Bug 70874

Summary:

oopses in i915_gem_free_request()

Product:

DRI

Reporter:

Eric Anholt <eric>

Component:

DRM/Intel

Assignee:

Intel GFX Bugs mailing list <intel-gfx-bugs>

Status:

CLOSED FIXED

QA Contact:

Intel GFX Bugs mailing list <intel-gfx-bugs>

Severity:

major

Priority:

medium

CC:

intel-gfx-bugs

Version:

unspecified

Hardware:

x86-64 (AMD64)

OS:

All

Whiteboard:

i915 platform:

i915 features:

Attachments:

Description	Flags
oops output from dmesg	none
copy of i915.ko in case someone wants to go digging before I reproduce again.	none
Serialise i915_gem_release() and i915_gem_free_request()	none
gdb log of line numbers for latest oops, for what it's worth.	none

Description Eric Anholt 2013-10-25 20:54:16 UTC

Created attachment 88124 [details]
oops output from dmesg

Ever since switching to drm-intel-nightly to test some patches a while back, my IVB MBA has been oopsing on a regular basis when running piglit quick.tests in a gnome-shell session.

Oops will be attached, but an excerpt:

[111184.767285] RIP: 0010:[<ffffffffa0014c30>]  [<ffffffffa0014c30>] i915_gem_free_request+0x50/0xc0 [i915]
...
[111184.767616] Call Trace:
[111184.767639]  [<ffffffffa0015e75>] i915_gem_retire_requests_ring+0x65/0x130 [i915]
[111184.767681]  [<ffffffffa001c5b7>] i915_gem_set_domain_ioctl+0x197/0x250 [i915]
[111184.767718]  [<ffffffff8151da82>] drm_ioctl+0x502/0x630
[111184.767746]  [<ffffffff811c67a1>] ? fsnotify+0x231/0x310
[111184.767774]  [<ffffffff8119b8fd>] do_vfs_ioctl+0x2cd/0x4a0
[111184.767801]  [<ffffffff8119bb51>] SyS_ioctl+0x81/0xa0
[111184.767829]  [<ffffffff81c36ea2>] system_call_fastpath+0x16/0x1b

Apparently at some point my kernel config rotted and lost debugging symbols; I've found the knob to reenable and built a new one so next time I'll be able to get line info.

Kernel commit:
commit 5877608517a5b964433d9e6bba402426ccdc1a41
Author: Kenneth Graunke <kenneth@whitecape.org>
Date:   Mon Oct 14 11:38:40 2013 -0700

    use per-context OACONTROL stuff again.

branchpoint from danvet:
commit aabd627ec77463dc9c064ce2735ef71f48a2ec94
Merge: e4e0241 14c8d11
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Tue Oct 22 00:28:42 2013 +0200

    Merge remote-tracking branch 'drm-upstream/drm-next' into drm-intel-nightly

Note that I was also experiencing this problem without kwg's stuff -- it started when I was trying to get a patch tested for Ben.

Comment 1 Eric Anholt 2013-10-25 20:55:17 UTC

Created attachment 88125 [details]
copy of i915.ko in case someone wants to go digging before I reproduce again.

Comment 2 Chris Wilson 2013-10-25 21:36:08 UTC

Created attachment 88130 [details] [review]
Serialise i915_gem_release() and i915_gem_free_request()

Comment 3 Daniel Vetter 2013-10-27 18:26:01 UTC

Chris, can I intrigue you for an i-g-t testcase to exercise this race?

But nice catch, definite case of bonghits locking here ;-)

Comment 4 Eric Anholt 2013-10-29 07:54:54 UTC

Created attachment 88276 [details]
gdb log of line numbers for latest oops, for what it's worth.

Attached gdb log of trying to list line numbers on my latest oops.  Doesn't look terribly useful.

Comment 5 Chris Wilson 2013-12-13 14:21:29 UTC

commit 0d1430a3f4b7cfd8779b78740a4182321f3ca7f3
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Wed Dec 4 14:52:06 2013 +0000

    drm/i915: Hold mutex across i915_gem_release
    
    Inorder to serialise the closing of the file descriptor and its
    subsequent release of client requests with i915_gem_free_request(), we
    need to hold the struct_mutex in i915_gem_release(). Failing to do so
    has the potential to trigger an OOPS, later with a use-after-free.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.