From patchwork Tue Nov 8 20:37:58 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Michael S. Tsirkin" X-Patchwork-Id: 9418111 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id DD9076022E for ; Tue, 8 Nov 2016 20:38:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CFA4C28690 for ; Tue, 8 Nov 2016 20:38:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C47342876B; Tue, 8 Nov 2016 20:38:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id CDDA228690 for ; Tue, 8 Nov 2016 20:38:03 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id E69B66E5C9; Tue, 8 Nov 2016 20:38:01 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by gabe.freedesktop.org (Postfix) with ESMTPS id D23126E5C9 for ; Tue, 8 Nov 2016 20:38:00 +0000 (UTC) Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 2150582C; Tue, 8 Nov 2016 20:38:00 +0000 (UTC) Received: from redhat.com (ovpn-116-67.rdu2.redhat.com [10.10.116.67]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with SMTP id uA8Kbwnu016277; Tue, 8 Nov 2016 15:37:59 -0500 Date: Tue, 8 Nov 2016 22:37:58 +0200 From: "Michael S. Tsirkin" To: Jiri Slaby Subject: Re: BUG: 'list_empty(&vgdev->free_vbufs)' is true! Message-ID: <20161108223153-mutt-send-email-mst@kernel.org> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Tue, 08 Nov 2016 20:38:00 +0000 (UTC) Cc: Gerd Hoffmann , Linux kernel mailing list , dri-devel@lists.freedesktop.org, virtualization@lists.linux-foundation.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP On Mon, Nov 07, 2016 at 09:43:24AM +0100, Jiri Slaby wrote: > Hi, > > I can relatively easily reproduce this bug: > BUG: 'list_empty(&vgdev->free_vbufs)' is true! > ------------[ cut here ]------------ > kernel BUG at /home/latest/linux/drivers/gpu/drm/virtio/virtgpu_vq.c:130! > invalid opcode: 0000 [#1] PREEMPT SMP KASAN > Modules linked in: > CPU: 1 PID: 355 Comm: kworker/1:2 Not tainted 4.9.0-rc2-next-20161028+ #32 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 > Workqueue: events drm_fb_helper_dirty_work > task: ffff88007b124980 task.stack: ffff88007b8a0000 > RIP: 0010:virtio_gpu_get_vbuf+0x32e/0x630 > RSP: 0018:ffff88007b8a78c0 EFLAGS: 00010286 > RAX: 000000000000002e RBX: 1ffff1000f714f1d RCX: 0000000000000000 > RDX: 000000000000002e RSI: 0000000000000001 RDI: ffffed000f714f0e > RBP: ffff88007b8a7970 R08: 0000000000000001 R09: 0000000000000000 > R10: 0000000000000002 R11: 0000000000000001 R12: 0000000000000030 > R13: ffff88007caeaba8 R14: 0000000000000018 R15: ffff88007cae0000 > FS: 0000000000000000(0000) GS:ffff88007dc80000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000601028 CR3: 000000007740d000 CR4: 00000000000006e0 > Call Trace: > Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 bb 01 00 00 4c 89 69 e8 > eb 9e 48 c7 c6 e0 d2 d1 83 48 c7 c7 20 d3 d1 83 e8 6c fb 04 ff <0f> 0b > 48 c7 c7 a0 fb b0 85 e8 09 95 86 ff 48 c7 c6 c0 d3 d1 83 > RIP: virtio_gpu_get_vbuf+0x32e/0x630 RSP: ffff88007b8a78c0 > > > There is no stacktrace, as the kernel starts panicing all over the place > during its generation. Any ideas? > > thanks, CC maintainers. The following might be helpful for debugging - if kernel still will not stop panicing, we are looking at some kind of memory corruption. diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index 5a0f8a7..d5e1e72 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -127,7 +127,11 @@ virtio_gpu_get_vbuf(struct virtio_gpu_device *vgdev, struct virtio_gpu_vbuffer *vbuf; spin_lock(&vgdev->free_vbufs_lock); - BUG_ON(list_empty(&vgdev->free_vbufs)); + WARN_ON(list_empty(&vgdev->free_vbufs)); + if (list_empty(&vgdev->free_vbufs)) { + spin_unlock(&vgdev->free_vbufs_lock); + return ERR_PTR(-EINVAL); + } vbuf = list_first_entry(&vgdev->free_vbufs, struct virtio_gpu_vbuffer, list); list_del(&vbuf->list);