Bug 70874 - oopses in i915_gem_free_request()
Summary: oopses in i915_gem_free_request()
Alias: None
Product: DRI
Classification: Unclassified
Component: DRM/Intel (show other bugs)
Version: unspecified
Hardware: x86-64 (AMD64) All
: medium major
Assignee: Intel GFX Bugs mailing list
QA Contact: Intel GFX Bugs mailing list
Depends on:
Reported: 2013-10-25 20:54 UTC by Eric Anholt
Modified: 2017-07-24 22:57 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:

oops output from dmesg (2.35 KB, text/plain)
2013-10-25 20:54 UTC, Eric Anholt
no flags Details
copy of i915.ko in case someone wants to go digging before I reproduce again. (1.05 MB, application/octet-stream)
2013-10-25 20:55 UTC, Eric Anholt
no flags Details
Serialise i915_gem_release() and i915_gem_free_request() (1.54 KB, patch)
2013-10-25 21:36 UTC, Chris Wilson
no flags Details | Splinter Review
gdb log of line numbers for latest oops, for what it's worth. (1.18 KB, text/plain)
2013-10-29 07:54 UTC, Eric Anholt
no flags Details

Description Eric Anholt 2013-10-25 20:54:16 UTC
Created attachment 88124 [details]
oops output from dmesg

Ever since switching to drm-intel-nightly to test some patches a while back, my IVB MBA has been oopsing on a regular basis when running piglit quick.tests in a gnome-shell session.

Oops will be attached, but an excerpt:

[111184.767285] RIP: 0010:[<ffffffffa0014c30>]  [<ffffffffa0014c30>] i915_gem_free_request+0x50/0xc0 [i915]
[111184.767616] Call Trace:
[111184.767639]  [<ffffffffa0015e75>] i915_gem_retire_requests_ring+0x65/0x130 [i915]
[111184.767681]  [<ffffffffa001c5b7>] i915_gem_set_domain_ioctl+0x197/0x250 [i915]
[111184.767718]  [<ffffffff8151da82>] drm_ioctl+0x502/0x630
[111184.767746]  [<ffffffff811c67a1>] ? fsnotify+0x231/0x310
[111184.767774]  [<ffffffff8119b8fd>] do_vfs_ioctl+0x2cd/0x4a0
[111184.767801]  [<ffffffff8119bb51>] SyS_ioctl+0x81/0xa0
[111184.767829]  [<ffffffff81c36ea2>] system_call_fastpath+0x16/0x1b

Apparently at some point my kernel config rotted and lost debugging symbols; I've found the knob to reenable and built a new one so next time I'll be able to get line info.

Kernel commit:
commit 5877608517a5b964433d9e6bba402426ccdc1a41
Author: Kenneth Graunke <kenneth@whitecape.org>
Date:   Mon Oct 14 11:38:40 2013 -0700

    use per-context OACONTROL stuff again.

branchpoint from danvet:
commit aabd627ec77463dc9c064ce2735ef71f48a2ec94
Merge: e4e0241 14c8d11
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Tue Oct 22 00:28:42 2013 +0200

    Merge remote-tracking branch 'drm-upstream/drm-next' into drm-intel-nightly

Note that I was also experiencing this problem without kwg's stuff -- it started when I was trying to get a patch tested for Ben.
Comment 1 Eric Anholt 2013-10-25 20:55:17 UTC
Created attachment 88125 [details]
copy of i915.ko in case someone wants to go digging before I reproduce again.
Comment 2 Chris Wilson 2013-10-25 21:36:08 UTC
Created attachment 88130 [details] [review]
Serialise i915_gem_release() and i915_gem_free_request()
Comment 3 Daniel Vetter 2013-10-27 18:26:01 UTC
Chris, can I intrigue you for an i-g-t testcase to exercise this race?

But nice catch, definite case of bonghits locking here ;-)
Comment 4 Eric Anholt 2013-10-29 07:54:54 UTC
Created attachment 88276 [details]
gdb log of line numbers for latest oops, for what it's worth.

Attached gdb log of trying to list line numbers on my latest oops.  Doesn't look terribly useful.
Comment 5 Chris Wilson 2013-12-13 14:21:29 UTC
commit 0d1430a3f4b7cfd8779b78740a4182321f3ca7f3
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Wed Dec 4 14:52:06 2013 +0000

    drm/i915: Hold mutex across i915_gem_release
    Inorder to serialise the closing of the file descriptor and its
    subsequent release of client requests with i915_gem_free_request(), we
    need to hold the struct_mutex in i915_gem_release(). Failing to do so
    has the potential to trigger an OOPS, later with a use-after-free.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.