Re: [BUG 6.3-rc1] Bad lock in ttm_bo_delayed_delete()

[Christian König]

Am 08.03.23 um 03:26 schrieb Steven Rostedt:
> On Tue, 7 Mar 2023 21:22:23 -0500
> Steven Rostedt <rostedt@xxxxxxxxxxx> wrote:
>
> > Looks like there was a lock possibly used after free. But as commit
> > 9bff18d13473a9fdf81d5158248472a9d8ecf2bd ("drm/ttm: use per BO cleanup
> > workers") changed a lot of this code, I figured it may be the culprit.
> If I bothered to look at the second warning after this one (I usually stop
> after the first), it appears to state there was a use after free issue.

Yeah, that looks like the reference count was somehow messed up.

What test case/environment do you run to trigger this?

Thanks for the notice,
Christian.

> [  206.692285] ------------[ cut here ]------------
> [  206.706333] refcount_t: underflow; use-after-free.
> [  206.720577] WARNING: CPU: 0 PID: 332 at lib/refcount.c:28 refcount_warn_saturate+0xb6/0xfc
> [  206.735810] Modules linked in:
> [  206.749493] CPU: 0 PID: 332 Comm: kworker/0:13H Tainted: G        W          6.3.0-rc1-test-00001-ga98bd42762ed-dirty #965
> [  206.765833] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-debian-1.16.0-5 04/01/2014
> [  206.781767] Workqueue: ttm ttm_bo_delayed_delete
> [  206.796500] EIP: refcount_warn_saturate+0xb6/0xfc
> [  206.811121] Code: 68 50 1c 0d cf e8 66 b3 a9 ff 0f 0b 58 c9 c3 90 80 3d 57 c6 38 cf 00 75 8a c6 05 57 c6 38 cf 01 68 7c 1c 0d cf e8 46 b3 a9 ff <0f> 0b 59 c9 c3 80 3d 55 c6 38 cf 00 0f 85 67 ff ff ff c6 05 55 c6
> [  206.844560] EAX: 00000026 EBX: c2d5f150 ECX: c3ae5e40 EDX: 00000002
> [  206.862109] ESI: c2d5f0bc EDI: f6f91200 EBP: c3ae5f18 ESP: c3ae5f14
> [  206.878773] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010246
> [  206.895665] CR0: 80050033 CR2: ff9ff000 CR3: 0f512000 CR4: 00150ef0
> [  206.912303] Call Trace:
> [  206.927940]  ttm_bo_delayed_delete+0x8c/0x94
> [  206.944179]  process_one_work+0x21a/0x538
> [  206.960605]  worker_thread+0x146/0x398
> [  206.976839]  kthread+0xea/0x10c
> [  206.992696]  ? process_one_work+0x538/0x538
> [  207.008827]  ? kthread_complete_and_exit+0x1c/0x1c
> [  207.025150]  ret_from_fork+0x1c/0x28
> [  207.041307] irq event stamp: 4219
> [  207.056883] hardirqs last  enabled at (4219): [<ced2a039>] _raw_spin_unlock_irqrestore+0x2d/0x58
> [  207.074298] hardirqs last disabled at (4218): [<ce1d3a65>] kvfree_call_rcu+0x155/0x2ec
> [  207.091461] softirqs last  enabled at (3570): [<ced2b113>] __do_softirq+0x2f3/0x48b
> [  207.107979] softirqs last disabled at (3565): [<ce0c84e9>] call_on_stack+0x45/0x4c
> [  207.123827] ---[ end trace 0000000000000000 ]---
>
>
> -- Steve