Created attachment 88124 [details] oops output from dmesg Ever since switching to drm-intel-nightly to test some patches a while back, my IVB MBA has been oopsing on a regular basis when running piglit quick.tests in a gnome-shell session. Oops will be attached, but an excerpt: [111184.767285] RIP: 0010:[<ffffffffa0014c30>] [<ffffffffa0014c30>] i915_gem_free_request+0x50/0xc0 [i915] ... [111184.767616] Call Trace: [111184.767639] [<ffffffffa0015e75>] i915_gem_retire_requests_ring+0x65/0x130 [i915] [111184.767681] [<ffffffffa001c5b7>] i915_gem_set_domain_ioctl+0x197/0x250 [i915] [111184.767718] [<ffffffff8151da82>] drm_ioctl+0x502/0x630 [111184.767746] [<ffffffff811c67a1>] ? fsnotify+0x231/0x310 [111184.767774] [<ffffffff8119b8fd>] do_vfs_ioctl+0x2cd/0x4a0 [111184.767801] [<ffffffff8119bb51>] SyS_ioctl+0x81/0xa0 [111184.767829] [<ffffffff81c36ea2>] system_call_fastpath+0x16/0x1b Apparently at some point my kernel config rotted and lost debugging symbols; I've found the knob to reenable and built a new one so next time I'll be able to get line info. Kernel commit: commit 5877608517a5b964433d9e6bba402426ccdc1a41 Author: Kenneth Graunke <kenneth@whitecape.org> Date: Mon Oct 14 11:38:40 2013 -0700 use per-context OACONTROL stuff again. branchpoint from danvet: commit aabd627ec77463dc9c064ce2735ef71f48a2ec94 Merge: e4e0241 14c8d11 Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Tue Oct 22 00:28:42 2013 +0200 Merge remote-tracking branch 'drm-upstream/drm-next' into drm-intel-nightly Note that I was also experiencing this problem without kwg's stuff -- it started when I was trying to get a patch tested for Ben.
Created attachment 88125 [details] copy of i915.ko in case someone wants to go digging before I reproduce again.
Created attachment 88130 [details] [review] Serialise i915_gem_release() and i915_gem_free_request()
Chris, can I intrigue you for an i-g-t testcase to exercise this race? But nice catch, definite case of bonghits locking here ;-)
Created attachment 88276 [details] gdb log of line numbers for latest oops, for what it's worth. Attached gdb log of trying to list line numbers on my latest oops. Doesn't look terribly useful.
commit 0d1430a3f4b7cfd8779b78740a4182321f3ca7f3 Author: Chris Wilson <chris@chris-wilson.co.uk> Date: Wed Dec 4 14:52:06 2013 +0000 drm/i915: Hold mutex across i915_gem_release Inorder to serialise the closing of the file descriptor and its subsequent release of client requests with i915_gem_free_request(), we need to hold the struct_mutex in i915_gem_release(). Failing to do so has the potential to trigger an OOPS, later with a use-after-free.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.