Bug 109161

Summary:	Kernel crash shortly after gnome-shell login - refcount_t: increment on 0; use-after-free
Product:	DRI	Reporter:	Yanko Kaneti <yaneti>
Component:	DRM/AMDgpu	Assignee:	Default DRI bug account <dri-devel>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	medium	CC:	mikhail.v.gavrilov
Version:	unspecified
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:

Description Yanko Kaneti 2018-12-27 12:51:37 UTC

Fedora rawhide
4.21.0-0.rc0.git1.1.fc30.x86_64 ~= linus a5f2bd479f58
....
[   12.777868] [drm] initializing kernel modesetting (POLARIS11 0x1002:0x67EF 0x1682:0x9460 0xCF).
....
[   68.593291] amdgpu 0000:0a:00.0: 0000000038144057 unpin not necessary
[   68.795444] ------------[ cut here ]------------
[   68.800304] refcount_t: increment on 0; use-after-free.
[   68.805649] WARNING: CPU: 12 PID: 1907 at lib/refcount.c:153 refcount_inc_checked+0x26/0x30
[   68.814053] Modules linked in: nfsv3 nfs_acl nfs lockd grace fscache pppoe pppox ppp_synctty ppp_async ppp_generic slhc fuse iptable_mangle xt_CHECKSUM iptable_nat ipt_MASQUERADE nf_nat_ipv4 nf_nat xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables ib_isert iscsi_target_mod ib_srpt target_core_mod ib_srp scsi_transport_srp rpcrdma rdma_ucm ib_iser rdma_cm ib_umad ib_ipoib iw_cm libiscsi ib_cm scsi_transport_iscsi mlx4_ib ib_uverbs ib_core mlx4_en it87 hwmon_vid sunrpc btrfs xor zstd_compress raid6_pq libcrc32c zstd_decompress xxhash vfat fat edac_mce_amd kvm_amd kvm irqbypass pl2303 joydev snd_hda_codec_realtek ftdi_sio snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel snd_hda_codec ppdev snd_hda_core snd_hwdep snd_seq crct10dif_pclmul raid1 snd_seq_device mlx4_core crc32_pclmul snd_pcm wmi_bmof snd_timer ghash_clmulni_intel parport_serial mxm_wmi snd igb parport_pc sp5100_tco devlink soundcore
[   68.814090]  ccp parport k10temp i2c_piix4 atlantic dca gpio_amdpt gpio_generic amdgpu hid_logitech_hidpp chash amd_iommu_v2 gpu_sched i2c_algo_bit ttm drm_kms_helper drm crc32c_intel nvme hid_logitech_dj nvme_core wmi pinctrl_amd i2c_dev
[   68.903020] CPU: 12 PID: 1907 Comm: gnome-shell Not tainted 4.21.0-0.rc0.git1.1.fc30.x86_64 #1
[   68.903021] Hardware name: Gigabyte Technology Co., Ltd. X470 AORUS ULTRA GAMING/X470 AORUS ULTRA GAMING-CF, BIOS F3g 05/10/2018
[   68.903023] RIP: 0010:refcount_inc_checked+0x26/0x30
[   68.903024] Code: 0f 1f 40 00 e8 ab ff ff ff 84 c0 74 01 c3 80 3d 74 62 3b 01 00 75 f6 48 c7 c7 38 32 35 a9 c6 05 64 62 3b 01 01 e8 7e 4d b9 ff <0f> 0b c3 0f 1f 80 00 00 00 00 8b 06 83 f8 ff 74 20 31 c9 39 f8 89
[   68.903025] RSP: 0018:ffffadf1c8b8bb10 EFLAGS: 00010282
[   68.903026] RAX: 0000000000000000 RBX: ffff98d381b58050 RCX: 0000000000000000
[   68.903027] RDX: ffff98d3be7ddc40 RSI: ffff98d3be7d6c28 RDI: ffff98d3be7d6c28
[   68.903028] RBP: ffff98d381b5807c R08: 0000000000000002 R09: 0000000000000000
[   68.903029] R10: 0000000000000000 R11: 0000000000000000 R12: ffff98d3a9fa2d08
[   68.903030] R13: ffff98d381b580f8 R14: ffff98d381b588f8 R15: ffff98d3a9fa3160
[   68.903035] FS:  00007f05a5b04d00(0000) GS:ffff98d3be600000(0000) knlGS:0000000000000000
[   68.903036] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   68.903037] CR2: 00007f0538b3b00c CR3: 00000007f465c000 CR4: 00000000003406e0
[   68.903037] Call Trace:
[   68.903042]  ttm_bo_add_to_lru+0xab/0x160 [ttm]
[   68.903047]  ttm_eu_backoff_reservation+0x4e/0xe0 [ttm]
[   69.044521]  amdgpu_gem_object_close+0xf3/0x1e0 [amdgpu]
[   69.044540]  drm_gem_object_release_handle+0x7b/0xc0 [drm]
[   69.055515]  drm_gem_handle_delete+0x61/0x90 [drm]
[   69.055523]  ? drm_mode_destroy_dumb+0x40/0x40 [drm]
[   69.065443]  drm_ioctl_kernel+0xa9/0xf0 [drm]
[   69.065452]  drm_ioctl+0x201/0x3a0 [drm]
[   69.073783]  ? drm_mode_destroy_dumb+0x40/0x40 [drm]
[   69.073787]  ? sched_clock+0x5/0x10
[   69.082443]  ? sched_clock_cpu+0xc/0xb0
[   69.086349]  ? lockdep_hardirqs_on+0xed/0x180
[   69.086379]  amdgpu_drm_ioctl+0x49/0x80 [amdgpu]
[   69.086384]  do_vfs_ioctl+0xa5/0x6f0
[   69.099131]  ksys_ioctl+0x60/0x90
[   69.099135]  __x64_sys_ioctl+0x16/0x20
[   69.106318]  do_syscall_64+0x60/0x1f0
[   69.110043]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   69.115181] RIP: 0033:0x7f05a965c2fb
[   69.118817] Code: 0f 1e fa 48 8b 05 8d 9b 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5d 9b 0c 00 f7 d8 64 89 01 48
[   69.118818] RSP: 002b:00007ffd2a76dea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   69.118819] RAX: ffffffffffffffda RBX: 00005627173c6080 RCX: 00007f05a965c2fb
[   69.118820] RDX: 00007ffd2a76dee4 RSI: 00000000c00464b4 RDI: 000000000000000b
[   69.118820] RBP: 00007ffd2a76dee4 R08: 0000562717496a20 R09: 0000000000000005
[   69.118821] R10: 0000000000000011 R11: 0000000000000246 R12: 00000000c00464b4
[   69.118824] R13: 000000000000000b R14: 00005627175aba10 R15: 0000000000000007
[   69.181886] irq event stamp: 2263926
[   69.181889] hardirqs last  enabled at (2263925): [<ffffffffa813c59e>] console_unlock+0x45e/0x610
[   69.181892] hardirqs last disabled at (2263926): [<ffffffffa80037e8>] trace_hardirqs_off_thunk+0x1a/0x1c
[   69.204101] softirqs last  enabled at (2263922): [<ffffffffa8e00365>] __do_softirq+0x365/0x47c
[   69.204103] softirqs last disabled at (2263915): [<ffffffffa80c60e9>] irq_exit+0x119/0x120
[   69.204104] ---[ end trace f9abd5c695102e80 ]---
....

Comment 1 Michel Dänzer 2018-12-27 15:20:20 UTC

Probably introduced by https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=674e78acae0dfb4beb56132e41cbae5b60f7d662 , fixed by https://cgit.freedesktop.org/~agd5f/linux/commit/?h=drm-next-4.21-wip&id=77acd1cd912987ffd62dad6a09275a1fb406f0c2 .

Comment 2 Yanko Kaneti 2018-12-27 15:35:03 UTC

I can confirm the fix.

After applying 77acd1cd912987ffd62dad6a09275a1fb406f0c2 on top of linus tip  shell is stable, so far.

Thanks

Comment 3 mikhail.v.gavrilov 2019-01-06 22:06:26 UTC

I am also confirm that patch https://cgit.freedesktop.org/~agd5f/linux/patch/?id=77acd1cd912987ffd62dad6a09275a1fb406f0c2 fix this.

Comment 4 Yanko Kaneti 2019-01-07 07:30:05 UTC

The fix landed on Linus's tree yesterday , so closing

Comment 5 mikhail.v.gavrilov 2019-01-07 08:47:24 UTC

Looks like I hurried to report that all is well.
With prolonged working, hangs still happens.

1)

[24501.462105] general protection fault: 0000 [#1] SMP NOPTI
[24501.462112] CPU: 0 PID: 2147 Comm: gnome-shell Tainted: G        WC        4.21.0-0.rc0.git7.2.fc30.x86_64 #1
[24501.462115] Hardware name: System manufacturer System Product Name/ROG STRIX X470-I GAMING, BIOS 1103 11/16/2018
[24501.462122] RIP: 0010:__memcpy+0x12/0x20
[24501.462125] Code: ff 0f 31 48 c1 e2 20 48 09 c2 48 31 d3 e9 79 ff ff ff 90 90 90 90 90 90 0f 1f 44 00 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 <f3> 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 f3 a4
[24501.462128] RSP: 0018:ffffba514d57fbc8 EFLAGS: 00010246
[24501.462131] RAX: 47ff9014d115ff00 RBX: 00000000d4745000 RCX: 0000000000000200
[24501.462134] RDX: 0000000000000000 RSI: ffff8de714745000 RDI: 47ff9014d115ff00
[24501.462136] RBP: ffff8dee37f1d0b0 R08: ffff8de640000000 R09: 0000000000000000
[24501.462138] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000001000
[24501.462140] R13: 0000000000000000 R14: ffff8dee37f1d0b0 R15: 0000000000000008
[24501.462143] FS:  00007fe6b56dad00(0000) GS:ffff8dee3cc00000(0000) knlGS:0000000000000000
[24501.462146] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[24501.462148] CR2: 00007fe6b429f000 CR3: 000000077fef2000 CR4: 00000000003406f0
[24501.462150] Call Trace:
[24501.462156]  dma_direct_unmap_page+0x7a/0x80
[24501.462165]  ttm_unmap_and_unpopulate_pages+0x10f/0x120 [ttm]
[24501.462173]  ttm_tt_destroy.part.12+0x49/0x50 [ttm]
[24501.462179]  ttm_bo_cleanup_memtype_use+0x2e/0x70 [ttm]
[24501.462186]  ttm_bo_put+0x2bf/0x3f0 [ttm]
[24501.462247]  amdgpu_bo_unref+0x1a/0x30 [amdgpu]
[24501.462301]  amdgpu_gem_object_free+0x33/0x50 [amdgpu]
[24501.462315]  drm_gem_object_release_handle+0x59/0xc0 [drm]
[24501.462325]  drm_gem_handle_delete+0x61/0x90 [drm]
[24501.462336]  ? drm_gem_handle_create+0x40/0x40 [drm]
[24501.462346]  drm_ioctl_kernel+0xa9/0xf0 [drm]
[24501.462357]  drm_ioctl+0x201/0x3a0 [drm]
[24501.462367]  ? drm_gem_handle_create+0x40/0x40 [drm]
[24501.462370]  ? sched_clock+0x5/0x10
[24501.462373]  ? sched_clock_cpu+0xc/0xb0
[24501.462377]  ? lockdep_hardirqs_on+0xed/0x180
[24501.462422]  amdgpu_drm_ioctl+0x49/0x80 [amdgpu]
[24501.462429]  do_vfs_ioctl+0xa5/0x6f0
[24501.462434]  ksys_ioctl+0x60/0x90
[24501.462438]  __x64_sys_ioctl+0x16/0x20
[24501.462442]  do_syscall_64+0x60/0x1f0
[24501.462445]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[24501.462448] RIP: 0033:0x7fe6b92342fb
[24501.462451] Code: 0f 1e fa 48 8b 05 8d 9b 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5d 9b 0c 00 f7 d8 64 89 01 48
[24501.462453] RSP: 002b:00007ffff46ce9f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[24501.462456] RAX: ffffffffffffffda RBX: 000055605e605f70 RCX: 00007fe6b92342fb
[24501.462458] RDX: 00007ffff46cea30 RSI: 0000000040086409 RDI: 000000000000000d
[24501.462461] RBP: 00007ffff46cea30 R08: 0000000000000000 R09: 0000000000000007
[24501.462463] R10: 00000000000000ee R11: 0000000000000246 R12: 0000000040086409
[24501.462465] R13: 000000000000000d R14: 000055605c758b80 R15: 000055605c75f910
[24501.462471] Modules linked in: vhost_net vhost macvtap macvlan tap nls_utf8 isofs fuse rfcomm xt_CHECKSUM ipt_MASQUERADE devlink tun bridge stp llc nf_conntrack_netbios_ns nf_conntrack_broadcast xt_CT ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ip6table_nat nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables cmac bnep sunrpc xfs vfat fat libcrc32c edac_mce_amd kvm_amd kvm arc4 irqbypass uvcvideo videobuf2_vmalloc joydev snd_hda_codec_realtek videobuf2_memops videobuf2_v4l2 r8822be(C) snd_hda_codec_generic videobuf2_common crct10dif_pclmul snd_usb_audio ledtrig_audio crc32_pclmul eeepc_wmi snd_hda_codec_hdmi asus_wmi videodev snd_usbmidi_lib snd_hda_intel snd_rawmidi sparse_keymap video media ghash_clmulni_intel snd_hda_codec wmi_bmof mac80211 snd_hda_core snd_hwdep snd_seq
[24501.462509]  snd_seq_device btusb snd_pcm btrtl btbcm btintel bluetooth snd_timer cfg80211 sp5100_tco snd i2c_piix4 k10temp soundcore ecdh_generic ccp rfkill pcc_cpufreq gpio_amdpt gpio_generic acpi_cpufreq binfmt_misc hid_logitech_hidpp amdgpu hid_logitech_dj chash amd_iommu_v2 gpu_sched ttm drm_kms_helper drm crc32c_intel igb nvme dca i2c_algo_bit nvme_core wmi pinctrl_amd uas usb_storage hid_sony ff_memless
[24501.462539] ---[ end trace 4adc8adf49e40b60 ]---
[24501.462545] RIP: 0010:__memcpy+0x12/0x20
[24501.462548] Code: ff 0f 31 48 c1 e2 20 48 09 c2 48 31 d3 e9 79 ff ff ff 90 90 90 90 90 90 0f 1f 44 00 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 <f3> 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 f3 a4
[24501.462550] RSP: 0018:ffffba514d57fbc8 EFLAGS: 00010246
[24501.462553] RAX: 47ff9014d115ff00 RBX: 00000000d4745000 RCX: 0000000000000200
[24501.462556] RDX: 0000000000000000 RSI: ffff8de714745000 RDI: 47ff9014d115ff00
[24501.462558] RBP: ffff8dee37f1d0b0 R08: ffff8de640000000 R09: 0000000000000000
[24501.462561] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000001000
[24501.462563] R13: 0000000000000000 R14: ffff8dee37f1d0b0 R15: 0000000000000008
[24501.462568] FS:  00007fe6b56dad00(0000) GS:ffff8dee3cc00000(0000) knlGS:0000000000000000
[24501.462571] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[24501.462574] CR2: 00007fe6b429f000 CR3: 000000077fef2000 CR4: 00000000003406f0
[25509.978504] general protection fault: 0000 [#2] SMP NOPTI
[25509.978511] CPU: 11 PID: 2242 Comm: Xwayland:cs0 Tainted: G      D WC        4.21.0-0.rc0.git7.2.fc30.x86_64 #1
[25509.978514] Hardware name: System manufacturer System Product Name/ROG STRIX X470-I GAMING, BIOS 1103 11/16/2018
[25509.978521] RIP: 0010:__memcpy+0x12/0x20
[25509.978524] Code: ff 0f 31 48 c1 e2 20 48 09 c2 48 31 d3 e9 79 ff ff ff 90 90 90 90 90 90 0f 1f 44 00 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 <f3> 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 f3 a4
[25509.978527] RSP: 0018:ffffba514995fbc8 EFLAGS: 00010246
[25509.978530] RAX: 00039ee640000a00 RBX: 00000000d0e00000 RCX: 0000000000040000
[25509.978533] RDX: 0000000000000000 RSI: ffff8de710e00000 RDI: 00039ee640000a00
[25509.978535] RBP: ffff8dee37f1d0b0 R08: ffff8de640000000 R09: 0000000000000000
[25509.978538] R10: 0000000000000000 R11: ffff8dedc06a32c0 R12: 0000000000200000
[25509.978540] R13: 0000000000000000 R14: ffff8dee37f1d0b0 R15: 0000000000000008
[25509.978543] FS:  00007f039b5c3700(0000) GS:ffff8dee3e200000(0000) knlGS:0000000000000000
[25509.978546] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[25509.978548] CR2: 00000ad9d7122000 CR3: 000000077d9b6000 CR4: 00000000003406e0
[25509.978550] Call Trace:
[25509.978556]  dma_direct_unmap_page+0x7a/0x80
[25509.978567]  ttm_unmap_and_unpopulate_pages+0x10f/0x120 [ttm]
[25509.978575]  ttm_tt_destroy.part.12+0x49/0x50 [ttm]
[25509.978582]  ttm_bo_cleanup_memtype_use+0x2e/0x70 [ttm]
[25509.978589]  ttm_bo_put+0x2bf/0x3f0 [ttm]
[25509.978654]  amdgpu_bo_unref+0x1a/0x30 [amdgpu]
[25509.978717]  amdgpu_gem_object_free+0x33/0x50 [amdgpu]
[25509.978734]  drm_gem_object_release_handle+0x59/0xc0 [drm]
[25509.978750]  drm_gem_handle_delete+0x61/0x90 [drm]
[25509.978765]  ? drm_gem_handle_create+0x40/0x40 [drm]
[25509.978781]  drm_ioctl_kernel+0xa9/0xf0 [drm]
[25509.978798]  drm_ioctl+0x201/0x3a0 [drm]
[25509.978814]  ? drm_gem_handle_create+0x40/0x40 [drm]
[25509.978819]  ? __pm_runtime_resume+0x3a/0x90
[25509.978881]  amdgpu_drm_ioctl+0x49/0x80 [amdgpu]
[25509.978886]  do_vfs_ioctl+0xa5/0x6f0
[25509.978892]  ksys_ioctl+0x60/0x90
[25509.978896]  __x64_sys_ioctl+0x16/0x20
[25509.978900]  do_syscall_64+0x60/0x1f0
[25509.978905]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[25509.978908] RIP: 0033:0x7f03a04f22fb
[25509.978911] Code: 0f 1e fa 48 8b 05 8d 9b 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5d 9b 0c 00 f7 d8 64 89 01 48
[25509.978913] RSP: 002b:00007f039b5c2808 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[25509.978917] RAX: ffffffffffffffda RBX: 00005559da5af410 RCX: 00007f03a04f22fb
[25509.978919] RDX: 00007f039b5c2840 RSI: 0000000040086409 RDI: 000000000000000b
[25509.978921] RBP: 00007f039b5c2840 R08: 0000000000000000 R09: 0000000000000007
[25509.978923] R10: 000000000000004c R11: 0000000000000246 R12: 0000000040086409
[25509.978925] R13: 000000000000000b R14: 00005559d939e090 R15: 00005559da5ae170
[25509.978932] Modules linked in: vhost_net vhost macvtap macvlan tap nls_utf8 isofs fuse rfcomm xt_CHECKSUM ipt_MASQUERADE devlink tun bridge stp llc nf_conntrack_netbios_ns nf_conntrack_broadcast xt_CT ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ip6table_nat nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables cmac bnep sunrpc xfs vfat fat libcrc32c edac_mce_amd kvm_amd kvm arc4 irqbypass uvcvideo videobuf2_vmalloc joydev snd_hda_codec_realtek videobuf2_memops videobuf2_v4l2 r8822be(C) snd_hda_codec_generic videobuf2_common crct10dif_pclmul snd_usb_audio ledtrig_audio crc32_pclmul eeepc_wmi snd_hda_codec_hdmi asus_wmi videodev snd_usbmidi_lib snd_hda_intel snd_rawmidi sparse_keymap video media ghash_clmulni_intel snd_hda_codec wmi_bmof mac80211 snd_hda_core snd_hwdep snd_seq
[25509.978974]  snd_seq_device btusb snd_pcm btrtl btbcm btintel bluetooth snd_timer cfg80211 sp5100_tco snd i2c_piix4 k10temp soundcore ecdh_generic ccp rfkill pcc_cpufreq gpio_amdpt gpio_generic acpi_cpufreq binfmt_misc hid_logitech_hidpp amdgpu hid_logitech_dj chash amd_iommu_v2 gpu_sched ttm drm_kms_helper drm crc32c_intel igb nvme dca i2c_algo_bit nvme_core wmi pinctrl_amd uas usb_storage hid_sony ff_memless
[25509.979000] ---[ end trace 4adc8adf49e40b61 ]---
[25509.979004] RIP: 0010:__memcpy+0x12/0x20
[25509.979007] Code: ff 0f 31 48 c1 e2 20 48 09 c2 48 31 d3 e9 79 ff ff ff 90 90 90 90 90 90 0f 1f 44 00 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 <f3> 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 f3 a4
[25509.979010] RSP: 0018:ffffba514d57fbc8 EFLAGS: 00010246
[25509.979013] RAX: 47ff9014d115ff00 RBX: 00000000d4745000 RCX: 0000000000000200
[25509.979015] RDX: 0000000000000000 RSI: ffff8de714745000 RDI: 47ff9014d115ff00
[25509.979017] RBP: ffff8dee37f1d0b0 R08: ffff8de640000000 R09: 0000000000000000
[25509.979019] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000001000
[25509.979021] R13: 0000000000000000 R14: ffff8dee37f1d0b0 R15: 0000000000000008
[25509.979024] FS:  00007f039b5c3700(0000) GS:ffff8dee3e200000(0000) knlGS:0000000000000000
[25509.979027] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[25509.979029] CR2: 00000ad9d7122000 CR3: 000000077d9b6000 CR4: 00000000003406e0



2)

[ 4083.291763] general protection fault: 0000 [#1] SMP NOPTI
[ 4083.291770] CPU: 2 PID: 2254 Comm: Xwayland Tainted: G        WC        4.21.0-0.rc0.git7.2.fc30.x86_64 #1
[ 4083.291772] Hardware name: System manufacturer System Product Name/ROG STRIX X470-I GAMING, BIOS 1103 11/16/2018
[ 4083.291778] RIP: 0010:__memcpy+0x12/0x20
[ 4083.291781] Code: ff 0f 31 48 c1 e2 20 48 09 c2 48 31 d3 e9 79 ff ff ff 90 90 90 90 90 90 0f 1f 44 00 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 <f3> 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 f3 a4
[ 4083.291783] RSP: 0018:ffffa61208f8bbc8 EFLAGS: 00010246
[ 4083.291787] RAX: 63379ce45ccd0020 RBX: 00000000d4663000 RCX: 0000000000000200
[ 4083.291789] RDX: 0000000000000000 RSI: ffff8b8494663000 RDI: 63379ce45ccd0020
[ 4083.291792] RBP: ffff8b8bb7e9e0b0 R08: ffff8b83c0000000 R09: 0000000000000000
[ 4083.291794] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000001000
[ 4083.291796] R13: 0000000000000000 R14: ffff8b8bb7e9e0b0 R15: 0000000000000008
[ 4083.291798] FS:  00007f49061b7a80(0000) GS:ffff8b8bbd000000(0000) knlGS:0000000000000000
[ 4083.291800] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4083.291802] CR2: 00007f30ab4f6000 CR3: 00000007e6056000 CR4: 00000000003406e0
[ 4083.291803] Call Trace:
[ 4083.291808]  dma_direct_unmap_page+0x7a/0x80
[ 4083.291815]  ttm_unmap_and_unpopulate_pages+0x10f/0x120 [ttm]
[ 4083.291821]  ttm_tt_destroy.part.12+0x49/0x50 [ttm]
[ 4083.291825]  ttm_bo_cleanup_memtype_use+0x2e/0x70 [ttm]
[ 4083.291830]  ttm_bo_put+0x2bf/0x3f0 [ttm]
[ 4083.291875]  amdgpu_bo_unref+0x1a/0x30 [amdgpu]
[ 4083.291917]  amdgpu_gem_object_free+0x33/0x50 [amdgpu]
[ 4083.291928]  drm_gem_object_release_handle+0x59/0xc0 [drm]
[ 4083.291939]  drm_gem_handle_delete+0x61/0x90 [drm]
[ 4083.291949]  ? drm_gem_handle_create+0x40/0x40 [drm]
[ 4083.291970]  drm_ioctl_kernel+0xa9/0xf0 [drm]
[ 4083.291991]  drm_ioctl+0x201/0x3a0 [drm]
[ 4083.292002]  ? drm_gem_handle_create+0x40/0x40 [drm]
[ 4083.292006]  ? sched_clock+0x5/0x10
[ 4083.292008]  ? sched_clock_cpu+0xc/0xb0
[ 4083.292012]  ? lockdep_hardirqs_on+0xed/0x180
[ 4083.292052]  amdgpu_drm_ioctl+0x49/0x80 [amdgpu]
[ 4083.292056]  do_vfs_ioctl+0xa5/0x6f0
[ 4083.292060]  ksys_ioctl+0x60/0x90
[ 4083.292063]  __x64_sys_ioctl+0x16/0x20
[ 4083.292066]  do_syscall_64+0x60/0x1f0
[ 4083.292069]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 4083.292071] RIP: 0033:0x7f49068f82fb
[ 4083.292073] Code: 0f 1e fa 48 8b 05 8d 9b 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5d 9b 0c 00 f7 d8 64 89 01 48
[ 4083.292075] RSP: 002b:00007ffff0903d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 4083.292077] RAX: ffffffffffffffda RBX: 000056085ab72ac0 RCX: 00007f49068f82fb
[ 4083.292078] RDX: 00007ffff0903dd0 RSI: 0000000040086409 RDI: 000000000000000b
[ 4083.292079] RBP: 00007ffff0903dd0 R08: 0000000000000000 R09: 0000000000000005
[ 4083.292081] R10: 000000000000004a R11: 0000000000000246 R12: 0000000040086409
[ 4083.292082] R13: 000000000000000b R14: 0000560859b70090 R15: 000056085a9a7fe0
[ 4083.292087] Modules linked in: vhost_net vhost macvtap macvlan tap nls_utf8 isofs fuse rfcomm xt_CHECKSUM ipt_MASQUERADE tun bridge stp llc devlink nf_conntrack_netbios_ns nf_conntrack_broadcast xt_CT ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ip6table_nat nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables cmac bnep sunrpc xfs vfat fat libcrc32c arc4 edac_mce_amd r8822be(C) kvm_amd joydev kvm snd_hda_codec_realtek snd_hda_codec_generic irqbypass ledtrig_audio mac80211 snd_hda_codec_hdmi eeepc_wmi asus_wmi uvcvideo sparse_keymap btusb video btrtl videobuf2_vmalloc snd_hda_intel btbcm videobuf2_memops btintel videobuf2_v4l2 snd_hda_codec snd_usb_audio videobuf2_common bluetooth wmi_bmof videodev snd_hda_core crct10dif_pclmul snd_usbmidi_lib snd_seq snd_hwdep crc32_pclmul media
[ 4083.292115]  snd_rawmidi snd_seq_device cfg80211 ghash_clmulni_intel snd_pcm ecdh_generic k10temp snd_timer sp5100_tco snd i2c_piix4 rfkill soundcore ccp pcc_cpufreq gpio_amdpt gpio_generic acpi_cpufreq binfmt_misc amdgpu hid_logitech_hidpp chash amd_iommu_v2 gpu_sched ttm drm_kms_helper igb crc32c_intel uas drm usb_storage nvme dca hid_logitech_dj i2c_algo_bit nvme_core wmi pinctrl_amd hid_sony ff_memless
[ 4083.292162] ---[ end trace 672909da503f003d ]---
[ 4083.292166] RIP: 0010:__memcpy+0x12/0x20
[ 4083.292168] Code: ff 0f 31 48 c1 e2 20 48 09 c2 48 31 d3 e9 79 ff ff ff 90 90 90 90 90 90 0f 1f 44 00 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 <f3> 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 f3 a4
[ 4083.292171] RSP: 0018:ffffa61208f8bbc8 EFLAGS: 00010246
[ 4083.292173] RAX: 63379ce45ccd0020 RBX: 00000000d4663000 RCX: 0000000000000200
[ 4083.292175] RDX: 0000000000000000 RSI: ffff8b8494663000 RDI: 63379ce45ccd0020
[ 4083.292177] RBP: ffff8b8bb7e9e0b0 R08: ffff8b83c0000000 R09: 0000000000000000
[ 4083.292178] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000001000
[ 4083.292182] R13: 0000000000000000 R14: ffff8b8bb7e9e0b0 R15: 0000000000000008
[ 4083.292185] FS:  00007f49061b7a80(0000) GS:ffff8b8bbd000000(0000) knlGS:0000000000000000
[ 4083.292187] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4083.292188] CR2: 00007f30ab4f6000 CR3: 00000007e6056000 CR4: 00000000003406e0

Comment 6 Yanko Kaneti 2019-01-08 12:01:14 UTC

FWIW I've been running linus rc1+ and after that 5.0.0-0.rc1.git0.1.fc30.x86_64 without having any issues with my Polaris11, where previously the bug triggered in the first minute of use.

Comment 7 Michel Dänzer 2019-01-10 15:29:36 UTC

(In reply to mikhail.v.gavrilov from comment #5)
> Looks like I hurried to report that all is well.
> With prolonged working, hangs still happens.

This looks like a separate issue, see bug 109234 and follow-ups to https://lists.freedesktop.org/archives/dri-devel/2019-January/202909.html .

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.