dri-devel August 2019

dri-devel@lists.freedesktop.org

318 participants
2338 discussions

[Bug 203471] New: Tearing on Raven Ridge and RX560X PRIME setup even with Vsync enabled
by bugzilla-daemon＠bugzilla.kernel.org 16 Oct '20

16 Oct '20

https://bugzilla.kernel.org/show_bug.cgi?id=203471 Bug ID: 203471 Summary: Tearing on Raven Ridge and RX560X PRIME setup even with Vsync enabled Product: Drivers Version: 2.5 Kernel Version: 5.1 rc6 Hardware: All OS: Linux Tree: Mainline Status: NEW Severity: high Priority: P1 Component: Video(DRI - non Intel) Assignee: drivers_video-dri(a)kernel-bugs.osdl.org Reporter: haxk612(a)gmail.com Regression: No I have Acer Nitro 5 AN515-42 with Ryzen 5 2500U and RX560X. When i launch some game with DRI_PRIME=1 to have it on dGPU there is huge tearing on top of the screen that is there with or without Vsync. If i launch the game on iGPU there is no tearing at all. Also the tearing happens only when the game is in fullscreen. If i take a screenshot there is no tearing in the screenshot. And i cannot post a picture as my phone camera is broken in my latest build of android. I have tried 5.2-wip branch and there is the same issue. Will post dmesg and journalctl in few hours. -- You are receiving this mail because: You are watching the assignee of the bug.

1 26

[Bug 199979] New: amdgpu: changing pwm1_enable from 1 to 2 does not resume automatic fan control
by bugzilla-daemon＠bugzilla.kernel.org 06 Oct '20

06 Oct '20

https://bugzilla.kernel.org/show_bug.cgi?id=199979 Bug ID: 199979 Summary: amdgpu: changing pwm1_enable from 1 to 2 does not resume automatic fan control Product: Drivers Version: 2.5 Kernel Version: 4.17.0 Hardware: All OS: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: Video(DRI - non Intel) Assignee: drivers_video-dri(a)kernel-bugs.osdl.org Reporter: CWidmer(a)umbrox.de Regression: No When using the hardware monitoring interface to change pwm1_enable to 2 (automatic) from 1 (manual), the automatic fan control does not work as expected. Instead, the pwm1 value keeps jumping around between at least two values and a continuous, persisting, and unpleasantly high-pitched sound can be heard from inside the computer case. The only way to stop those things is writing some valid value to pwm1, which in turn also switches pwm1_enable back to 1. If the system is booted without ever manually changing the pwm1_enable value, which then defaults to 2, automatic fan control does work as intended. I am using a custom RX 580 (Sapphire Nitro+ Radeon RX 580 8GD5 Special Edition) on a Gentoo x86_64 system and was able to reproduce the issue with the 4.17.0 kernel with Gentoo patches, the Ubuntu kernel on the 18.04 image (should be a 4.15 one) and also with amd-staging-drm-next. -- You are receiving this mail because: You are watching the assignee of the bug.

1 1

[Bug 198551] New: amdgpu error on shutdown or gpu intense game
by bugzilla-daemon＠bugzilla.kernel.org 24 Sep '20

24 Sep '20

https://bugzilla.kernel.org/show_bug.cgi?id=198551 Bug ID: 198551 Summary: amdgpu error on shutdown or gpu intense game Product: Drivers Version: 2.5 Kernel Version: 4.14.14-1 Hardware: All OS: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: Video(DRI - non Intel) Assignee: drivers_video-dri(a)kernel-bugs.osdl.org Reporter: illuslion1998(a)gmail.com Regression: No Created attachment 273797 --> https://bugzilla.kernel.org/attachment.cgi?id=273797&action=edit amdgpu error log I get this error sometimes when I try to shutdown my computer. It freezes everything and I have to hard reset my computer. This sometimes also happens when I play a GPU intense game. (Example CS:GO). My GPU is Radeon R5 M255. -- You are receiving this mail because: You are watching the assignee of the bug.

1 5

[PATCH] drm: avoid spurious EBUSY due to nonblocking atomic modesets
by Daniel Vetter 23 Sep '20

23 Sep '20

When doing an atomic modeset with ALLOW_MODESET drivers are allowed to pull in arbitrary other resources, including CRTCs (e.g. when reconfiguring global resources). But in nonblocking mode userspace has then no idea this happened, which can lead to spurious EBUSY calls, both: - when that other CRTC is currently busy doing a page_flip the ALLOW_MODESET commit can fail with an EBUSY - on the other CRTC a normal atomic flip can fail with EBUSY because of the additional commit inserted by the kernel without userspace's knowledge For blocking commits this isn't a problem, because everyone else will just block until all the CRTC are reconfigured. Only thing userspace can notice is the dropped frames without any reason for why frames got dropped. Consensus is that we need new uapi to handle this properly, but no one has any idea what exactly the new uapi should look like. As a stop-gap plug this problem by demoting nonblocking commits which might cause issues by including CRTCs not in the original request to blocking commits. v2: Add comments and a WARN_ON to enforce this only when allowed - we don't want to silently convert page flips into blocking plane updates just because the driver is buggy. References: https://lists.freedesktop.org/archives/dri-devel/2018-July/182281.html Bugzilla: https://gitlab.freedesktop.org/wayland/weston/issues/24#note_9568 Cc: Daniel Stone <daniel(a)fooishbar.org> Cc: Pekka Paalanen <pekka.paalanen(a)collabora.co.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> --- drivers/gpu/drm/drm_atomic.c | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index d5cefb1cb2a2..058512f14772 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -2018,15 +2018,43 @@ EXPORT_SYMBOL(drm_atomic_commit); int drm_atomic_nonblocking_commit(struct drm_atomic_state *state) { struct drm_mode_config *config = &state->dev->mode_config; - int ret; + unsigned requested_crtc = 0; + unsigned affected_crtc = 0; + struct drm_crtc *crtc; + struct drm_crtc_state *crtc_state; + bool nonblocking = true; + int ret, i; + + /* + * For commits that allow modesets drivers can add other CRTCs to the + * atomic commit, e.g. when they need to reallocate global resources. + * + * But when userspace also requests a nonblocking commit then userspace + * cannot know that the commit affects other CRTCs, which can result in + * spurious EBUSY failures. Until we have better uapi plug this by + * demoting such commits to blocking mode. + */ + for_each_new_crtc_in_state(state, crtc, crtc_state, i) + requested_crtc |= drm_crtc_mask(crtc); ret = drm_atomic_check_only(state); if (ret) return ret; - DRM_DEBUG_ATOMIC("committing %p nonblocking\n", state); + for_each_new_crtc_in_state(state, crtc, crtc_state, i) + affected_crtc |= drm_crtc_mask(crtc); + + if (affected_crtc != requested_crtc) { + /* adding other CRTC is only allowed for modeset commits */ + WARN_ON(state->allow_modeset); + + DRM_DEBUG_ATOMIC("demoting %p to blocking mode to avoid EBUSY\n", state); + nonblocking = false; + } else { + DRM_DEBUG_ATOMIC("committing %p nonblocking\n", state); + } - return config->funcs->atomic_commit(state->dev, state, true); + return config->funcs->atomic_commit(state->dev, state, nonblocking); } EXPORT_SYMBOL(drm_atomic_nonblocking_commit); -- 2.18.0

3 11

[Bug 203033] New: nouveau hung task
by bugzilla-daemon＠bugzilla.kernel.org 28 Aug '20

28 Aug '20

https://bugzilla.kernel.org/show_bug.cgi?id=203033 Bug ID: 203033 Summary: nouveau hung task Product: Drivers Version: 2.5 Kernel Version: 5.0.0 Hardware: x86-64 OS: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: Video(DRI - non Intel) Assignee: drivers_video-dri(a)kernel-bugs.osdl.org Reporter: mcroce(a)redhat.com Regression: No The GUI freezes randomly with nouveau with this error in the syslog: INFO: task kworker/u16:4:14755 blocked for more than 120 seconds. Not tainted 5.0.0-matteo #28 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/u16:4 D 0 14755 2 0x80000000 Workqueue: events_unbound nv50_disp_atomic_commit_work [nouveau] Call Trace: ? __schedule+0x1a6/0x6c0 schedule+0x2c/0x70 schedule_timeout+0x268/0x380 ? nvif_notify_get+0x94/0xa0 [nouveau] dma_fence_default_wait+0x204/0x270 ? dma_fence_release+0x90/0x90 dma_fence_wait_timeout+0xdd/0x100 drm_atomic_helper_wait_for_fences+0x3a/0xc0 [drm_kms_helper] nv50_disp_atomic_commit_tail+0x7c/0x850 [nouveau] ? __switch_to_asm+0x34/0x70 ? __switch_to_asm+0x40/0x70 ? __switch_to_asm+0x40/0x70 ? __switch_to_asm+0x40/0x70 process_one_work+0x1fa/0x400 worker_thread+0x2d/0x3d0 ? process_one_work+0x400/0x400 kthread+0x113/0x130 ? kthread_create_on_node+0x60/0x60 ret_from_fork+0x35/0x40 -- You are receiving this mail because: You are watching the assignee of the bug.

1 5

[Bug 204609] New: amdgpu: powerplay failed send message
by bugzilla-daemon＠bugzilla.kernel.org 15 Aug '20

15 Aug '20

https://bugzilla.kernel.org/show_bug.cgi?id=204609 Bug ID: 204609 Summary: amdgpu: powerplay failed send message Product: Drivers Version: 2.5 Kernel Version: 5.3.0-rc3-drm-next Hardware: x86-64 OS: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: Video(DRI - non Intel) Assignee: drivers_video-dri(a)kernel-bugs.osdl.org Reporter: kingoipo(a)gmail.com Regression: No Created attachment 284483 --> https://bugzilla.kernel.org/attachment.cgi?id=284483&action=edit dmesg Always when booting and sometimes during regular usage, the following messages appear: > amdgpu: [powerplay] failed send message: TransferTableSmu2Dram (18) param: > 0x00000006 response 0xffffffc2 > amdgpu: [powerplay] failed send message: NumOfDisplays (64) param: > 0x00000002 response 0xffffffc2 My hardware is a Sapphire RX 5700 on an x570 motherboard. The kernel is build from https://cgit.freedesktop.org/~agd5f/linux/log/?h=drm-next commit 283791cbb202ae73002de4a6c53f835e4406b276. Mesa is from oibaf's ppa for ubuntu 19.04: https://launchpad.net/~oibaf/+archive/ubuntu/graphics-drivers?field.series_… Xorg is distro provided 1.20.4 with amdgpu driver version 19.0.1 -- You are receiving this mail because: You are watching the assignee of the bug.

1 10

[RFC v2 00/11] DVFS in the OPP core
by Rajendra Nayak 12 Aug '20

12 Aug '20

This is a v2 of the RFC posted earlier by Stephen Boyd [1] As part of v2 I still follow the same approach of dev_pm_opp_set_rate() API using clk framework to round the frequency passed and making it accept 0 as a valid frequency indicating the frequency isn't required anymore. It just has a few more drivers converted to use this approach like dsi/dpu and ufs. ufs demonstrates the case of having to handle multiple power domains, one of which is scalable. The patches are based on 5.1-rc1 and depend on some ufs fixes I posted earlier [2] and a DT patch to include the rpmpd header [3] [1] https://lkml.org/lkml/2019/1/28/2086 [2] https://lkml.org/lkml/2019/3/8/70 [3] https://lkml.org/lkml/2019/3/20/120 Rajendra Nayak (10): OPP: Make dev_pm_opp_set_rate() with freq=0 as valid tty: serial: qcom_geni_serial: Use OPP API to set clk/perf state spi: spi-geni-qcom: Use OPP API to set clk/perf state arm64: dts: sdm845: Add OPP table for all qup devices scsi: ufs: Add support to manage multiple power domains in ufshcd-pltfrm scsi: ufs: Add support for specifying OPP tables in DT arm64: dts: sdm845: Add ufs opps and power-domains drm/msm/dpu: Use OPP API to set clk/perf state drm/msm: dsi: Use OPP API to set clk/perf state arm64: dts: sdm845: Add DSI and MDP OPP tables and power-domains Stephen Boyd (1): OPP: Don't overwrite rounded clk rate arch/arm64/boot/dts/qcom/sdm845.dtsi | 194 +++++++++++++++++- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 7 +- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 9 + drivers/gpu/drm/msm/dsi/dsi.h | 2 + drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 88 +++++++- drivers/opp/core.c | 26 ++- drivers/scsi/ufs/ufshcd-pltfrm.c | 52 ++++- drivers/scsi/ufs/ufshcd.c | 21 +- drivers/scsi/ufs/ufshcd.h | 3 + drivers/spi/spi-geni-qcom.c | 14 +- drivers/tty/serial/qcom_geni_serial.c | 15 +- 12 files changed, 406 insertions(+), 29 deletions(-) -- QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, hosted by The Linux Foundation

5 35

[drm/ttm] Memory corruption problem when ttm_tt_init() fails.
by Tetsuo Handa 29 Jul '20

29 Jul '20

I'm doing memory allocation failure injection test using 3.19-rc5 and it seems to me that there is a memory corruption bug in ttm or vmwgfx code. ---------- Crash pattern 1 start ---------- [ 80.751971] [TTM] Failed allocating page table [ 83.000393] BUG: unable to handle kernel NULL pointer dereference at (null) [ 83.004392] IP: [<ffffffff811b65a9>] __fput+0x39/0x1e0 [ 83.006944] PGD 7acd2067 PUD 7b0c7067 PMD 0 [ 83.009240] Oops: 0000 [#1] SMP [ 83.010940] Modules linked in: stap_fault_injection(OE) ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 ipt_REJECT nf_reject_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_mangle ip6table_raw ip6table_filter ip6_tables iptable_mangle iptable_raw iptable_filter ip_tables coretemp crct10dif_pclmul crc32_pclmul crc32c_intel dm_mirror ghash_clmulni_intel dm_region_hash aesni_intel dm_log glue_helper dm_mod lrw gf128mul ablk_helper cryptd ppdev vmw_balloon microcode serio_raw pcspkr parport_pc shpchp parport vmw_vmci i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc uinput sd_mod ata_generic pata_acpi mptspi scsi_transport_spi mptscsih ata_piix e1000 mptbase libata floppy [ 83.038033] CPU: 2 PID: 8795 Comm: sh Tainted: G W OE 3.19.0-rc5+ #28 [ 83.039666] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 [ 83.042110] task: ffff88007a220000 ti: ffff880052048000 task.ti: ffff880052048000 [ 83.043865] RIP: 0010:[<ffffffff811b65a9>] [<ffffffff811b65a9>] __fput+0x39/0x1e0 [ 83.045665] RSP: 0018:ffff88005204bea8 EFLAGS: 00010297 [ 83.046895] RAX: 0000000000000000 RBX: ffff88007aff3500 RCX: 0000000000000a0a [ 83.048595] RDX: 000000000002801d RSI: 000000000000000a RDI: ffff88007aff3500 [ 83.050254] RBP: ffff88005204bee8 R08: ffff88007cbfd000 R09: 0000000180080006 [ 83.051848] R10: 0000000000000000 R11: ffffea0001f2fe00 R12: ffffffff81e6c040 [ 83.053515] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 83.055156] FS: 0000000000000000(0000) GS:ffff88007fc80000(0000) knlGS:0000000000000000 [ 83.057000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.058328] CR2: 0000000000000000 CR3: 000000007b0bc000 CR4: 00000000000407e0 [ 83.060004] Stack: [ 83.060482] ffff88007af0de48 ffff88007af0dc00 ffff88007af0de48 0000000000000000 [ 83.062285] ffffffff81e6c040 ffff88007a220610 ffff88007a220000 0000000000000000 [ 83.064115] ffff88005204bef8 ffffffff811b679e ffff88005204bf28 ffffffff81088f6f [ 83.065956] Call Trace: [ 83.066544] [<ffffffff811b679e>] ____fput+0xe/0x10 [ 83.067738] [<ffffffff81088f6f>] task_work_run+0xaf/0xf0 [ 83.068971] [<ffffffff81013c5a>] do_notify_resume+0x7a/0x90 [ 83.070307] [<ffffffff816a6d87>] int_signal+0x12/0x17 [ 83.071464] Code: 55 41 54 53 48 89 fb 48 83 ec 18 4c 8b 7f 18 4c 8b 77 10 4c 8b 6f 20 e8 06 c7 4e 00 8b 53 44 4c 8b 53 20 89 d0 83 e0 02 83 f8 01 <41> 0f b7 02 45 19 e4 41 83 e4 08 41 83 c4 08 44 89 e1 66 25 00 [ 83.077450] RIP [<ffffffff811b65a9>] __fput+0x39/0x1e0 [ 83.078729] RSP <ffff88005204bea8> [ 83.079522] CR2: 0000000000000000 crash> bt -l PID: 8795 TASK: ffff88007a220000 CPU: 2 COMMAND: "sh" #0 [ffff88005204ba70] machine_kexec at ffffffff8104ef62 /usr/src/linux/arch/x86/kernel/machine_kexec_64.c: 320 #1 [ffff88005204bac0] crash_kexec at ffffffff810ed983 /usr/src/linux/kernel/kexec.c: 1482 #2 [ffff88005204bb90] oops_end at ffffffff810176e8 /usr/src/linux/arch/x86/kernel/dumpstack.c: 231 #3 [ffff88005204bbc0] no_context at ffffffff8169af1f /usr/src/linux/arch/x86/mm/fault.c: 724 #4 [ffff88005204bc20] __bad_area_nosemaphore at ffffffff8169aff6 /usr/src/linux/arch/x86/mm/fault.c: 804 #5 [ffff88005204bc70] bad_area at ffffffff8169b31f /usr/src/linux/arch/x86/mm/fault.c: 833 #6 [ffff88005204bca0] __do_page_fault at ffffffff81059b37 /usr/src/linux/arch/x86/mm/fault.c: 1213 #7 [ffff88005204bdc0] do_page_fault at ffffffff81059c11 /usr/src/linux/arch/x86/mm/fault.c: 1295 #8 [ffff88005204bdf0] page_fault at ffffffff816a8a28 /usr/src/linux/arch/x86/kernel/entry_64.S: 1283 [exception RIP: __fput+57] RIP: ffffffff811b65a9 RSP: ffff88005204bea8 RFLAGS: 00010297 RAX: 0000000000000000 RBX: ffff88007aff3500 RCX: 0000000000000a0a RDX: 000000000002801d RSI: 000000000000000a RDI: ffff88007aff3500 RBP: ffff88005204bee8 R8: ffff88007cbfd000 R9: 0000000180080006 R10: 0000000000000000 R11: ffffea0001f2fe00 R12: ffffffff81e6c040 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #9 [ffff88005204bef0] ____fput at ffffffff811b679e /usr/src/linux/fs/file_table.c: 245 #10 [ffff88005204bf00] task_work_run at ffffffff81088f6f /usr/src/linux/kernel/task_work.c: 125 #11 [ffff88005204bf30] do_notify_resume at ffffffff81013c5a /usr/src/linux/include/linux/tracehook.h: 190 #12 [ffff88005204bf50] int_signal at ffffffff816a6d87 /usr/src/linux/arch/x86/kernel/entry_64.S: 587 RIP: 00007f1361d5f420 RSP: 00007fff77be5740 RFLAGS: 00000200 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R8: 0000000000000000 R9: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ORIG_RAX: 000000000000003b CS: 0033 SS: 002b WARNING: possibly bogus exception frame ---------- Crash pattern 1 end ---------- ---------- Crash pattern 2 start ---------- [ 227.647021] [TTM] Failed allocating page table [ 227.875795] BUG: unable to handle kernel NULL pointer dereference at (null) [ 227.877714] IP: [<ffffffff81594c57>] skb_queue_tail+0x37/0x60 [ 227.879107] PGD 78adc067 PUD 78ada067 PMD 0 [ 227.880186] Oops: 0002 [#1] SMP [ 227.881017] Modules linked in: stap_fault_injection(OE) ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 ipt_REJECT nf_reject_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_mangle ip6table_raw ip6table_filter ip6_tables iptable_mangle iptable_raw iptable_filter ip_tables coretemp crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel dm_mirror aesni_intel dm_region_hash dm_log glue_helper dm_mod lrw gf128mul ablk_helper cryptd ppdev vmw_balloon microcode parport_pc serio_raw pcspkr parport vmw_vmci shpchp i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc uinput ata_generic pata_acpi sd_mod ata_piix libata mptspi scsi_transport_spi e1000 mptscsih mptbase floppy [ 227.898988] CPU: 2 PID: 610 Comm: Xorg Tainted: G W OE 3.19.0-rc5+ #28 [ 227.900691] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 [ 227.903162] task: ffff8800788c6040 ti: ffff8800792d8000 task.ti: ffff8800792d8000 [ 227.904884] RIP: 0010:[<ffffffff81594c57>] [<ffffffff81594c57>] skb_queue_tail+0x37/0x60 [ 227.906816] RSP: 0018:ffff8800792dbbc8 EFLAGS: 00010046 [ 227.908056] RAX: 0000000000000292 RBX: ffff88007cbc6d10 RCX: 0000000000000000 [ 227.909718] RDX: 0000000000000000 RSI: 0000000000000292 RDI: ffff88007cbc6d24 [ 227.911376] RBP: ffff8800792dbbe8 R08: 0000000000000292 R09: 0180000002800000 [ 227.913027] R10: 0000000700020008 R11: 0000000000000000 R12: ffff88007b65aa00 [ 227.914690] R13: ffff88007cbc6d24 R14: 0000000000000000 R15: ffff88007cbc6c80 [ 227.916356] FS: 00007f3d07740980(0000) GS:ffff88007fc80000(0000) knlGS:0000000000000000 [ 227.918232] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 227.919559] CR2: 0000000000000000 CR3: 0000000078add000 CR4: 00000000000407e0 [ 227.921261] Stack: [ 227.921744] 0000000000000078 ffff88007b65aa00 0000000000000078 0000000000000000 [ 227.923618] ffff8800792dbca8 ffffffff816491bd ffff88007cbc6d10 ffff8800792dbd10 [ 227.925427] 0000007800000000 ffff8800792dbcc8 0000000000000078 ffff88007cbc6f78 [ 227.927271] Call Trace: [ 227.927872] [<ffffffff816491bd>] unix_stream_sendmsg+0x1dd/0x430 [ 227.929301] [<ffffffff8158c0c3>] sock_aio_write+0x103/0x140 [ 227.930638] [<ffffffff811b42ec>] do_sync_readv_writev+0x4c/0x80 [ 227.932047] [<ffffffff811b5c95>] do_readv_writev+0x1e5/0x280 [ 227.933406] [<ffffffff8101fe4b>] ? __restore_xstate_sig+0x8b/0x680 [ 227.934865] [<ffffffff81104424>] ? __audit_syscall_entry+0xb4/0x110 [ 227.936371] [<ffffffff811b5db9>] vfs_writev+0x39/0x50 [ 227.937565] [<ffffffff811b5eea>] SyS_writev+0x4a/0xd0 [ 227.938777] [<ffffffff816a6d6c>] ? int_check_syscall_exit_work+0x34/0x3d [ 227.940364] [<ffffffff816a6ae9>] system_call_fastpath+0x12/0x17 [ 227.941775] Code: 8d 6f 14 41 54 49 89 f4 53 48 89 fb 4c 89 ef 48 83 ec 08 e8 dc 1a 11 00 48 8b 53 08 49 89 1c 24 4c 89 ef 48 89 c6 49 89 54 24 08 <4c> 89 22 83 43 10 01 4c 89 63 08 e8 09 17 11 00 48 83 c4 08 5b [ 227.947880] RIP [<ffffffff81594c57>] skb_queue_tail+0x37/0x60 [ 227.949297] RSP <ffff8800792dbbc8> [ 227.950112] CR2: 0000000000000000 crash> bt -l PID: 610 TASK: ffff8800788c6040 CPU: 2 COMMAND: "Xorg" #0 [ffff8800792db790] machine_kexec at ffffffff8104ef62 /usr/src/linux/arch/x86/kernel/machine_kexec_64.c: 320 #1 [ffff8800792db7e0] crash_kexec at ffffffff810ed983 /usr/src/linux/kernel/kexec.c: 1482 #2 [ffff8800792db8b0] oops_end at ffffffff810176e8 /usr/src/linux/arch/x86/kernel/dumpstack.c: 231 #3 [ffff8800792db8e0] no_context at ffffffff8169af1f /usr/src/linux/arch/x86/mm/fault.c: 724 #4 [ffff8800792db940] __bad_area_nosemaphore at ffffffff8169aff6 /usr/src/linux/arch/x86/mm/fault.c: 804 #5 [ffff8800792db990] bad_area at ffffffff8169b31f /usr/src/linux/arch/x86/mm/fault.c: 833 #6 [ffff8800792db9c0] __do_page_fault at ffffffff81059b37 /usr/src/linux/arch/x86/mm/fault.c: 1213 #7 [ffff8800792dbae0] do_page_fault at ffffffff81059c11 /usr/src/linux/arch/x86/mm/fault.c: 1295 #8 [ffff8800792dbb10] page_fault at ffffffff816a8a28 /usr/src/linux/arch/x86/kernel/entry_64.S: 1283 [exception RIP: skb_queue_tail+55] RIP: ffffffff81594c57 RSP: ffff8800792dbbc8 RFLAGS: 00010046 RAX: 0000000000000292 RBX: ffff88007cbc6d10 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000292 RDI: ffff88007cbc6d24 RBP: ffff8800792dbbe8 R8: 0000000000000292 R9: 0180000002800000 R10: 0000000700020008 R11: 0000000000000000 R12: ffff88007b65aa00 R13: ffff88007cbc6d24 R14: 0000000000000000 R15: ffff88007cbc6c80 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #9 [ffff8800792dbbf0] unix_stream_sendmsg at ffffffff816491bd /usr/src/linux/net/unix/af_unix.c: 1711 #10 [ffff8800792dbcb0] sock_aio_write at ffffffff8158c0c3 /usr/src/linux/net/socket.c: 955 #11 [ffff8800792dbd90] do_sync_readv_writev at ffffffff811b42ec /usr/src/linux/fs/read_write.c: 697 #12 [ffff8800792dbe20] do_readv_writev at ffffffff811b5c95 /usr/src/linux/fs/read_write.c: 851 #13 [ffff8800792dbf20] vfs_writev at ffffffff811b5db9 /usr/src/linux/fs/read_write.c: 893 #14 [ffff8800792dbf30] sys_writev at ffffffff811b5eea /usr/src/linux/fs/read_write.c: 926 #15 [ffff8800792dbf80] system_call_fastpath at ffffffff816a6ae9 /usr/src/linux/arch/x86/kernel/entry_64.S: 423 RIP: 00007f3d056223c0 RSP: 00007ffff316be40 RFLAGS: 00003293 RAX: ffffffffffffffda RBX: ffffffff816a6ae9 RCX: ffffffffffffffff RDX: 0000000000000001 RSI: 00007ffff316af90 RDI: 0000000000000014 RBP: 0000000001d59be0 R8: 0000000000000000 R9: 0000000000000004 R10: 00000000ffffffff R11: 0000000000003293 R12: 00007f3d077406a0 R13: 0000000000000001 R14: 00007ffff316af90 R15: 0000000000000000 ORIG_RAX: 0000000000000014 CS: 0033 SS: 002b ---------- Crash pattern 2 end ---------- ---------- Crash pattern 3 start ---------- [ 88.675004] [TTM] Failed allocating page table [ 88.678152] BUG: unable to handle kernel paging request at ffff8801531d77c0 [ 88.679845] IP: [<ffffffff815964b5>] __alloc_skb+0x165/0x2b0 [ 88.681221] PGD 1f2b067 PUD 0 [ 88.682000] Oops: 0002 [#1] SMP [ 88.682838] Modules linked in: stap_fault_injection(OE) ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 ipt_REJECT nf_reject_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_mangle ip6table_raw ip6table_filter ip6_tables iptable_mangle iptable_raw iptable_filter ip_tables coretemp crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel dm_mirror dm_region_hash aesni_intel dm_log glue_helper dm_mod lrw gf128mul ablk_helper cryptd ppdev vmw_balloon microcode serio_raw pcspkr parport_pc shpchp vmw_vmci parport i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc uinput sd_mod ata_generic pata_acpi e1000 ata_piix libata mptspi scsi_transport_spi mptscsih mptbase floppy [ 88.701377] CPU: 0 PID: 3904 Comm: gnome-shell Tainted: G W OE 3.19.0-rc5+ #31 [ 88.703292] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 [ 88.705840] task: ffff880079e05780 ti: ffff88007918c000 task.ti: ffff88007918c000 [ 88.707575] RIP: 0010:[<ffffffff815964b5>] [<ffffffff815964b5>] __alloc_skb+0x165/0x2b0 [ 88.709601] RSP: 0018:ffff88007918faa8 EFLAGS: 00010246 [ 88.710884] RAX: 00000000ffffffff RBX: ffff8800531d7700 RCX: 00000000ffffffff [ 88.712584] RDX: ffff8801531d77c0 RSI: 0000000000000000 RDI: ffff8800531d77c8 [ 88.714260] RBP: ffff88007918faf8 R08: 00000000ffffffc0 R09: 0000000000000200 [ 88.715927] R10: ffffffff8159639e R11: ffff88007f803700 R12: ffff8800531d7800 [ 88.717648] R13: 00000000ffffffff R14: ffff88007f803700 R15: 0000000000000100 [ 88.719327] FS: 00007fcafd8aaa00(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000 [ 88.721216] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.722548] CR2: ffff8801531d77c0 CR3: 00000000790ae000 CR4: 00000000000407f0 [ 88.724257] Stack: [ 88.724761] ffff88007a2cdf00 000000007a01b800 0000000000000246 00ff88007918fcd8 [ 88.726741] ffff88007918fae8 0000000000000003 0000000000000000 ffff88007918fba8 [ 88.728578] ffff88007a01b800 0000000000000000 ffff88007918fb58 ffffffff81596d5c [ 88.730582] Call Trace: [ 88.731243] [<ffffffff81596d5c>] alloc_skb_with_frags+0x5c/0x1e0 [ 88.732725] [<ffffffff811c99bc>] ? do_sys_poll+0x12c/0x5b0 [ 88.734208] [<ffffffff815910b6>] sock_alloc_send_pskb+0x196/0x250 [ 88.735710] [<ffffffff8159b887>] ? skb_copy_datagram_from_iter+0xe7/0x200 [ 88.737361] [<ffffffff8164ba07>] ? wait_for_unix_gc+0x27/0xa0 [ 88.738784] [<ffffffff8164928a>] unix_stream_sendmsg+0x2aa/0x430 [ 88.740213] [<ffffffff8158c0c3>] sock_aio_write+0x103/0x140 [ 88.741610] [<ffffffff811c8860>] ? poll_select_copy_remaining+0x130/0x130 [ 88.743278] [<ffffffff811b42ec>] do_sync_readv_writev+0x4c/0x80 [ 88.744721] [<ffffffff811b5c95>] do_readv_writev+0x1e5/0x280 [ 88.746109] [<ffffffff8158bf9d>] ? SYSC_recvfrom+0x13d/0x160 [ 88.747452] [<ffffffff81104424>] ? __audit_syscall_entry+0xb4/0x110 [ 88.748992] [<ffffffff811b5db9>] vfs_writev+0x39/0x50 [ 88.750192] [<ffffffff811b5eea>] SyS_writev+0x4a/0xd0 [ 88.751423] [<ffffffff811046b6>] ? __audit_syscall_exit+0x236/0x2e0 [ 88.753121] [<ffffffff816a6ae9>] system_call_fastpath+0x12/0x17 [ 88.754650] Code: b6 83 90 00 00 00 83 e0 f7 09 c8 b9 ff ff ff ff 85 f6 88 83 90 00 00 00 b8 ff ff ff ff 66 89 8b c2 00 00 00 66 89 83 c6 00 00 00 <48> c7 02 00 00 00 00 48 c7 42 08 00 00 00 00 48 c7 42 10 00 00 [ 88.761554] RIP [<ffffffff815964b5>] __alloc_skb+0x165/0x2b0 [ 88.763077] RSP <ffff88007918faa8> [ 88.763978] CR2: ffff8801531d77c0 crash> bt -l PID: 3904 TASK: ffff880079e05780 CPU: 0 COMMAND: "gnome-shell" #0 [ffff88007918f690] machine_kexec at ffffffff8104ef62 /usr/src/linux/arch/x86/kernel/machine_kexec_64.c: 320 #1 [ffff88007918f6e0] crash_kexec at ffffffff810ed983 /usr/src/linux/kernel/kexec.c: 1482 #2 [ffff88007918f7b0] oops_end at ffffffff810176e8 /usr/src/linux/arch/x86/kernel/dumpstack.c: 231 #3 [ffff88007918f7e0] no_context at ffffffff8169af1f /usr/src/linux/arch/x86/mm/fault.c: 724 #4 [ffff88007918f840] __bad_area_nosemaphore at ffffffff8169aff6 /usr/src/linux/arch/x86/mm/fault.c: 804 #5 [ffff88007918f890] bad_area_nosemaphore at ffffffff8169b162 /usr/src/linux/arch/x86/mm/fault.c: 812 #6 [ffff88007918f8a0] __do_page_fault at ffffffff810596f8 /usr/src/linux/arch/x86/mm/fault.c: 1277 #7 [ffff88007918f9c0] do_page_fault at ffffffff81059c11 /usr/src/linux/arch/x86/mm/fault.c: 1295 #8 [ffff88007918f9f0] page_fault at ffffffff816a8a28 /usr/src/linux/arch/x86/kernel/entry_64.S: 1283 [exception RIP: __alloc_skb+357] RIP: ffffffff815964b5 RSP: ffff88007918faa8 RFLAGS: 00010246 RAX: 00000000ffffffff RBX: ffff8800531d7700 RCX: 00000000ffffffff RDX: ffff8801531d77c0 RSI: 0000000000000000 RDI: ffff8800531d77c8 RBP: ffff88007918faf8 R8: 00000000ffffffc0 R9: 0000000000000200 R10: ffffffff8159639e R11: ffff88007f803700 R12: ffff8800531d7800 R13: 00000000ffffffff R14: ffff88007f803700 R15: 0000000000000100 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #9 [ffff88007918fb00] alloc_skb_with_frags at ffffffff81596d5c /usr/src/linux/net/core/skbuff.c: 4386 #10 [ffff88007918fb60] sock_alloc_send_pskb at ffffffff815910b6 /usr/src/linux/net/core/sock.c: 1826 #11 [ffff88007918fbf0] unix_stream_sendmsg at ffffffff8164928a /usr/src/linux/net/unix/af_unix.c: 1682 #12 [ffff88007918fcb0] sock_aio_write at ffffffff8158c0c3 /usr/src/linux/net/socket.c: 955 #13 [ffff88007918fd90] do_sync_readv_writev at ffffffff811b42ec /usr/src/linux/fs/read_write.c: 697 #14 [ffff88007918fe20] do_readv_writev at ffffffff811b5c95 /usr/src/linux/fs/read_write.c: 851 #15 [ffff88007918ff20] vfs_writev at ffffffff811b5db9 /usr/src/linux/fs/read_write.c: 893 #16 [ffff88007918ff30] sys_writev at ffffffff811b5eea /usr/src/linux/fs/read_write.c: 926 #17 [ffff88007918ff80] system_call_fastpath at ffffffff816a6ae9 /usr/src/linux/arch/x86/kernel/entry_64.S: 423 RIP: 00007fcaf3c273c0 RSP: 00007fffadd91330 RFLAGS: 00000246 RAX: ffffffffffffffda RBX: ffffffff816a6ae9 RCX: 00007fffadd91360 RDX: 0000000000000002 RSI: 00007fffadd914b0 RDI: 0000000000000006 RBP: 0000000000b5c230 R8: 0000000000000000 R9: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 00007fffadd91428 R13: 00007fffadd91424 R14: 0000000000b5c248 R15: 0000000000000001 ORIG_RAX: 0000000000000014 CS: 0033 SS: 002b ---------- Crash pattern 3 end ---------- ---------- Failed memory allocation start ---------- 0xffffffff81199850 : __kmalloc+0x0/0x280 [kernel] /usr/src/linux/mm/slub.c:3247 0xffffffff814676fa : ttm_tt_init+0x8a/0xb0 [kernel] /usr/src/linux/include/linux/slab.h:524 /usr/src/linux/include/linux/slab.h:535 /usr/src/linux/include/drm/drm_mem_util.h:38 /usr/src/linux/drivers/gpu/drm/ttm/ttm_tt.c:53 /usr/src/linux/drivers/gpu/drm/ttm/ttm_tt.c:200 0xffffffff8147caa6 : vmw_ttm_tt_create+0x76/0xb0 [kernel] /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c:700 0xffffffff81467b8d : ttm_bo_add_ttm+0x9d/0xe0 [kernel] /usr/src/linux/drivers/gpu/drm/ttm/ttm_bo.c:238 0xffffffff8146a2ff : ttm_bo_validate+0x14f/0x1f0 [kernel] /usr/src/linux/drivers/gpu/drm/ttm/ttm_bo.c:1067 0xffffffff8146a5d4 : ttm_bo_init+0x234/0x470 [kernel] /usr/src/linux/drivers/gpu/drm/ttm/ttm_bo.c:1167 0xffffffff8147ae9e : vmw_dmabuf_init+0x13e/0x240 [kernel] /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c:435 0xffffffff8147b0cb : vmw_user_dmabuf_alloc+0x8b/0x120 [kernel] /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c:503 0xffffffff8147b202 : vmw_dmabuf_alloc_ioctl+0x52/0xb0 [kernel] /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c:698 0xffffffff814497a4 : drm_ioctl+0x1a4/0x630 [kernel] /usr/src/linux/drivers/gpu/drm/drm_ioctl.c:727 0xffffffff814773c9 : vmw_generic_ioctl+0x169/0x260 [kernel] /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c:1073 0xffffffff814774f5 : vmw_unlocked_ioctl+0x15/0x20 [kernel] /usr/src/linux/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c:1084 0xffffffff811c7c18 : do_vfs_ioctl+0x2f8/0x510 [kernel] /usr/src/linux/fs/ioctl.c:44 /usr/src/linux/fs/ioctl.c:602 0xffffffff811c7e71 : sys_ioctl+0x41/0x80 [kernel] /usr/src/linux/include/linux/file.h:38 /usr/src/linux/fs/ioctl.c:618 /usr/src/linux/fs/ioctl.c:608 0xffffffff816a6ae9 : system_call_fastpath+0x12/0x17 [kernel] /usr/src/linux/arch/x86/kernel/entry_64.S:423 ---------- Failed memory allocation end ---------- If I skip ttm_tt_destroy() call, this bug no longer occurs. Therefore, I guess that this memory corruption is caused by the destroy function being called with partially initialized ttm object. --- a/drivers/gpu/drm/ttm/ttm_tt.c +++ b/drivers/gpu/drm/ttm/ttm_tt.c @@ -199,8 +199,8 @@ int ttm_tt_init(struct ttm_tt *ttm, struct ttm_bo_device *bdev, ttm_tt_alloc_page_directory(ttm); if (!ttm->pages) { - ttm_tt_destroy(ttm); - pr_err("Failed allocating page table\n"); + //ttm_tt_destroy(ttm); + pr_err("Failed allocating page table, but skip ttm_tt_destroy()\n"); return -ENOMEM; } return 0; I can reproduce this problem at least since 3.13.0. I don't know whether this problem is specific to vmwgfx code or not, for I tested only CentOS 7 with GUI environment on VMware Player 6. I think you can reproduce this problem by starting a SystemTap script shown below and then flipping windows using from Ctrl-Alt-F1 to Ctrl-Alt-F7 . ---------- Reproducer start ---------- # stap -g -e 'global is_target%; probe begin { printf("Probe start!\n"); } probe module("ttm").function("ttm_tt_init") { is_target[tid()] = 1; } probe module("ttm").function("ttm_tt_init").return { is_target[tid()] = 0; } probe kernel.function("__kmalloc") { if (($flags & %{ __GFP_NOFAIL | __GFP_WAIT %} ) == %{ __GFP_WAIT %} && is_target[tid()]) { print_backtrace(); $size = 1 << 30; exit(); } } probe end { delete is_target; }' ---------- Reproducer end ---------- I can also reproduce below problem using 3.10.0-123.9.3.el7.x86_64 , though below problem might be different from above problem. ---------- Crash pattern 4 start ---------- [TTM] Failed allocating page table ------------[ cut here ]------------ WARNING: at lib/list_debug.c:33 __list_add+0xac/0xc0() list_add corruption. prev->next should be next (ffff88007af4cd98), but was (null). (prev=ffff88007ac881f0). Modules linked in: fuse btrfs zlib_deflate raid6_pq xor vfat msdos fat ext4 mbcache jbd2 netconsole ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul ppdev glue_helper vmw_balloon ablk_helper cryptd serio_raw parport_pc i2c_piix4 parport vmw_vmci pcspkr dm_mirror shpchp dm_region_hash dm_log mperf dm_mod nfsd auth_rpcgss nfs_acl lockd sunrpc uinput xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif crct10dif_common ata_generic pata_acpi crc32c_intel vmwgfx mptspi ttm scsi_transport_spi mptscsih ahci ata_piix libahci drm mptbase libata e1000 i2c_core floppy [last unloaded: stap_bad36894e80d53e8ee72ce3ee48a27ac_3394] CPU: 0 PID: 849 Comm: Xorg Tainted: GF W O-------------- 3.10.0-123.9.3.el7.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 ffff88007984da10 00000000da42f7a4 ffff88007984d9c8 ffffffff815e239b ffff88007984da00 ffffffff8105dee1 ffff88007ac881f0 ffff88007af4cd98 ffff88007ac881f0 0000000000000282 ffff88007984db98 ffff88007984da68 Call Trace: [<ffffffff815e239b>] dump_stack+0x19/0x1b [<ffffffff8105dee1>] warn_slowpath_common+0x61/0x80 [<ffffffff8105df5c>] warn_slowpath_fmt+0x5c/0x80 [<ffffffff812cfeec>] __list_add+0xac/0xc0 [<ffffffffa01a56e9>] vmw_fence_create+0xd9/0x130 [vmwgfx] [<ffffffffa0197ef8>] vmw_execbuf_fence_commands+0xc8/0x120 [vmwgfx] [<ffffffffa01987b8>] vmw_execbuf_process+0x4f8/0xbe0 [vmwgfx] [<ffffffff81194585>] ? __kmalloc+0x55/0x230 [<ffffffffa0199af8>] do_dmabuf_dirty_sou.isra.9+0x328/0x3c0 [vmwgfx] [<ffffffffa00da00c>] ? ttm_read_lock+0x2c/0xd0 [ttm] [<ffffffffa00d50a1>] ? ttm_bo_add_to_lru+0x51/0xc0 [ttm] [<ffffffffa0199d50>] vmw_framebuffer_dmabuf_dirty+0x1c0/0x1f0 [vmwgfx] [<ffffffff81194723>] ? __kmalloc+0x1f3/0x230 [<ffffffffa012d3f0>] drm_mode_dirtyfb_ioctl+0xe0/0x190 [drm] [<ffffffffa011cdb2>] drm_ioctl+0x502/0x630 [drm] [<ffffffff815edbb4>] ? __do_page_fault+0x204/0x540 [<ffffffff812c0e64>] ? timerqueue_del+0x24/0x70 [<ffffffff81089486>] ? __remove_hrtimer+0x46/0xa0 [<ffffffffa019ca71>] vmw_unlocked_ioctl+0x51/0x80 [vmwgfx] [<ffffffff811c2b25>] do_vfs_ioctl+0x2e5/0x4c0 [<ffffffff810650d6>] ? do_setitimer+0xe6/0x2a0 [<ffffffff811c2da1>] SyS_ioctl+0xa1/0xc0 [<ffffffff815f2a99>] system_call_fastpath+0x16/0x1b ---[ end trace a993c155f4775b96 ]--- ------------[ cut here ]------------ WARNING: at lib/list_debug.c:36 __list_add+0x8a/0xc0() list_add double add: new=ffff88007ac881f0, prev=ffff88007ac881f0, next=ffff88007af4cd98. Modules linked in: fuse btrfs zlib_deflate raid6_pq xor vfat msdos fat ext4 mbcache jbd2 netconsole ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul ppdev glue_helper vmw_balloon ablk_helper cryptd serio_raw parport_pc i2c_piix4 parport vmw_vmci pcspkr dm_mirror shpchp dm_region_hash dm_log mperf dm_mod nfsd auth_rpcgss nfs_acl lockd sunrpc uinput xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif crct10dif_common ata_generic pata_acpi crc32c_intel vmwgfx mptspi ttm scsi_transport_spi mptscsih ahci ata_piix libahci drm mptbase libata e1000 i2c_core floppy [last unloaded: stap_bad36894e80d53e8ee72ce3ee48a27ac_3394] CPU: 0 PID: 849 Comm: Xorg Tainted: GF W O-------------- 3.10.0-123.9.3.el7.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 ffff88007984da10 00000000da42f7a4 ffff88007984d9c8 ffffffff815e239b ffff88007984da00 ffffffff8105dee1 ffff88007ac881f0 ffff88007af4cd98 ffff88007ac881f0 0000000000000282 ffff88007984db98 ffff88007984da68 Call Trace: [<ffffffff815e239b>] dump_stack+0x19/0x1b [<ffffffff8105dee1>] warn_slowpath_common+0x61/0x80 [<ffffffff8105df5c>] warn_slowpath_fmt+0x5c/0x80 [<ffffffff812cfeca>] __list_add+0x8a/0xc0 [<ffffffffa01a56e9>] vmw_fence_create+0xd9/0x130 [vmwgfx] [<ffffffffa0197ef8>] vmw_execbuf_fence_commands+0xc8/0x120 [vmwgfx] [<ffffffffa01987b8>] vmw_execbuf_process+0x4f8/0xbe0 [vmwgfx] [<ffffffff81194585>] ? __kmalloc+0x55/0x230 [<ffffffffa0199af8>] do_dmabuf_dirty_sou.isra.9+0x328/0x3c0 [vmwgfx] [<ffffffffa00da00c>] ? ttm_read_lock+0x2c/0xd0 [ttm] [<ffffffffa00d50a1>] ? ttm_bo_add_to_lru+0x51/0xc0 [ttm] [<ffffffffa0199d50>] vmw_framebuffer_dmabuf_dirty+0x1c0/0x1f0 [vmwgfx] [<ffffffff81194723>] ? __kmalloc+0x1f3/0x230 [<ffffffffa012d3f0>] drm_mode_dirtyfb_ioctl+0xe0/0x190 [drm] [<ffffffffa011cdb2>] drm_ioctl+0x502/0x630 [drm] [<ffffffff815edbb4>] ? __do_page_fault+0x204/0x540 [<ffffffff812c0e64>] ? timerqueue_del+0x24/0x70 [<ffffffff81089486>] ? __remove_hrtimer+0x46/0xa0 [<ffffffffa019ca71>] vmw_unlocked_ioctl+0x51/0x80 [vmwgfx] [<ffffffff811c2b25>] do_vfs_ioctl+0x2e5/0x4c0 [<ffffffff810650d6>] ? do_setitimer+0xe6/0x2a0 [<ffffffff811c2da1>] SyS_ioctl+0xa1/0xc0 [<ffffffff815f2a99>] system_call_fastpath+0x16/0x1b ---[ end trace a993c155f4775b97 ]--- INFO: rcu_sched detected stalls on CPUs/tasks: { 0} (detected by 1, t=60019 jiffies, g=6722, c=6721, q=0) sending NMI to all CPUs: NMI backtrace for cpu 0 CPU: 0 PID: 849 Comm: Xorg Tainted: GF W O-------------- 3.10.0-123.9.3.el7.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 task: ffff880077655b00 ti: ffff88007984c000 task.ti: ffff88007984c000 RIP: 0010:[<ffffffff8108ece5>] [<ffffffff8108ece5>] __wake_up_common+0x5/0x90 RSP: 0018:ffff88007984d9d0 EFLAGS: 00000046 RAX: 0000000000000046 RBX: ffff88007ac88220 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff88007ac88220 RBP: ffff88007984da00 R08: 0000000000000000 R09: ffff88007f617320 R10: ffffea000173f700 R11: ffffffffa01a462d R12: 0000000000000046 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 00007faaaca78980(0000) GS:ffff88007f600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faaa4b3c000 CR3: 000000007baaf000 CR4: 00000000000407f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Stack: ffffffff81090af9 ffff88007af4cd80 ffff88007ac881e0 ffff88007ac881f0 ffff88007984da48 ffff88007ac881e0 ffff88007984da88 ffffffffa01a524b ffffc90008680018 ffff88007af4cda8 ffff88007af4cdd8 0000000000000292 Call Trace: [<ffffffff81090af9>] ? __wake_up+0x39/0x50 [<ffffffffa01a524b>] vmw_fences_update+0x11b/0x220 [vmwgfx] [<ffffffffa01a2568>] vmw_update_seqno+0x48/0x50 [vmwgfx] [<ffffffffa01a2073>] vmw_fifo_send_fence+0x93/0xe0 [vmwgfx] [<ffffffffa0197e85>] vmw_execbuf_fence_commands+0x55/0x120 [vmwgfx] [<ffffffffa01987b8>] vmw_execbuf_process+0x4f8/0xbe0 [vmwgfx] [<ffffffffa01998d0>] do_dmabuf_dirty_sou.isra.9+0x100/0x3c0 [vmwgfx] [<ffffffffa00da00c>] ? ttm_read_lock+0x2c/0xd0 [ttm] [<ffffffffa00d50a1>] ? ttm_bo_add_to_lru+0x51/0xc0 [ttm] [<ffffffffa0199d50>] vmw_framebuffer_dmabuf_dirty+0x1c0/0x1f0 [vmwgfx] [<ffffffff81194723>] ? __kmalloc+0x1f3/0x230 [<ffffffffa012d3f0>] drm_mode_dirtyfb_ioctl+0xe0/0x190 [drm] [<ffffffffa011cdb2>] drm_ioctl+0x502/0x630 [drm] [<ffffffff815edbb4>] ? __do_page_fault+0x204/0x540 [<ffffffff812c0e64>] ? timerqueue_del+0x24/0x70 [<ffffffff81089486>] ? __remove_hrtimer+0x46/0xa0 [<ffffffffa019ca71>] vmw_unlocked_ioctl+0x51/0x80 [vmwgfx] [<ffffffff811c2b25>] do_vfs_ioctl+0x2e5/0x4c0 [<ffffffff810650d6>] ? do_setitimer+0xe6/0x2a0 [<ffffffff811c2da1>] SyS_ioctl+0xa1/0xc0 [<ffffffff815f2a99>] system_call_fastpath+0x16/0x1b Code: 49 0f af c0 e9 64 ff ff ff 0f 1f 44 00 00 44 8d 4a ff 31 c0 45 31 c0 4d 63 c9 e9 4e ff ff ff 0f 1f 80 00 00 00 00 66 66 66 66 90 <55> 48 89 e5 41 57 41 89 f7 41 56 41 89 ce 41 55 41 54 4c 8d 67 ---------- Crash pattern 4 end ----------

4 3

[Bug 204181] New: NULL pointer dereference regression in amdgpu
by bugzilla-daemon＠bugzilla.kernel.org 26 Jul '20

26 Jul '20

https://bugzilla.kernel.org/show_bug.cgi?id=204181 Bug ID: 204181 Summary: NULL pointer dereference regression in amdgpu Product: Drivers Version: 2.5 Kernel Version: 5.2.1 Hardware: x86-64 OS: Linux Tree: Mainline Status: NEW Severity: high Priority: P1 Component: Video(DRI - non Intel) Assignee: drivers_video-dri(a)kernel-bugs.osdl.org Reporter: virtuousfox(a)gmail.com Regression: No Created attachment 283693 --> https://bugzilla.kernel.org/attachment.cgi?id=283693&action=edit dmesg After updating from 5.1 to 5.2.1 in about 5-10 minutes of watching a Youtube video in Firefox I now get complete lock-up of video output and inability to shutdown using power button. Using "magic keys" allows me to reboot and get kernel log via `journalctl -b -1 -k`, here is relevant part: BUG: kernel NULL pointer dereference, address: 00000000000002b4 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 2 PID: 8200 Comm: kworker/u16:1 Tainted: G IO 5.2.1-1383.gd5bbc26-HSF #1 openSUSE Tumbleweed (unreleased) Hardware name: Gigabyte Technology Co., Ltd. GA-990XA-UD3/GA-990XA-UD3, BIOS F14e 09/09/2014 Workqueue: events_unbound commit_work RIP: 0010:dc_stream_log+0x6/0xb0 [amdgpu] Code: 04 00 00 49 8b bc 02 80 02 00 00 48 8b 07 48 8b 40 50 e8 ed 88 a8 d6 b8 01 00 00 00 c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 53 <8b> 86 b4 02 00 00 48 89 f3 48 89 f2 8b 8e 10 01 00 00 bf 04 00 00 RSP: 0018:ffffa5568b1b7c00 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000002 RDX: ffffffffc07fbd50 RSI: 0000000000000000 RDI: ffff8e9ee9500000 RBP: ffff8e9d90618000 R08: 0000000000000001 R09: 0000000000000000 R10: ffffa5568b1b7c30 R11: 0000000000000000 R12: ffff8e9ee9500000 R13: ffff8e9ededb4448 R14: ffff8e9e47e10c00 R15: ffff8e9ededa0000 FS: 0000000000000000(0000) GS:ffff8e9eee000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000002b4 CR3: 00000003bcf46000 CR4: 00000000000406e0 Call Trace: dc_commit_state+0x79/0xb0 [amdgpu] amdgpu_dm_atomic_commit_tail+0x3c0/0xdb0 [amdgpu] ? finish_task_switch+0x74/0x300 ? __switch_to+0x152/0x4e0 ? __switch_to_asm+0x34/0x70 ? __lock_acquire+0x3c8/0x7a0 ? find_held_lock+0x32/0x90 ? find_held_lock+0x32/0x90 ? sched_clock+0x5/0x10 ? mark_held_locks+0x2d/0x80 ? preempt_count_sub+0x98/0xe0 ? _raw_spin_unlock_irq+0x3a/0x50 ? wait_for_completion_timeout+0xe9/0x110 ? commit_tail+0x3c/0x70 commit_tail+0x3c/0x70 process_one_work+0x271/0x5f0 worker_thread+0x4a/0x3d0 ? process_one_work+0x5f0/0x5f0 kthread+0x118/0x140 ? kthread_create_worker_on_cpu+0x70/0x70 ret_from_fork+0x27/0x50 Modules linked in: af_packet ts_bm xt_pkttype xt_string nf_nat_ftp nf_conntrack_ftp xt_tcpudp ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nfnetlink ebtable_filter ebtables scsi_transport_iscsi ip6table_filter ip6_tables iptable_filter ip_tables x_tables bpfilter snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq zram snd_pcm_oss rfcomm snd_mixer_oss it87 hwmon_vid bnep msr rc_avermedia tuner_simple tuner_types amd64_edac_mod tuner tda7432 edac_mce_amd btusb tvaudio kvm_amd ath9k btrtl btbcm msp3400 ath9k_common btintel bluetooth ath9k_hw kvm irqbypass ath bttv tea575x joydev tveeprom videobuf_dma_sg snd_usb_audio videobuf_core snd_usbmidi_lib rc_core snd_rawmidi snd_hda_codec_realtek mac80211 snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi v4l2_common snd_seq_device snd_hda_intel videodev sp5100_tco pcspkr snd_hda_codec wmi_bmof mxm_wmi amdgpu fam15h_power k10temp media i2c_piix4 cfg80211 r8169 snd_hda_core gpu_sched realtek snd_hwdep libphy ttm rfkill snd_pcm mac_hid hid_generic usbhid uas usb_storage ohci_pci serio_raw sd_mod ehci_pci ohci_hcd xhci_pci ehci_hcd xhci_hcd wmi exfat(O) l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppox ppp_generic slhc vhba(O) uinput sg nbd dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ecryptfs CR2: 00000000000002b4 ---[ end trace 0633d97cb3f2d2d6 ]--- RIP: 0010:dc_stream_log+0x6/0xb0 [amdgpu] Code: 04 00 00 49 8b bc 02 80 02 00 00 48 8b 07 48 8b 40 50 e8 ed 88 a8 d6 b8 01 00 00 00 c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 53 <8b> 86 b4 02 00 00 48 89 f3 48 89 f2 8b 8e 10 01 00 00 bf 04 00 00 RSP: 0018:ffffa5568b1b7c00 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000002 RDX: ffffffffc07fbd50 RSI: 0000000000000000 RDI: ffff8e9ee9500000 RBP: ffff8e9d90618000 R08: 0000000000000001 R09: 0000000000000000 R10: ffffa5568b1b7c30 R11: 0000000000000000 R12: ffff8e9ee9500000 R13: ffff8e9ededb4448 R14: ffff8e9e47e10c00 R15: ffff8e9ededa0000 FS: 0000000000000000(0000) GS:ffff8e9eee000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000002b4 CR3: 00000003bcf46000 CR4: 00000000000406e0 -- You are receiving this mail because: You are watching the assignee of the bug.

1 67

[Bug 199475] New: AMDGPU Failed to blank
by bugzilla-daemon＠bugzilla.kernel.org 20 Jun '20

20 Jun '20

https://bugzilla.kernel.org/show_bug.cgi?id=199475 Bug ID: 199475 Summary: AMDGPU Failed to blank Product: Drivers Version: 2.5 Kernel Version: 4.15.18 Hardware: Other OS: Linux Tree: Mainline Status: NEW Severity: low Priority: P1 Component: Video(DRI - non Intel) Assignee: drivers_video-dri(a)kernel-bugs.osdl.org Reporter: andreassx0(a)gmail.com Regression: No Im getting this error on starup: drm:hwss_wait_for_blank_complete [amdgpu] *ERROR* DC: failed to blank crtc! -- You are receiving this mail because: You are watching the assignee of the bug.

1 9

← Newer
1
2
3
4
5
6
7
...
234
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

dri-devel August 2019