From: Kornel Dulęba <[email protected]> A kernel panic caused by a list corruption was observed when the IPU6 driver is running under heavy load. The panic would reproduce consistently within a few minutes of the test suite running, though never during the same test. The corruption would always happen in list_add_tail called from xe_bo_pin_external:
list_add corruption. prev->next should be next (ffff8bb9862912c8), but was ffff8bb9e811e2a8. (prev=ffff8bb9e811e2a8) Having prev->next == prev, suggests that node was re-initialized without being removed from the list first. This indicates that the BO might have been destroyed while it was still pinned. Looking into xe_ttm_bo_destroy and its caller ttm_bo_release, reveals that the latter supports a case where bo->pin_count > 0, albeit with a WARN_ON_ONCE. Since ttm_bo_release sets bo->pin_count to 0 in that case, add a complementary change to also remove bo->pinned_link from the list. With this applied, the test progresses much further, with the newly added warning seen in dmesg. Test: atest CtsCameraTestCases Signed-off-by: Kornel Dulęba <[email protected]> --- drivers/gpu/drm/xe/xe_bo.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c index f2634d048cd4..c5989db950f7 100644 --- a/drivers/gpu/drm/xe/xe_bo.c +++ b/drivers/gpu/drm/xe/xe_bo.c @@ -1688,6 +1688,11 @@ static void xe_ttm_bo_destroy(struct ttm_buffer_object *ttm_bo) if (bo->parent_obj) xe_bo_put(bo->parent_obj); + spin_lock(&xe->pinned.lock); + if (WARN_ON_ONCE(!list_empty(&bo->pinned_link))) + list_del_init(&bo->pinned_link); + spin_unlock(&xe->pinned.lock); + mutex_lock(&xe->mem_access.vram_userfault.lock); if (!list_empty(&bo->vram_userfault_link)) list_del(&bo->vram_userfault_link); -- 2.34.1
