Bug 112403 - [CI][SHARDS]igt@gem_pwrite@big-gtt-forwards - dmesg-warn - BUG: Bad page state in process gem_pwrite pfn:490e01
Summary: [CI][SHARDS]igt@gem_pwrite@big-gtt-forwards - dmesg-warn - BUG: Bad page stat...
Status: RESOLVED MOVED
Alias: None
Product: DRI
Classification: Unclassified
Component: DRM/Intel (show other bugs)
Version: DRI git
Hardware: Other All
: not set not set
Assignee: Intel GFX Bugs mailing list
QA Contact: Intel GFX Bugs mailing list
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-11-27 08:30 UTC by Lakshmi
Modified: 2019-11-29 19:52 UTC (History)
1 user (show)

See Also:
i915 platform: ICL
i915 features: GEM/Other

Attachments

Description Lakshmi 2019-11-27 08:30:07 UTC 
https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_7421/shard-iclb7/igt@gem_pwrite@big-gtt-forwards.html

6> [293.416373] Console: switching to colour dummy device 80x25
<6> [293.416415] [IGT] gem_pwrite: executing
<6> [293.422062] [IGT] gem_pwrite: starting subtest big-gtt-forwards
<1> [293.500752] BUG: Bad page state in process gem_pwrite  pfn:490e01
<4> [293.500894] page:ffffea0012438040 refcount:0 mapcount:-65280 mapping:0000000000000000 index:0x0
<4> [293.500896] raw: 8000000000000000 dead000000000100 dead000000000122 0000000000000000
<4> [293.500898] raw: 0000000000000000 0000000000000000 00000000ffff00ff 0000000000000000
<4> [293.500899] page dumped because: nonzero mapcount
<4> [293.500900] Modules linked in: snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic i915 mei_hdcp x86_pkg_temp_thermal coretemp crct10dif_pclmul crc32_pclmul snd_hda_intel snd_intel_dspcfg snd_hda_codec cdc_ether ghash_clmulni_intel snd_hwdep usbnet snd_hda_core mii e1000e snd_pcm ptp pps_core mei_me mei intel_lpss_pci thunderbolt prime_numbers
<4> [293.500913] CPU: 2 PID: 1281 Comm: gem_pwrite Tainted: G     U            5.4.0-rc8-CI-CI_DRM_7421+ #1
<4> [293.500914] Hardware name: Intel Corporation Ice Lake Client Platform/IceLake U DDR4 SODIMM PD RVP, BIOS ICLSFWR1.R00.3234.A01.1906141750 06/14/2019
<4> [293.500915] Call Trace:
<4> [293.500920]  dump_stack+0x71/0x9b
<4> [293.500923]  bad_page+0xc2/0x120
<4> [293.500926]  get_page_from_freelist+0xf9b/0x13e0
<4> [293.500936]  __alloc_pages_nodemask+0x12a/0x330
<4> [293.500940]  __get_free_pages+0xc/0x40
<4> [293.500942]  __sg_alloc_table+0x75/0x160
<4> [293.500984]  ? i915_gem_object_set_to_cpu_domain+0xc1/0x150 [i915]
<4> [293.500987]  sg_alloc_table+0x1f/0x50
<4> [293.500989]  ? sg_pcopy_to_buffer+0x10/0x10
<4> [293.501022]  shmem_get_pages+0xf5/0x710 [i915]
<4> [293.501027]  ? __mutex_lock+0x9a/0x9d0
<4> [293.501029]  ? __mutex_lock+0x396/0x9d0
<4> [293.501062]  ? __i915_gem_object_get_pages+0x1b/0xd0 [i915]
<4> [293.501066]  ? find_held_lock+0x2d/0x90
<4> [293.501096]  ? i915_gem_object_set_to_cpu_domain+0xc1/0x150 [i915]
<4> [293.501127]  ____i915_gem_object_get_pages+0x21/0xb0 [i915]
<4> [293.501157]  __i915_gem_object_get_pages+0x5c/0xd0 [i915]
<4> [293.501188]  i915_gem_set_domain_ioctl+0x376/0x4e0 [i915]
<4> [293.501219]  ? i915_gem_object_set_to_cpu_domain+0x150/0x150 [i915]
<4> [293.501223]  drm_ioctl_kernel+0xa7/0xf0
<4> [293.501227]  drm_ioctl+0x2e1/0x390
<4> [293.501257]  ? i915_gem_object_set_to_cpu_domain+0x150/0x150 [i915]
<4> [293.501262]  ? __lock_acquire+0x460/0x15d0
<4> [293.501267]  do_vfs_ioctl+0xa0/0x6f0
<4> [293.501269]  ? find_held_lock+0x2d/0x90
<4> [293.501272]  ? __task_pid_nr_ns+0xbc/0x1f0
<4> [293.501276]  ksys_ioctl+0x35/0x60
<4> [293.501279]  __x64_sys_ioctl+0x11/0x20
<4> [293.501281]  do_syscall_64+0x4f/0x210
<4> [293.501284]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
<4> [293.501286] RIP: 0033:0x7f01655175d7
<4> [293.501288] Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48
<4> [293.501289] RSP: 002b:00007ffc42ce7cb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
<4> [293.501291] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f01655175d7
<4> [293.501293] RDX: 00007ffc42ce7cfc RSI: 00000000400c645f RDI: 0000000000000005
<4> [293.501294] RBP: 00007ffc42ce7cfc R08: 0000000000000000 R09: 000000000000002b
<4> [293.501295] R10: 0000000000000056 R11: 0000000000000246 R12: 00000000400c645f
<4> [293.501296] R13: 0000000000000005 R14: 0000000100001000 R15: 0000000000000000
<4> [293.501303] Disabling lock debugging due to kernel taint
<1> [293.501379] BUG: Bad page state in process gem_pwrite  pfn:490e03
<4> [293.501387] page:ffffea00124380c0 refcount:0 mapcount:-65280 mapping:0000000000000000 index:0x0
<4> [293.501390] raw: 8000000000000000 dead000000000100 dead000000000122 0000000000000000
<4> [293.501392] raw: 0000000000000000 0000000000000000 00000000ffff00ff 0000000000000000
<4> [293.501393] page dumped because: nonzero mapcount
<4> [293.501395] Modules linked in: snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic i915 mei_hdcp x86_pkg_temp_thermal coretemp crct10dif_pclmul crc32_pclmul snd_hda_intel snd_intel_dspcfg snd_hda_codec cdc_ether ghash_clmulni_intel snd_hwdep usbnet snd_hda_core mii e1000e snd_pcm ptp pps_core mei_me mei intel_lpss_pci thunderbolt prime_numbers
<4> [293.501406] CPU: 2 PID: 1281 Comm: gem_pwrite Tainted: G    BU            5.4.0-rc8-CI-CI_DRM_7421+ #1
<4> [293.501407] Hardware name: Intel Corporation Ice Lake Client Platform/IceLake U DDR4 SODIMM PD RVP, BIOS ICLSFWR1.R00.3234.A01.1906141750 06/14/2019
<4> [293.501407] Call Trace:
<4> [293.501410]  dump_stack+0x71/0x9b
<4> [293.501413]  bad_page+0xc2/0x120
<4> [293.501415]  get_page_from_freelist+0xf9b/0x13e0
<4> [293.501421]  __alloc_pages_nodemask+0x12a/0x330
<4> [293.501425]  __get_free_pages+0xc/0x40
<4> [293.501427]  __sg_alloc_table+0x75/0x160
<4> [293.501481]  ? i915_gem_object_set_to_cpu_domain+0xc1/0x150 [i915]
<4> [293.501486]  sg_alloc_table+0x1f/0x50
<4> [293.501488]  ? sg_pcopy_to_buffer+0x10/0x10
<4> [293.501524]  shmem_get_pages+0xf5/0x710 [i915]
<4> [293.501528]  ? __mutex_lock+0x9a/0x9d0
<4> [293.501530]  ? __mutex_lock+0x396/0x9d0
<4> [293.501566]  ? __i915_gem_object_get_pages+0x1b/0xd0 [i915]
<4> [293.501569]  ? find_held_lock+0x2d/0x90
<4> [293.501602]  ? i915_gem_object_set_to_cpu_domain+0xc1/0x150 [i915]
<4> [293.501635]  ____i915_gem_object_get_pages+0x21/0xb0 [i915]
<4> [293.501664]  __i915_gem_object_get_pages+0x5c/0xd0 [i915]
<4> [293.501692]  i915_gem_set_domain_ioctl+0x376/0x4e0 [i915]
<4> [293.501719]  ? i915_gem_object_set_to_cpu_domain+0x150/0x150 [i915]
<4> [293.501721]  drm_ioctl_kernel+0xa7/0xf0
<4> [293.501724]  drm_ioctl+0x2e1/0x390
<4> [293.501770]  ? i915_gem_object_set_to_cpu_domain+0x150/0x150 [i915]
<4> [293.501773]  ? __lock_acquire+0x460/0x15d0
<4> [293.501776]  do_vfs_ioctl+0xa0/0x6f0
<4> [293.501777]  ? find_held_lock+0x2d/0x90
<4> [293.501779]  ? __task_pid_nr_ns+0xbc/0x1f0
<4> [293.501781]  ksys_ioctl+0x35/0x60
<4> [293.501783]  __x64_sys_ioctl+0x11/0x20
<4> [293.501784]  do_syscall_64+0x4f/0x210
<4> [293.501786]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
<4> [293.501787] RIP: 0033:0x7f01655175d7
<4> [293.501788] Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48
<4> [293.501789] RSP: 002b:00007ffc42ce7cb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
<4> [293.501790] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f01655175d7
<4> [293.501791] RDX: 00007ffc42ce7cfc RSI: 00000000400c645f RDI: 0000000000000005
<4> [293.501791] RBP: 00007ffc42ce7cfc R08: 0000000000000000 R09: 000000000000002b
<4> [293.501792] R10: 0000000000000056 R11: 0000000000000246 R12: 00000000400c645f
<4> [293.501793] R13: 0000000000000005 R14: 0000000100001000 R15: 0000000000000000
<7> [296.119424] [drm:edp_panel_vdd_off_sync [i915]] Turning [ENCODER:214:DDI A] VDD off
<7> [296.119651] [drm:edp_panel_vdd_off_sync [i915]] PP_STATUS: 0x80000008 PP_CONTROL: 0x00000067
<7> [296.119686] [drm:intel_power_well_disable [i915]] disabling DC off
<7> [296.119724] [drm:skl_enable_dc6 [i915]] Enabling DC6
<7> [296.119757] [drm:gen9_set_dc_state [i915]] Setting DC state from 00 to 02
<6> [301.563665] [IGT] gem_pwrite: exiting, ret=0
<5> [301.563869] Setting dangerous option reset - tainting kernel
<6> [301.805824] Console: switching to colour frame buffer device 240x67
Comment 1 CI Bug Log 2019-11-27 08:31:48 UTC 
The CI Bug Log issue associated to this bug has been updated.

### New filters associated

* ICL: igt@gem_pwrite@big-gtt-forwards - dmesg-warn - BUG: Bad page state in process gem_pwrite  pfn:490e01
  - https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_7421/shard-iclb7/igt@gem_pwrite@big-gtt-forwards.html
Comment 2 Chris Wilson 2019-11-27 09:00:04 UTC 
Use-after-free in the page list???? Disturbing.
Comment 3 Martin Peres 2019-11-29 19:52:43 UTC 
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/drm/intel/issues/651.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.