 um 03:26 schrieb Steven Rostedt:
> On Tue, 7 Mar 2023 21:22:23 -0500
> Steven Rostedt <rostedt@goodmis.org> wrote:
>
>> Looks like there was a lock possibly used after free. But as commit
>> 9bff18d13473a9fdf81d5158248472a9d8ecf2bd ("drm/ttm: use per BO cleanup
>> workers") changed a lot of this code, I figured it may be the culprit.
> If I bothered to look at the second warning after this one (I usually stop
> after the first), it appears to state there was a use after free issue.

Yeah, that looks like the reference count was somehow messed up.

What test case/environment do you run to trigger this?

Thanks for the notice,
Christian.

>
> [  206.692285] ------------[ cut here ]------------
> [  206.706333] refcount_t: underflow; use-after-free.
> [  206.720577] WARNING: CPU: 0 PID: 332 at lib/refcount.c:28 refcount_warn_saturate+0xb6/0xfc
> [  206.735810] Modules linked in:
> [  206.749493] CPU: 0 PID: 332 Comm: kworker/0:13H Tainted: G        W          6.3.0-rc1-test-00001-ga98bd42762ed-dirty #965
> [  206.765833] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-debian-1.16.0-5 04/01/2014
> [  206.781767] Workqueue: ttm ttm_bo_delayed_delete
> [  206.796500] EIP: refcount_warn_saturate+0xb6/0xfc
> [  206.811121] Code: 68 50 1c 0d cf e8 66 b3 a9 ff 0f 0b 58 c9 c3 90 80 3d 57 c6 38 cf 00 75 8a c6 05 57 c6 38 cf 01 68 7c 1c 0d cf e8 46 b3 a9 ff <0f> 0b 59 c9 c3 80 3d 55 c6 38 cf 00 0f 85 67 ff ff ff c6 05 55 c6
> [  206.844560] EAX: 00000026 EBX: c2d5f150 ECX: c3ae5e40 EDX: 00000002
> [  206.862109] ESI: c2d5f0bc EDI: f6f91200 EBP: c3ae5f18 ESP: c3ae5f14
> [  206.878773] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010246
> [  206.895665] CR0: 80050033 CR2: ff9ff000 CR3: 0f512000 CR4: 00150ef0
> [  206.912303] Call Trace:
> [  206.927940]  ttm_bo_delayed_delete+0x8c/0x94
> [  206.944179]  process_one_work+0x21a/0x538
> [  206.960605]  worker_thread+0x146/0x398
> [  206.976839]  kthread+0xea/0x10c
> [  206.992696]  ? process_one_work+0x538/0x538
> [  207.008827]  ? kthread_complete_and_exit+0x1c/0x1c
> [  207.025150]  ret_from_fork+0x1c/0x28
> [  207.041307] irq event stamp: 4219
> [  207.056883] hardirqs last  enabled at (4219): [<ced2a039>] _raw_spin_unlock_irqrestore+0x2d/0x58
> [  207.074298] hardirqs last disabled at (4218): [<ce1d3a65>] kvfree_call_rcu+0x155/0x2ec
> [  207.091461] softirqs last  enabled at (3570): [<ced2b113>] __do_softirq+0x2f3/0x48b
> [  207.107979] softirqs last disabled at (3565): [<ce0c84e9>] call_on_stack+0x45/0x4c
> [  207.123827] ---[ end trace 0000000000000000 ]---
>
>
> -- Steve