From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dave Gordon Subject: Re: Kernel Oops on 3.14.66 Date: Wed, 27 Apr 2016 11:03:36 +0100 Message-ID: <57208E78.4070800@intel.com> References: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------020207000105010400080006" Return-path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by gabe.freedesktop.org (Postfix) with ESMTP id 9FF746EA35 for ; Wed, 27 Apr 2016 10:03:38 +0000 (UTC) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" To: intel-gfx@lists.freedesktop.org List-Id: intel-gfx@lists.freedesktop.org This is a multi-part message in MIME format. --------------020207000105010400080006 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On 27/04/16 10:19, Andreas Lampersperger wrote: > Hello, > > has anyone here a hint for me, what can cause this error. > The error occures highly sporadic on different machines with intel hd > graphics (ivb_gt1). > I did also some kernel coredumps and found out, that the failed > paging request came from drm_i915_gem_request->list.prev or ->list.next. > > Thank you > Andreas Try this patch. .Dave. --------------020207000105010400080006 Content-Type: text/x-patch; name="0001-initialise-request-list-head.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="0001-initialise-request-list-head.patch" >>From 6dde6b8b07239c68f32315faffa9d80b6e2d0aec Mon Sep 17 00:00:00 2001 From: Dave Gordon Date: Fri, 22 Apr 2016 19:33:53 +0100 Subject: [PATCH] Request constructor should initialise list head Organization: Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ Users of the Linux kernel linked-list macros should remember that a zeroed "struct list_head" is not a valid list and in particular is not the same as an empty list. ALL list heads MUST be initialised! Without this, any attempt to follow this link (e.g. during teardown) before the request has been put on the list of pending requests (or if is not put on the list, e.g. is cancelled instead) will result in a NULL pointer dereference. Note: the diff below claims this code goes in i915_gem_request_free(), but that's just git's failure to parse the function headers correctly. It obviously belongs in __i915_gem_request_alloc(); it seems to apply correctly despite the incorrect function tag. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93907 ? Signed-off-by: Dave Gordon --- drivers/gpu/drm/i915/i915_gem.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index d493e79..8ce7d4d 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2751,6 +2751,7 @@ void i915_gem_request_free(struct kref *req_ref) if (ret) goto err; + INIT_LIST_HEAD(&req->list); kref_init(&req->ref); req->i915 = dev_priv; req->engine = engine; -- 1.9.1 --------------020207000105010400080006 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KSW50ZWwtZ2Z4 IG1haWxpbmcgbGlzdApJbnRlbC1nZnhAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlz dHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vaW50ZWwtZ2Z4Cg== --------------020207000105010400080006--