* [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
@ 2026-03-13 15:17 Maarten Lankhorst
2026-03-13 15:17 ` [PATCH v2 1/1] drm: " Maarten Lankhorst
` (15 more replies)
0 siblings, 16 replies; 33+ messages in thread
From: Maarten Lankhorst @ 2026-03-13 15:17 UTC (permalink / raw)
To: dri-devel; +Cc: intel-xe, Maarten Lankhorst
I tried to see what happened with xe_module_unload --r reload on a fully
running system, and came across these bugs in the kernel. Even after
these fixes I still see a hang when reloading, related to cgroups, so
likely some more fixes are needed to address those.
Should this patch have a fixes tag or cc stable patch?
Test-with: https://patchwork.freedesktop.org/series/162133/
Maarten Lankhorst (1):
drm: Fix use-after-free on framebuffers and property blobs when
calling drm_dev_unplug
drivers/gpu/drm/drm_file.c | 5 ++++-
drivers/gpu/drm/drm_mode_config.c | 9 ++++++---
2 files changed, 10 insertions(+), 4 deletions(-)
--
2.51.0
^ permalink raw reply [flat|nested] 33+ messages in thread
* [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
@ 2026-03-13 15:17 ` Maarten Lankhorst
2026-03-17 15:26 ` Thomas Hellström
2026-03-25 17:26 ` Guenter Roeck
2026-03-13 15:29 ` ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev2) Patchwork
` (14 subsequent siblings)
15 siblings, 2 replies; 33+ messages in thread
From: Maarten Lankhorst @ 2026-03-13 15:17 UTC (permalink / raw)
To: dri-devel; +Cc: intel-xe, Maarten Lankhorst, Thomas Hellström
When trying to do a rather aggressive test of igt's "xe_module_load
--r reload" with a full desktop environment and game running I noticed
a few OOPSes when dereferencing freed pointers, related to
framebuffers and property blobs after the compositor exits.
Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
and immediately put the references from struct drm_file objects during
drm_dev_unplug().
Related warnings for framebuffers on the subtest:
[ 739.713076] ------------[ cut here ]------------
WARN_ON(!list_empty(&dev->mode_config.fb_list))
[ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12: xe_module_load/13145
....
[ 739.713328] Call Trace:
[ 739.713330] <TASK>
[ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe]
[ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe]
[ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
[ 739.714041] xe_display_fini_early+0x33/0x50 [xe]
[ 739.714284] devm_action_release+0xf/0x20
[ 739.714294] devres_release_all+0xad/0xf0
[ 739.714301] device_unbind_cleanup+0x12/0xa0
[ 739.714305] device_release_driver_internal+0x1b7/0x210
[ 739.714311] device_driver_detach+0x14/0x20
[ 739.714315] unbind_store+0xa6/0xb0
[ 739.714319] drv_attr_store+0x21/0x30
[ 739.714322] sysfs_kf_write+0x48/0x60
[ 739.714328] kernfs_fop_write_iter+0x16b/0x240
[ 739.714333] vfs_write+0x266/0x520
[ 739.714341] ksys_write+0x72/0xe0
[ 739.714345] __x64_sys_write+0x19/0x20
[ 739.714347] x64_sys_call+0xa15/0xa30
[ 739.714355] do_syscall_64+0xd8/0xab0
[ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53
and
[ 739.714459] ------------[ cut here ]------------
[ 739.714461] xe 0000:67:00.0: [drm] drm_WARN_ON(!list_empty(&fb->filp_head))
[ 739.714464] WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at drm_framebuffer_free+0x6c/0x90 [drm], CPU#12: xe_module_load/13145
[ 739.714715] RIP: 0010:drm_framebuffer_free+0x7a/0x90 [drm]
...
[ 739.714869] Call Trace:
[ 739.714871] <TASK>
[ 739.714876] drm_mode_config_cleanup+0x26a/0x320 [drm]
[ 739.714998] ? __drm_printfn_seq_file+0x20/0x20 [drm]
[ 739.715115] ? drm_mode_config_cleanup+0x207/0x320 [drm]
[ 739.715235] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
[ 739.715576] xe_display_fini_early+0x33/0x50 [xe]
[ 739.715821] devm_action_release+0xf/0x20
[ 739.715828] devres_release_all+0xad/0xf0
[ 739.715843] device_unbind_cleanup+0x12/0xa0
[ 739.715850] device_release_driver_internal+0x1b7/0x210
[ 739.715856] device_driver_detach+0x14/0x20
[ 739.715860] unbind_store+0xa6/0xb0
[ 739.715865] drv_attr_store+0x21/0x30
[ 739.715868] sysfs_kf_write+0x48/0x60
[ 739.715873] kernfs_fop_write_iter+0x16b/0x240
[ 739.715878] vfs_write+0x266/0x520
[ 739.715886] ksys_write+0x72/0xe0
[ 739.715890] __x64_sys_write+0x19/0x20
[ 739.715893] x64_sys_call+0xa15/0xa30
[ 739.715900] do_syscall_64+0xd8/0xab0
[ 739.715905] entry_SYSCALL_64_after_hwframe+0x4b/0x53
and then finally file close blows up:
[ 743.186530] Oops: general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP
[ 743.186535] CPU: 3 UID: 1000 PID: 3453 Comm: kwin_wayland Tainted: G W 7.0.0-rc1-valkyria+ #110 PREEMPT_{RT,(lazy)}
[ 743.186537] Tainted: [W]=WARN
[ 743.186538] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
[ 743.186539] RIP: 0010:drm_framebuffer_cleanup+0x55/0xc0 [drm]
[ 743.186588] Code: d8 72 73 0f b6 42 05 ff c3 39 c3 72 e8 49 8d bd 50 07 00 00 31 f6 e8 3a 80 d3 e1 49 8b 44 24 10 49 8d 7c 24 08 49 8b 54 24 08 <48> 3b 38 0f 85 95 7f 02 00 48 3b 7a 08 0f 85 8b 7f 02 00 48 89 42
[ 743.186589] RSP: 0018:ffffc900085e3cf8 EFLAGS: 00010202
[ 743.186591] RAX: dead000000000122 RBX: 0000000000000001 RCX: ffffffff8217ed03
[ 743.186592] RDX: dead000000000100 RSI: 0000000000000000 RDI: ffff88814675ba08
[ 743.186593] RBP: ffffc900085e3d10 R08: 0000000000000000 R09: 0000000000000000
[ 743.186593] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88814675ba00
[ 743.186594] R13: ffff88810d778000 R14: ffff888119f6dca0 R15: ffff88810c660bb0
[ 743.186595] FS: 00007ff377d21280(0000) GS:ffff888cec3f8000(0000) knlGS:0000000000000000
[ 743.186596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 743.186596] CR2: 000055690b55e000 CR3: 0000000113586003 CR4: 00000000003706f0
[ 743.186597] Call Trace:
[ 743.186598] <TASK>
[ 743.186603] intel_user_framebuffer_destroy+0x12/0x90 [xe]
[ 743.186722] drm_framebuffer_free+0x3a/0x90 [drm]
[ 743.186750] ? trace_hardirqs_on+0x5f/0x120
[ 743.186754] drm_mode_object_put+0x51/0x70 [drm]
[ 743.186786] drm_fb_release+0x105/0x190 [drm]
[ 743.186812] ? rt_mutex_slowunlock+0x3aa/0x410
[ 743.186817] ? rt_spin_lock+0xea/0x1b0
[ 743.186819] drm_file_free+0x1e0/0x2c0 [drm]
[ 743.186843] drm_release_noglobal+0x91/0xf0 [drm]
[ 743.186865] __fput+0x100/0x2e0
[ 743.186869] fput_close_sync+0x40/0xa0
[ 743.186870] __x64_sys_close+0x3e/0x80
[ 743.186873] x64_sys_call+0xa07/0xa30
[ 743.186879] do_syscall_64+0xd8/0xab0
[ 743.186881] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 743.186882] RIP: 0033:0x7ff37e567732
[ 743.186884] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 bf 01 00
[ 743.186885] RSP: 002b:00007ffc818169a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 743.186886] RAX: ffffffffffffffda RBX: 00007ffc81816a30 RCX: 00007ff37e567732
[ 743.186887] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012
[ 743.186888] RBP: 00007ffc818169d0 R08: 0000000000000000 R09: 0000000000000000
[ 743.186889] R10: 0000000000000000 R11: 0000000000000246 R12: 000055d60a7996e0
[ 743.186889] R13: 00007ffc81816a90 R14: 00007ffc81816a90 R15: 000055d60a782a30
[ 743.186892] </TASK>
[ 743.186893] Modules linked in: rfcomm snd_hrtimer xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp xt_addrtype nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep mtd_intel_dg snd_hda_codec_intelhdmi mtd snd_hda_codec_hdmi nls_utf8 mxm_wmi intel_wmi_thunderbolt gigabyte_wmi wmi_bmof xe drm_gpuvm drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video drm_suballoc_helper gpu_sched drm_client_lib drm_exec drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 i2c_mux snd i2c_smbus btusb btrtl btbcm btmtk btintel bluetooth ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink
[ 743.186938] ---[ end trace 0000000000000000 ]---
And for property blobs:
void drm_mode_config_cleanup(struct drm_device *dev)
{
...
list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
head_global) {
drm_property_blob_put(blob);
}
Resulting in:
[ 371.072940] BUG: unable to handle page fault for address: 000001ffffffffff
[ 371.072944] #PF: supervisor read access in kernel mode
[ 371.072945] #PF: error_code(0x0000) - not-present page
[ 371.072947] PGD 0 P4D 0
[ 371.072950] Oops: Oops: 0000 [#1] SMP
[ 371.072953] CPU: 0 UID: 1000 PID: 3693 Comm: kwin_wayland Not tainted 7.0.0-rc1-valkyria+ #111 PREEMPT_{RT,(lazy)}
[ 371.072956] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
[ 371.072957] RIP: 0010:drm_property_destroy_user_blobs+0x3b/0x90 [drm]
[ 371.073019] Code: 00 00 48 83 ec 10 48 8b 86 30 01 00 00 48 39 c3 74 59 48 89 c2 48 8d 48 c8 48 8b 00 4c 8d 60 c8 eb 04 4c 8d 60 c8 48 8b 71 40 <48> 39 16 0f 85 39 32 01 00 48 3b 50 08 0f 85 2f 32 01 00 48 89 70
[ 371.073021] RSP: 0018:ffffc90006a73de8 EFLAGS: 00010293
[ 371.073022] RAX: 000001ffffffffff RBX: ffff888118a1a930 RCX: ffff8881b92355c0
[ 371.073024] RDX: ffff8881b92355f8 RSI: 000001ffffffffff RDI: ffff888118be4000
[ 371.073025] RBP: ffffc90006a73e08 R08: ffff8881009b7300 R09: ffff888cecc5b000
[ 371.073026] R10: ffffc90006a73e90 R11: 0000000000000002 R12: 000001ffffffffc7
[ 371.073027] R13: ffff888118a1a980 R14: ffff88810b366d20 R15: ffff888118a1a970
[ 371.073028] FS: 00007f1faccbb280(0000) GS:ffff888cec2db000(0000) knlGS:0000000000000000
[ 371.073029] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 371.073030] CR2: 000001ffffffffff CR3: 000000010655c001 CR4: 00000000003706f0
[ 371.073031] Call Trace:
[ 371.073033] <TASK>
[ 371.073036] drm_file_free+0x1df/0x2a0 [drm]
[ 371.073077] drm_release_noglobal+0x7a/0xe0 [drm]
[ 371.073113] __fput+0xe2/0x2b0
[ 371.073118] fput_close_sync+0x40/0xa0
[ 371.073119] __x64_sys_close+0x3e/0x80
[ 371.073122] x64_sys_call+0xa07/0xa30
[ 371.073126] do_syscall_64+0xc0/0x840
[ 371.073130] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 371.073132] RIP: 0033:0x7f1fb3501732
[ 371.073133] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 bf 01 00
[ 371.073135] RSP: 002b:00007ffe8e6f0278 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 371.073136] RAX: ffffffffffffffda RBX: 00007ffe8e6f0300 RCX: 00007f1fb3501732
[ 371.073137] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012
[ 371.073138] RBP: 00007ffe8e6f02a0 R08: 0000000000000000 R09: 0000000000000000
[ 371.073139] R10: 0000000000000000 R11: 0000000000000246 R12: 00005585ba46eea0
[ 371.073140] R13: 00007ffe8e6f0360 R14: 00007ffe8e6f0360 R15: 00005585ba458a30
[ 371.073143] </TASK>
[ 371.073144] Modules linked in: rfcomm snd_hrtimer xt_addrtype xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep snd_hda_codec_intelhdmi snd_hda_codec_hdmi mtd_intel_dg mtd nls_utf8 wmi_bmof mxm_wmi gigabyte_wmi intel_wmi_thunderbolt xe drm_gpuvm drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video drm_suballoc_helper gpu_sched drm_client_lib drm_exec drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 btusb i2c_mux i2c_smbus btrtl snd btbcm btmtk btintel bluetooth ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink
[ 371.073198] CR2: 000001ffffffffff
[ 371.073199] ---[ end trace 0000000000000000 ]---
Add a guard around file close, and ensure the warnings from drm_mode_config
do not trigger. Fix those by allowing an open reference to the file descriptor
and cleaning up the file linked list entry in drm_mode_config_cleanup().
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
---
drivers/gpu/drm/drm_file.c | 5 ++++-
drivers/gpu/drm/drm_mode_config.c | 9 ++++++---
2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index ec820686b3021..f52141f842a1f 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -233,6 +233,7 @@ static void drm_events_release(struct drm_file *file_priv)
void drm_file_free(struct drm_file *file)
{
struct drm_device *dev;
+ int idx;
if (!file)
return;
@@ -249,9 +250,11 @@ void drm_file_free(struct drm_file *file)
drm_events_release(file);
- if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+ if (drm_core_check_feature(dev, DRIVER_MODESET) &&
+ drm_dev_enter(dev, &idx)) {
drm_fb_release(file);
drm_property_destroy_user_blobs(dev, file);
+ drm_dev_exit(idx);
}
if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c
index 84ae8a23a3678..e349418978f79 100644
--- a/drivers/gpu/drm/drm_mode_config.c
+++ b/drivers/gpu/drm/drm_mode_config.c
@@ -583,10 +583,13 @@ void drm_mode_config_cleanup(struct drm_device *dev)
*/
WARN_ON(!list_empty(&dev->mode_config.fb_list));
list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
- struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
+ if (list_empty(&fb->filp_head) || drm_framebuffer_read_refcount(fb) > 1) {
+ struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
- drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
- drm_framebuffer_print_info(&p, 1, fb);
+ drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
+ drm_framebuffer_print_info(&p, 1, fb);
+ }
+ list_del_init(&fb->filp_head);
drm_framebuffer_free(&fb->base.refcount);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev2)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
2026-03-13 15:17 ` [PATCH v2 1/1] drm: " Maarten Lankhorst
@ 2026-03-13 15:29 ` Patchwork
2026-03-13 15:30 ` ✓ CI.KUnit: success " Patchwork
` (13 subsequent siblings)
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-13 15:29 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev2)
URL : https://patchwork.freedesktop.org/series/162134/
State : warning
== Summary ==
+ KERNEL=/kernel
+ git clone https://gitlab.freedesktop.org/drm/maintainer-tools mt
Cloning into 'mt'...
warning: redirecting to https://gitlab.freedesktop.org/drm/maintainer-tools.git/
+ git -C mt rev-list -n1 origin/master
1f57ba1afceae32108bd24770069f764d940a0e4
+ cd /kernel
+ git config --global --add safe.directory /kernel
+ git log -n1
commit befcf079e1289e95784d476aeb3951750359c1ac
Author: Maarten Lankhorst <dev@lankhorst.se>
Date: Fri Mar 13 16:17:27 2026 +0100
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
When trying to do a rather aggressive test of igt's "xe_module_load
--r reload" with a full desktop environment and game running I noticed
a few OOPSes when dereferencing freed pointers, related to
framebuffers and property blobs after the compositor exits.
Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
and immediately put the references from struct drm_file objects during
drm_dev_unplug().
Related warnings for framebuffers on the subtest:
[ 739.713076] ------------[ cut here ]------------
WARN_ON(!list_empty(&dev->mode_config.fb_list))
[ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12: xe_module_load/13145
....
[ 739.713328] Call Trace:
[ 739.713330] <TASK>
[ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe]
[ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe]
[ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
[ 739.714041] xe_display_fini_early+0x33/0x50 [xe]
[ 739.714284] devm_action_release+0xf/0x20
[ 739.714294] devres_release_all+0xad/0xf0
[ 739.714301] device_unbind_cleanup+0x12/0xa0
[ 739.714305] device_release_driver_internal+0x1b7/0x210
[ 739.714311] device_driver_detach+0x14/0x20
[ 739.714315] unbind_store+0xa6/0xb0
[ 739.714319] drv_attr_store+0x21/0x30
[ 739.714322] sysfs_kf_write+0x48/0x60
[ 739.714328] kernfs_fop_write_iter+0x16b/0x240
[ 739.714333] vfs_write+0x266/0x520
[ 739.714341] ksys_write+0x72/0xe0
[ 739.714345] __x64_sys_write+0x19/0x20
[ 739.714347] x64_sys_call+0xa15/0xa30
[ 739.714355] do_syscall_64+0xd8/0xab0
[ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53
and
[ 739.714459] ------------[ cut here ]------------
[ 739.714461] xe 0000:67:00.0: [drm] drm_WARN_ON(!list_empty(&fb->filp_head))
[ 739.714464] WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at drm_framebuffer_free+0x6c/0x90 [drm], CPU#12: xe_module_load/13145
[ 739.714715] RIP: 0010:drm_framebuffer_free+0x7a/0x90 [drm]
...
[ 739.714869] Call Trace:
[ 739.714871] <TASK>
[ 739.714876] drm_mode_config_cleanup+0x26a/0x320 [drm]
[ 739.714998] ? __drm_printfn_seq_file+0x20/0x20 [drm]
[ 739.715115] ? drm_mode_config_cleanup+0x207/0x320 [drm]
[ 739.715235] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
[ 739.715576] xe_display_fini_early+0x33/0x50 [xe]
[ 739.715821] devm_action_release+0xf/0x20
[ 739.715828] devres_release_all+0xad/0xf0
[ 739.715843] device_unbind_cleanup+0x12/0xa0
[ 739.715850] device_release_driver_internal+0x1b7/0x210
[ 739.715856] device_driver_detach+0x14/0x20
[ 739.715860] unbind_store+0xa6/0xb0
[ 739.715865] drv_attr_store+0x21/0x30
[ 739.715868] sysfs_kf_write+0x48/0x60
[ 739.715873] kernfs_fop_write_iter+0x16b/0x240
[ 739.715878] vfs_write+0x266/0x520
[ 739.715886] ksys_write+0x72/0xe0
[ 739.715890] __x64_sys_write+0x19/0x20
[ 739.715893] x64_sys_call+0xa15/0xa30
[ 739.715900] do_syscall_64+0xd8/0xab0
[ 739.715905] entry_SYSCALL_64_after_hwframe+0x4b/0x53
and then finally file close blows up:
[ 743.186530] Oops: general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP
[ 743.186535] CPU: 3 UID: 1000 PID: 3453 Comm: kwin_wayland Tainted: G W 7.0.0-rc1-valkyria+ #110 PREEMPT_{RT,(lazy)}
[ 743.186537] Tainted: [W]=WARN
[ 743.186538] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
[ 743.186539] RIP: 0010:drm_framebuffer_cleanup+0x55/0xc0 [drm]
[ 743.186588] Code: d8 72 73 0f b6 42 05 ff c3 39 c3 72 e8 49 8d bd 50 07 00 00 31 f6 e8 3a 80 d3 e1 49 8b 44 24 10 49 8d 7c 24 08 49 8b 54 24 08 <48> 3b 38 0f 85 95 7f 02 00 48 3b 7a 08 0f 85 8b 7f 02 00 48 89 42
[ 743.186589] RSP: 0018:ffffc900085e3cf8 EFLAGS: 00010202
[ 743.186591] RAX: dead000000000122 RBX: 0000000000000001 RCX: ffffffff8217ed03
[ 743.186592] RDX: dead000000000100 RSI: 0000000000000000 RDI: ffff88814675ba08
[ 743.186593] RBP: ffffc900085e3d10 R08: 0000000000000000 R09: 0000000000000000
[ 743.186593] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88814675ba00
[ 743.186594] R13: ffff88810d778000 R14: ffff888119f6dca0 R15: ffff88810c660bb0
[ 743.186595] FS: 00007ff377d21280(0000) GS:ffff888cec3f8000(0000) knlGS:0000000000000000
[ 743.186596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 743.186596] CR2: 000055690b55e000 CR3: 0000000113586003 CR4: 00000000003706f0
[ 743.186597] Call Trace:
[ 743.186598] <TASK>
[ 743.186603] intel_user_framebuffer_destroy+0x12/0x90 [xe]
[ 743.186722] drm_framebuffer_free+0x3a/0x90 [drm]
[ 743.186750] ? trace_hardirqs_on+0x5f/0x120
[ 743.186754] drm_mode_object_put+0x51/0x70 [drm]
[ 743.186786] drm_fb_release+0x105/0x190 [drm]
[ 743.186812] ? rt_mutex_slowunlock+0x3aa/0x410
[ 743.186817] ? rt_spin_lock+0xea/0x1b0
[ 743.186819] drm_file_free+0x1e0/0x2c0 [drm]
[ 743.186843] drm_release_noglobal+0x91/0xf0 [drm]
[ 743.186865] __fput+0x100/0x2e0
[ 743.186869] fput_close_sync+0x40/0xa0
[ 743.186870] __x64_sys_close+0x3e/0x80
[ 743.186873] x64_sys_call+0xa07/0xa30
[ 743.186879] do_syscall_64+0xd8/0xab0
[ 743.186881] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 743.186882] RIP: 0033:0x7ff37e567732
[ 743.186884] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 bf 01 00
[ 743.186885] RSP: 002b:00007ffc818169a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 743.186886] RAX: ffffffffffffffda RBX: 00007ffc81816a30 RCX: 00007ff37e567732
[ 743.186887] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012
[ 743.186888] RBP: 00007ffc818169d0 R08: 0000000000000000 R09: 0000000000000000
[ 743.186889] R10: 0000000000000000 R11: 0000000000000246 R12: 000055d60a7996e0
[ 743.186889] R13: 00007ffc81816a90 R14: 00007ffc81816a90 R15: 000055d60a782a30
[ 743.186892] </TASK>
[ 743.186893] Modules linked in: rfcomm snd_hrtimer xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp xt_addrtype nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep mtd_intel_dg snd_hda_codec_intelhdmi mtd snd_hda_codec_hdmi nls_utf8 mxm_wmi intel_wmi_thunderbolt gigabyte_wmi wmi_bmof xe drm_gpuvm drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video drm_suballoc_helper gpu_sched drm_client_lib drm_exec drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 i2c_mux snd i2c_smbus btusb btrtl btbcm btmtk btintel bluetooth ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink
[ 743.186938] ---[ end trace 0000000000000000 ]---
And for property blobs:
void drm_mode_config_cleanup(struct drm_device *dev)
{
...
list_for_each_entry_safe(blob, bt, &dev->mode_config.property_blob_list,
head_global) {
drm_property_blob_put(blob);
}
Resulting in:
[ 371.072940] BUG: unable to handle page fault for address: 000001ffffffffff
[ 371.072944] #PF: supervisor read access in kernel mode
[ 371.072945] #PF: error_code(0x0000) - not-present page
[ 371.072947] PGD 0 P4D 0
[ 371.072950] Oops: Oops: 0000 [#1] SMP
[ 371.072953] CPU: 0 UID: 1000 PID: 3693 Comm: kwin_wayland Not tainted 7.0.0-rc1-valkyria+ #111 PREEMPT_{RT,(lazy)}
[ 371.072956] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
[ 371.072957] RIP: 0010:drm_property_destroy_user_blobs+0x3b/0x90 [drm]
[ 371.073019] Code: 00 00 48 83 ec 10 48 8b 86 30 01 00 00 48 39 c3 74 59 48 89 c2 48 8d 48 c8 48 8b 00 4c 8d 60 c8 eb 04 4c 8d 60 c8 48 8b 71 40 <48> 39 16 0f 85 39 32 01 00 48 3b 50 08 0f 85 2f 32 01 00 48 89 70
[ 371.073021] RSP: 0018:ffffc90006a73de8 EFLAGS: 00010293
[ 371.073022] RAX: 000001ffffffffff RBX: ffff888118a1a930 RCX: ffff8881b92355c0
[ 371.073024] RDX: ffff8881b92355f8 RSI: 000001ffffffffff RDI: ffff888118be4000
[ 371.073025] RBP: ffffc90006a73e08 R08: ffff8881009b7300 R09: ffff888cecc5b000
[ 371.073026] R10: ffffc90006a73e90 R11: 0000000000000002 R12: 000001ffffffffc7
[ 371.073027] R13: ffff888118a1a980 R14: ffff88810b366d20 R15: ffff888118a1a970
[ 371.073028] FS: 00007f1faccbb280(0000) GS:ffff888cec2db000(0000) knlGS:0000000000000000
[ 371.073029] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 371.073030] CR2: 000001ffffffffff CR3: 000000010655c001 CR4: 00000000003706f0
[ 371.073031] Call Trace:
[ 371.073033] <TASK>
[ 371.073036] drm_file_free+0x1df/0x2a0 [drm]
[ 371.073077] drm_release_noglobal+0x7a/0xe0 [drm]
[ 371.073113] __fput+0xe2/0x2b0
[ 371.073118] fput_close_sync+0x40/0xa0
[ 371.073119] __x64_sys_close+0x3e/0x80
[ 371.073122] x64_sys_call+0xa07/0xa30
[ 371.073126] do_syscall_64+0xc0/0x840
[ 371.073130] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 371.073132] RIP: 0033:0x7f1fb3501732
[ 371.073133] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 bf 01 00
[ 371.073135] RSP: 002b:00007ffe8e6f0278 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 371.073136] RAX: ffffffffffffffda RBX: 00007ffe8e6f0300 RCX: 00007f1fb3501732
[ 371.073137] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012
[ 371.073138] RBP: 00007ffe8e6f02a0 R08: 0000000000000000 R09: 0000000000000000
[ 371.073139] R10: 0000000000000000 R11: 0000000000000246 R12: 00005585ba46eea0
[ 371.073140] R13: 00007ffe8e6f0360 R14: 00007ffe8e6f0360 R15: 00005585ba458a30
[ 371.073143] </TASK>
[ 371.073144] Modules linked in: rfcomm snd_hrtimer xt_addrtype xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep snd_hda_codec_intelhdmi snd_hda_codec_hdmi mtd_intel_dg mtd nls_utf8 wmi_bmof mxm_wmi gigabyte_wmi intel_wmi_thunderbolt xe drm_gpuvm drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video drm_suballoc_helper gpu_sched drm_client_lib drm_exec drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 btusb i2c_mux i2c_smbus btrtl snd btbcm btmtk btintel bluetooth ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink
[ 371.073198] CR2: 000001ffffffffff
[ 371.073199] ---[ end trace 0000000000000000 ]---
Add a guard around file close, and ensure the warnings from drm_mode_config
do not trigger. Fix those by allowing an open reference to the file descriptor
and cleaning up the file linked list entry in drm_mode_config_cleanup().
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
+ /mt/dim checkpatch 45618ec6cfed86e72cf6c2325c8f947bfbe7c132 drm-intel
befcf079e128 drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
-:176: WARNING:COMMIT_LOG_LONG_LINE: Prefer a maximum 75 chars per line (possible unwrapped commit description?)
#176:
do not trigger. Fix those by allowing an open reference to the file descriptor
-:227: WARNING:MISSING_FIXES_TAG: The commit message has 'Call Trace:', perhaps it also needs a 'Fixes:' tag?
total: 0 errors, 2 warnings, 0 checks, 35 lines checked
^ permalink raw reply [flat|nested] 33+ messages in thread
* ✓ CI.KUnit: success for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev2)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
2026-03-13 15:17 ` [PATCH v2 1/1] drm: " Maarten Lankhorst
2026-03-13 15:29 ` ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev2) Patchwork
@ 2026-03-13 15:30 ` Patchwork
2026-03-13 16:09 ` ✓ Xe.CI.BAT: " Patchwork
` (12 subsequent siblings)
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-13 15:30 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev2)
URL : https://patchwork.freedesktop.org/series/162134/
State : success
== Summary ==
+ trap cleanup EXIT
+ /kernel/tools/testing/kunit/kunit.py run --kunitconfig /kernel/drivers/gpu/drm/xe/.kunitconfig
[15:29:11] Configuring KUnit Kernel ...
Generating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[15:29:15] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=25
[15:29:53] Starting KUnit Kernel (1/1)...
[15:29:53] ============================================================
Running tests with:
$ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[15:29:53] ================== guc_buf (11 subtests) ===================
[15:29:53] [PASSED] test_smallest
[15:29:53] [PASSED] test_largest
[15:29:53] [PASSED] test_granular
[15:29:53] [PASSED] test_unique
[15:29:53] [PASSED] test_overlap
[15:29:53] [PASSED] test_reusable
[15:29:53] [PASSED] test_too_big
[15:29:53] [PASSED] test_flush
[15:29:54] [PASSED] test_lookup
[15:29:54] [PASSED] test_data
[15:29:54] [PASSED] test_class
[15:29:54] ===================== [PASSED] guc_buf =====================
[15:29:54] =================== guc_dbm (7 subtests) ===================
[15:29:54] [PASSED] test_empty
[15:29:54] [PASSED] test_default
[15:29:54] ======================== test_size ========================
[15:29:54] [PASSED] 4
[15:29:54] [PASSED] 8
[15:29:54] [PASSED] 32
[15:29:54] [PASSED] 256
[15:29:54] ==================== [PASSED] test_size ====================
[15:29:54] ======================= test_reuse ========================
[15:29:54] [PASSED] 4
[15:29:54] [PASSED] 8
[15:29:54] [PASSED] 32
[15:29:54] [PASSED] 256
[15:29:54] =================== [PASSED] test_reuse ====================
[15:29:54] =================== test_range_overlap ====================
[15:29:54] [PASSED] 4
[15:29:54] [PASSED] 8
[15:29:54] [PASSED] 32
[15:29:54] [PASSED] 256
[15:29:54] =============== [PASSED] test_range_overlap ================
[15:29:54] =================== test_range_compact ====================
[15:29:54] [PASSED] 4
[15:29:54] [PASSED] 8
[15:29:54] [PASSED] 32
[15:29:54] [PASSED] 256
[15:29:54] =============== [PASSED] test_range_compact ================
[15:29:54] ==================== test_range_spare =====================
[15:29:54] [PASSED] 4
[15:29:54] [PASSED] 8
[15:29:54] [PASSED] 32
[15:29:54] [PASSED] 256
[15:29:54] ================ [PASSED] test_range_spare =================
[15:29:54] ===================== [PASSED] guc_dbm =====================
[15:29:54] =================== guc_idm (6 subtests) ===================
[15:29:54] [PASSED] bad_init
[15:29:54] [PASSED] no_init
[15:29:54] [PASSED] init_fini
[15:29:54] [PASSED] check_used
[15:29:54] [PASSED] check_quota
[15:29:54] [PASSED] check_all
[15:29:54] ===================== [PASSED] guc_idm =====================
[15:29:54] ================== no_relay (3 subtests) ===================
[15:29:54] [PASSED] xe_drops_guc2pf_if_not_ready
[15:29:54] [PASSED] xe_drops_guc2vf_if_not_ready
[15:29:54] [PASSED] xe_rejects_send_if_not_ready
[15:29:54] ==================== [PASSED] no_relay =====================
[15:29:54] ================== pf_relay (14 subtests) ==================
[15:29:54] [PASSED] pf_rejects_guc2pf_too_short
[15:29:54] [PASSED] pf_rejects_guc2pf_too_long
[15:29:54] [PASSED] pf_rejects_guc2pf_no_payload
[15:29:54] [PASSED] pf_fails_no_payload
[15:29:54] [PASSED] pf_fails_bad_origin
[15:29:54] [PASSED] pf_fails_bad_type
[15:29:54] [PASSED] pf_txn_reports_error
[15:29:54] [PASSED] pf_txn_sends_pf2guc
[15:29:54] [PASSED] pf_sends_pf2guc
[15:29:54] [SKIPPED] pf_loopback_nop
[15:29:54] [SKIPPED] pf_loopback_echo
[15:29:54] [SKIPPED] pf_loopback_fail
[15:29:54] [SKIPPED] pf_loopback_busy
[15:29:54] [SKIPPED] pf_loopback_retry
[15:29:54] ==================== [PASSED] pf_relay =====================
[15:29:54] ================== vf_relay (3 subtests) ===================
[15:29:54] [PASSED] vf_rejects_guc2vf_too_short
[15:29:54] [PASSED] vf_rejects_guc2vf_too_long
[15:29:54] [PASSED] vf_rejects_guc2vf_no_payload
[15:29:54] ==================== [PASSED] vf_relay =====================
[15:29:54] ================ pf_gt_config (9 subtests) =================
[15:29:54] [PASSED] fair_contexts_1vf
[15:29:54] [PASSED] fair_doorbells_1vf
[15:29:54] [PASSED] fair_ggtt_1vf
[15:29:54] ====================== fair_vram_1vf ======================
[15:29:54] [PASSED] 3.50 GiB
[15:29:54] [PASSED] 11.5 GiB
[15:29:54] [PASSED] 15.5 GiB
[15:29:54] [PASSED] 31.5 GiB
[15:29:54] [PASSED] 63.5 GiB
[15:29:54] [PASSED] 1.91 GiB
[15:29:54] ================== [PASSED] fair_vram_1vf ==================
[15:29:54] ================ fair_vram_1vf_admin_only =================
[15:29:54] [PASSED] 3.50 GiB
[15:29:54] [PASSED] 11.5 GiB
[15:29:54] [PASSED] 15.5 GiB
[15:29:54] [PASSED] 31.5 GiB
[15:29:54] [PASSED] 63.5 GiB
[15:29:54] [PASSED] 1.91 GiB
[15:29:54] ============ [PASSED] fair_vram_1vf_admin_only =============
[15:29:54] ====================== fair_contexts ======================
[15:29:54] [PASSED] 1 VF
[15:29:54] [PASSED] 2 VFs
[15:29:54] [PASSED] 3 VFs
[15:29:54] [PASSED] 4 VFs
[15:29:54] [PASSED] 5 VFs
[15:29:54] [PASSED] 6 VFs
[15:29:54] [PASSED] 7 VFs
[15:29:54] [PASSED] 8 VFs
[15:29:54] [PASSED] 9 VFs
[15:29:54] [PASSED] 10 VFs
[15:29:54] [PASSED] 11 VFs
[15:29:54] [PASSED] 12 VFs
[15:29:54] [PASSED] 13 VFs
[15:29:54] [PASSED] 14 VFs
[15:29:54] [PASSED] 15 VFs
[15:29:54] [PASSED] 16 VFs
[15:29:54] [PASSED] 17 VFs
[15:29:54] [PASSED] 18 VFs
[15:29:54] [PASSED] 19 VFs
[15:29:54] [PASSED] 20 VFs
[15:29:54] [PASSED] 21 VFs
[15:29:54] [PASSED] 22 VFs
[15:29:54] [PASSED] 23 VFs
[15:29:54] [PASSED] 24 VFs
[15:29:54] [PASSED] 25 VFs
[15:29:54] [PASSED] 26 VFs
[15:29:54] [PASSED] 27 VFs
[15:29:54] [PASSED] 28 VFs
[15:29:54] [PASSED] 29 VFs
[15:29:54] [PASSED] 30 VFs
[15:29:54] [PASSED] 31 VFs
[15:29:54] [PASSED] 32 VFs
[15:29:54] [PASSED] 33 VFs
[15:29:54] [PASSED] 34 VFs
[15:29:54] [PASSED] 35 VFs
[15:29:54] [PASSED] 36 VFs
[15:29:54] [PASSED] 37 VFs
[15:29:54] [PASSED] 38 VFs
[15:29:54] [PASSED] 39 VFs
[15:29:54] [PASSED] 40 VFs
[15:29:54] [PASSED] 41 VFs
[15:29:54] [PASSED] 42 VFs
[15:29:54] [PASSED] 43 VFs
[15:29:54] [PASSED] 44 VFs
[15:29:54] [PASSED] 45 VFs
[15:29:54] [PASSED] 46 VFs
[15:29:54] [PASSED] 47 VFs
[15:29:54] [PASSED] 48 VFs
[15:29:54] [PASSED] 49 VFs
[15:29:54] [PASSED] 50 VFs
[15:29:54] [PASSED] 51 VFs
[15:29:54] [PASSED] 52 VFs
[15:29:54] [PASSED] 53 VFs
[15:29:54] [PASSED] 54 VFs
[15:29:54] [PASSED] 55 VFs
[15:29:54] [PASSED] 56 VFs
[15:29:54] [PASSED] 57 VFs
[15:29:54] [PASSED] 58 VFs
[15:29:54] [PASSED] 59 VFs
[15:29:54] [PASSED] 60 VFs
[15:29:54] [PASSED] 61 VFs
[15:29:54] [PASSED] 62 VFs
[15:29:54] [PASSED] 63 VFs
[15:29:54] ================== [PASSED] fair_contexts ==================
[15:29:54] ===================== fair_doorbells ======================
[15:29:54] [PASSED] 1 VF
[15:29:54] [PASSED] 2 VFs
[15:29:54] [PASSED] 3 VFs
[15:29:54] [PASSED] 4 VFs
[15:29:54] [PASSED] 5 VFs
[15:29:54] [PASSED] 6 VFs
[15:29:54] [PASSED] 7 VFs
[15:29:54] [PASSED] 8 VFs
[15:29:54] [PASSED] 9 VFs
[15:29:54] [PASSED] 10 VFs
[15:29:54] [PASSED] 11 VFs
[15:29:54] [PASSED] 12 VFs
[15:29:54] [PASSED] 13 VFs
[15:29:54] [PASSED] 14 VFs
[15:29:54] [PASSED] 15 VFs
[15:29:54] [PASSED] 16 VFs
[15:29:54] [PASSED] 17 VFs
[15:29:54] [PASSED] 18 VFs
[15:29:54] [PASSED] 19 VFs
[15:29:54] [PASSED] 20 VFs
[15:29:54] [PASSED] 21 VFs
[15:29:54] [PASSED] 22 VFs
[15:29:54] [PASSED] 23 VFs
[15:29:54] [PASSED] 24 VFs
[15:29:54] [PASSED] 25 VFs
[15:29:54] [PASSED] 26 VFs
[15:29:54] [PASSED] 27 VFs
[15:29:54] [PASSED] 28 VFs
[15:29:54] [PASSED] 29 VFs
[15:29:54] [PASSED] 30 VFs
[15:29:54] [PASSED] 31 VFs
[15:29:54] [PASSED] 32 VFs
[15:29:54] [PASSED] 33 VFs
[15:29:54] [PASSED] 34 VFs
[15:29:54] [PASSED] 35 VFs
[15:29:54] [PASSED] 36 VFs
[15:29:54] [PASSED] 37 VFs
[15:29:54] [PASSED] 38 VFs
[15:29:54] [PASSED] 39 VFs
[15:29:54] [PASSED] 40 VFs
[15:29:54] [PASSED] 41 VFs
[15:29:54] [PASSED] 42 VFs
[15:29:54] [PASSED] 43 VFs
[15:29:54] [PASSED] 44 VFs
[15:29:54] [PASSED] 45 VFs
[15:29:54] [PASSED] 46 VFs
[15:29:54] [PASSED] 47 VFs
[15:29:54] [PASSED] 48 VFs
[15:29:54] [PASSED] 49 VFs
[15:29:54] [PASSED] 50 VFs
[15:29:54] [PASSED] 51 VFs
[15:29:54] [PASSED] 52 VFs
[15:29:54] [PASSED] 53 VFs
[15:29:54] [PASSED] 54 VFs
[15:29:54] [PASSED] 55 VFs
[15:29:54] [PASSED] 56 VFs
[15:29:54] [PASSED] 57 VFs
[15:29:54] [PASSED] 58 VFs
[15:29:54] [PASSED] 59 VFs
[15:29:54] [PASSED] 60 VFs
[15:29:54] [PASSED] 61 VFs
[15:29:54] [PASSED] 62 VFs
[15:29:54] [PASSED] 63 VFs
[15:29:54] ================= [PASSED] fair_doorbells ==================
[15:29:54] ======================== fair_ggtt ========================
[15:29:54] [PASSED] 1 VF
[15:29:54] [PASSED] 2 VFs
[15:29:54] [PASSED] 3 VFs
[15:29:54] [PASSED] 4 VFs
[15:29:54] [PASSED] 5 VFs
[15:29:54] [PASSED] 6 VFs
[15:29:54] [PASSED] 7 VFs
[15:29:54] [PASSED] 8 VFs
[15:29:54] [PASSED] 9 VFs
[15:29:54] [PASSED] 10 VFs
[15:29:54] [PASSED] 11 VFs
[15:29:54] [PASSED] 12 VFs
[15:29:54] [PASSED] 13 VFs
[15:29:54] [PASSED] 14 VFs
[15:29:54] [PASSED] 15 VFs
[15:29:54] [PASSED] 16 VFs
[15:29:54] [PASSED] 17 VFs
[15:29:54] [PASSED] 18 VFs
[15:29:54] [PASSED] 19 VFs
[15:29:54] [PASSED] 20 VFs
[15:29:54] [PASSED] 21 VFs
[15:29:54] [PASSED] 22 VFs
[15:29:54] [PASSED] 23 VFs
[15:29:54] [PASSED] 24 VFs
[15:29:54] [PASSED] 25 VFs
[15:29:54] [PASSED] 26 VFs
[15:29:54] [PASSED] 27 VFs
[15:29:54] [PASSED] 28 VFs
[15:29:54] [PASSED] 29 VFs
[15:29:54] [PASSED] 30 VFs
[15:29:54] [PASSED] 31 VFs
[15:29:54] [PASSED] 32 VFs
[15:29:54] [PASSED] 33 VFs
[15:29:54] [PASSED] 34 VFs
[15:29:54] [PASSED] 35 VFs
[15:29:54] [PASSED] 36 VFs
[15:29:54] [PASSED] 37 VFs
[15:29:54] [PASSED] 38 VFs
[15:29:54] [PASSED] 39 VFs
[15:29:54] [PASSED] 40 VFs
[15:29:54] [PASSED] 41 VFs
[15:29:54] [PASSED] 42 VFs
[15:29:54] [PASSED] 43 VFs
[15:29:54] [PASSED] 44 VFs
[15:29:54] [PASSED] 45 VFs
[15:29:54] [PASSED] 46 VFs
[15:29:54] [PASSED] 47 VFs
[15:29:54] [PASSED] 48 VFs
[15:29:54] [PASSED] 49 VFs
[15:29:54] [PASSED] 50 VFs
[15:29:54] [PASSED] 51 VFs
[15:29:54] [PASSED] 52 VFs
[15:29:54] [PASSED] 53 VFs
[15:29:54] [PASSED] 54 VFs
[15:29:54] [PASSED] 55 VFs
[15:29:54] [PASSED] 56 VFs
[15:29:54] [PASSED] 57 VFs
[15:29:54] [PASSED] 58 VFs
[15:29:54] [PASSED] 59 VFs
[15:29:54] [PASSED] 60 VFs
[15:29:54] [PASSED] 61 VFs
[15:29:54] [PASSED] 62 VFs
[15:29:54] [PASSED] 63 VFs
[15:29:54] ==================== [PASSED] fair_ggtt ====================
[15:29:54] ======================== fair_vram ========================
[15:29:54] [PASSED] 1 VF
[15:29:54] [PASSED] 2 VFs
[15:29:54] [PASSED] 3 VFs
[15:29:54] [PASSED] 4 VFs
[15:29:54] [PASSED] 5 VFs
[15:29:54] [PASSED] 6 VFs
[15:29:54] [PASSED] 7 VFs
[15:29:54] [PASSED] 8 VFs
[15:29:54] [PASSED] 9 VFs
[15:29:54] [PASSED] 10 VFs
[15:29:54] [PASSED] 11 VFs
[15:29:54] [PASSED] 12 VFs
[15:29:54] [PASSED] 13 VFs
[15:29:54] [PASSED] 14 VFs
[15:29:54] [PASSED] 15 VFs
[15:29:54] [PASSED] 16 VFs
[15:29:54] [PASSED] 17 VFs
[15:29:54] [PASSED] 18 VFs
[15:29:54] [PASSED] 19 VFs
[15:29:54] [PASSED] 20 VFs
[15:29:54] [PASSED] 21 VFs
[15:29:54] [PASSED] 22 VFs
[15:29:54] [PASSED] 23 VFs
[15:29:54] [PASSED] 24 VFs
[15:29:54] [PASSED] 25 VFs
[15:29:54] [PASSED] 26 VFs
[15:29:54] [PASSED] 27 VFs
[15:29:54] [PASSED] 28 VFs
[15:29:54] [PASSED] 29 VFs
[15:29:54] [PASSED] 30 VFs
[15:29:54] [PASSED] 31 VFs
[15:29:54] [PASSED] 32 VFs
[15:29:54] [PASSED] 33 VFs
[15:29:54] [PASSED] 34 VFs
[15:29:54] [PASSED] 35 VFs
[15:29:54] [PASSED] 36 VFs
[15:29:54] [PASSED] 37 VFs
[15:29:54] [PASSED] 38 VFs
[15:29:54] [PASSED] 39 VFs
[15:29:54] [PASSED] 40 VFs
[15:29:54] [PASSED] 41 VFs
[15:29:54] [PASSED] 42 VFs
[15:29:54] [PASSED] 43 VFs
[15:29:54] [PASSED] 44 VFs
[15:29:54] [PASSED] 45 VFs
[15:29:54] [PASSED] 46 VFs
[15:29:54] [PASSED] 47 VFs
[15:29:54] [PASSED] 48 VFs
[15:29:54] [PASSED] 49 VFs
[15:29:54] [PASSED] 50 VFs
[15:29:54] [PASSED] 51 VFs
[15:29:54] [PASSED] 52 VFs
[15:29:54] [PASSED] 53 VFs
[15:29:54] [PASSED] 54 VFs
[15:29:54] [PASSED] 55 VFs
[15:29:54] [PASSED] 56 VFs
[15:29:54] [PASSED] 57 VFs
[15:29:54] [PASSED] 58 VFs
[15:29:54] [PASSED] 59 VFs
[15:29:54] [PASSED] 60 VFs
[15:29:54] [PASSED] 61 VFs
[15:29:54] [PASSED] 62 VFs
[15:29:54] [PASSED] 63 VFs
[15:29:54] ==================== [PASSED] fair_vram ====================
[15:29:54] ================== [PASSED] pf_gt_config ===================
[15:29:54] ===================== lmtt (1 subtest) =====================
[15:29:54] ======================== test_ops =========================
[15:29:54] [PASSED] 2-level
[15:29:54] [PASSED] multi-level
[15:29:54] ==================== [PASSED] test_ops =====================
[15:29:54] ====================== [PASSED] lmtt =======================
[15:29:54] ================= pf_service (11 subtests) =================
[15:29:54] [PASSED] pf_negotiate_any
[15:29:54] [PASSED] pf_negotiate_base_match
[15:29:54] [PASSED] pf_negotiate_base_newer
[15:29:54] [PASSED] pf_negotiate_base_next
[15:29:54] [SKIPPED] pf_negotiate_base_older
[15:29:54] [PASSED] pf_negotiate_base_prev
[15:29:54] [PASSED] pf_negotiate_latest_match
[15:29:54] [PASSED] pf_negotiate_latest_newer
[15:29:54] [PASSED] pf_negotiate_latest_next
[15:29:54] [SKIPPED] pf_negotiate_latest_older
[15:29:54] [SKIPPED] pf_negotiate_latest_prev
[15:29:54] =================== [PASSED] pf_service ====================
[15:29:54] ================= xe_guc_g2g (2 subtests) ==================
[15:29:54] ============== xe_live_guc_g2g_kunit_default ==============
[15:29:54] ========= [SKIPPED] xe_live_guc_g2g_kunit_default ==========
[15:29:54] ============== xe_live_guc_g2g_kunit_allmem ===============
[15:29:54] ========== [SKIPPED] xe_live_guc_g2g_kunit_allmem ==========
[15:29:54] =================== [SKIPPED] xe_guc_g2g ===================
[15:29:54] =================== xe_mocs (2 subtests) ===================
[15:29:54] ================ xe_live_mocs_kernel_kunit ================
[15:29:54] =========== [SKIPPED] xe_live_mocs_kernel_kunit ============
[15:29:54] ================ xe_live_mocs_reset_kunit =================
[15:29:54] ============ [SKIPPED] xe_live_mocs_reset_kunit ============
[15:29:54] ==================== [SKIPPED] xe_mocs =====================
[15:29:54] ================= xe_migrate (2 subtests) ==================
[15:29:54] ================= xe_migrate_sanity_kunit =================
[15:29:54] ============ [SKIPPED] xe_migrate_sanity_kunit =============
[15:29:54] ================== xe_validate_ccs_kunit ==================
[15:29:54] ============= [SKIPPED] xe_validate_ccs_kunit ==============
[15:29:54] =================== [SKIPPED] xe_migrate ===================
[15:29:54] ================== xe_dma_buf (1 subtest) ==================
[15:29:54] ==================== xe_dma_buf_kunit =====================
[15:29:54] ================ [SKIPPED] xe_dma_buf_kunit ================
[15:29:54] =================== [SKIPPED] xe_dma_buf ===================
[15:29:54] ================= xe_bo_shrink (1 subtest) =================
[15:29:54] =================== xe_bo_shrink_kunit ====================
[15:29:54] =============== [SKIPPED] xe_bo_shrink_kunit ===============
[15:29:54] ================== [SKIPPED] xe_bo_shrink ==================
[15:29:54] ==================== xe_bo (2 subtests) ====================
[15:29:54] ================== xe_ccs_migrate_kunit ===================
[15:29:54] ============== [SKIPPED] xe_ccs_migrate_kunit ==============
[15:29:54] ==================== xe_bo_evict_kunit ====================
[15:29:54] =============== [SKIPPED] xe_bo_evict_kunit ================
[15:29:54] ===================== [SKIPPED] xe_bo ======================
[15:29:54] ==================== args (13 subtests) ====================
[15:29:54] [PASSED] count_args_test
[15:29:54] [PASSED] call_args_example
[15:29:54] [PASSED] call_args_test
[15:29:54] [PASSED] drop_first_arg_example
[15:29:54] [PASSED] drop_first_arg_test
[15:29:54] [PASSED] first_arg_example
[15:29:54] [PASSED] first_arg_test
[15:29:54] [PASSED] last_arg_example
[15:29:54] [PASSED] last_arg_test
[15:29:54] [PASSED] pick_arg_example
[15:29:54] [PASSED] if_args_example
[15:29:54] [PASSED] if_args_test
[15:29:54] [PASSED] sep_comma_example
[15:29:54] ====================== [PASSED] args =======================
[15:29:54] =================== xe_pci (3 subtests) ====================
[15:29:54] ==================== check_graphics_ip ====================
[15:29:54] [PASSED] 12.00 Xe_LP
[15:29:54] [PASSED] 12.10 Xe_LP+
[15:29:54] [PASSED] 12.55 Xe_HPG
[15:29:54] [PASSED] 12.60 Xe_HPC
[15:29:54] [PASSED] 12.70 Xe_LPG
[15:29:54] [PASSED] 12.71 Xe_LPG
[15:29:54] [PASSED] 12.74 Xe_LPG+
[15:29:54] [PASSED] 20.01 Xe2_HPG
[15:29:54] [PASSED] 20.02 Xe2_HPG
[15:29:54] [PASSED] 20.04 Xe2_LPG
[15:29:54] [PASSED] 30.00 Xe3_LPG
[15:29:54] [PASSED] 30.01 Xe3_LPG
[15:29:54] [PASSED] 30.03 Xe3_LPG
[15:29:54] [PASSED] 30.04 Xe3_LPG
[15:29:54] [PASSED] 30.05 Xe3_LPG
[15:29:54] [PASSED] 35.10 Xe3p_LPG
[15:29:54] [PASSED] 35.11 Xe3p_XPC
[15:29:54] ================ [PASSED] check_graphics_ip ================
[15:29:54] ===================== check_media_ip ======================
[15:29:54] [PASSED] 12.00 Xe_M
[15:29:54] [PASSED] 12.55 Xe_HPM
[15:29:54] [PASSED] 13.00 Xe_LPM+
[15:29:54] [PASSED] 13.01 Xe2_HPM
[15:29:54] [PASSED] 20.00 Xe2_LPM
[15:29:54] [PASSED] 30.00 Xe3_LPM
[15:29:54] [PASSED] 30.02 Xe3_LPM
[15:29:54] [PASSED] 35.00 Xe3p_LPM
[15:29:54] [PASSED] 35.03 Xe3p_HPM
[15:29:54] ================= [PASSED] check_media_ip ==================
[15:29:54] =================== check_platform_desc ===================
[15:29:54] [PASSED] 0x9A60 (TIGERLAKE)
[15:29:54] [PASSED] 0x9A68 (TIGERLAKE)
[15:29:54] [PASSED] 0x9A70 (TIGERLAKE)
[15:29:54] [PASSED] 0x9A40 (TIGERLAKE)
[15:29:54] [PASSED] 0x9A49 (TIGERLAKE)
[15:29:54] [PASSED] 0x9A59 (TIGERLAKE)
[15:29:54] [PASSED] 0x9A78 (TIGERLAKE)
[15:29:54] [PASSED] 0x9AC0 (TIGERLAKE)
[15:29:54] [PASSED] 0x9AC9 (TIGERLAKE)
[15:29:54] [PASSED] 0x9AD9 (TIGERLAKE)
[15:29:54] [PASSED] 0x9AF8 (TIGERLAKE)
[15:29:54] [PASSED] 0x4C80 (ROCKETLAKE)
[15:29:54] [PASSED] 0x4C8A (ROCKETLAKE)
[15:29:54] [PASSED] 0x4C8B (ROCKETLAKE)
[15:29:54] [PASSED] 0x4C8C (ROCKETLAKE)
[15:29:54] [PASSED] 0x4C90 (ROCKETLAKE)
[15:29:54] [PASSED] 0x4C9A (ROCKETLAKE)
[15:29:54] [PASSED] 0x4680 (ALDERLAKE_S)
[15:29:54] [PASSED] 0x4682 (ALDERLAKE_S)
[15:29:54] [PASSED] 0x4688 (ALDERLAKE_S)
[15:29:54] [PASSED] 0x468A (ALDERLAKE_S)
[15:29:54] [PASSED] 0x468B (ALDERLAKE_S)
[15:29:54] [PASSED] 0x4690 (ALDERLAKE_S)
[15:29:54] [PASSED] 0x4692 (ALDERLAKE_S)
[15:29:54] [PASSED] 0x4693 (ALDERLAKE_S)
[15:29:54] [PASSED] 0x46A0 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46A1 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46A2 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46A3 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46A6 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46A8 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46AA (ALDERLAKE_P)
[15:29:54] [PASSED] 0x462A (ALDERLAKE_P)
[15:29:54] [PASSED] 0x4626 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x4628 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46B0 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46B1 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46B2 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46B3 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46C0 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46C1 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46C2 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46C3 (ALDERLAKE_P)
[15:29:54] [PASSED] 0x46D0 (ALDERLAKE_N)
[15:29:54] [PASSED] 0x46D1 (ALDERLAKE_N)
[15:29:54] [PASSED] 0x46D2 (ALDERLAKE_N)
[15:29:54] [PASSED] 0x46D3 (ALDERLAKE_N)
[15:29:54] [PASSED] 0x46D4 (ALDERLAKE_N)
[15:29:54] [PASSED] 0xA721 (ALDERLAKE_P)
[15:29:54] [PASSED] 0xA7A1 (ALDERLAKE_P)
[15:29:54] [PASSED] 0xA7A9 (ALDERLAKE_P)
[15:29:54] [PASSED] 0xA7AC (ALDERLAKE_P)
[15:29:54] [PASSED] 0xA7AD (ALDERLAKE_P)
[15:29:54] [PASSED] 0xA720 (ALDERLAKE_P)
[15:29:54] [PASSED] 0xA7A0 (ALDERLAKE_P)
[15:29:54] [PASSED] 0xA7A8 (ALDERLAKE_P)
[15:29:54] [PASSED] 0xA7AA (ALDERLAKE_P)
[15:29:54] [PASSED] 0xA7AB (ALDERLAKE_P)
[15:29:54] [PASSED] 0xA780 (ALDERLAKE_S)
[15:29:54] [PASSED] 0xA781 (ALDERLAKE_S)
[15:29:54] [PASSED] 0xA782 (ALDERLAKE_S)
[15:29:54] [PASSED] 0xA783 (ALDERLAKE_S)
[15:29:54] [PASSED] 0xA788 (ALDERLAKE_S)
[15:29:54] [PASSED] 0xA789 (ALDERLAKE_S)
[15:29:54] [PASSED] 0xA78A (ALDERLAKE_S)
[15:29:54] [PASSED] 0xA78B (ALDERLAKE_S)
[15:29:54] [PASSED] 0x4905 (DG1)
[15:29:54] [PASSED] 0x4906 (DG1)
[15:29:54] [PASSED] 0x4907 (DG1)
[15:29:54] [PASSED] 0x4908 (DG1)
[15:29:54] [PASSED] 0x4909 (DG1)
[15:29:54] [PASSED] 0x56C0 (DG2)
[15:29:54] [PASSED] 0x56C2 (DG2)
[15:29:54] [PASSED] 0x56C1 (DG2)
[15:29:54] [PASSED] 0x7D51 (METEORLAKE)
[15:29:54] [PASSED] 0x7DD1 (METEORLAKE)
[15:29:54] [PASSED] 0x7D41 (METEORLAKE)
[15:29:54] [PASSED] 0x7D67 (METEORLAKE)
[15:29:54] [PASSED] 0xB640 (METEORLAKE)
[15:29:54] [PASSED] 0x56A0 (DG2)
[15:29:54] [PASSED] 0x56A1 (DG2)
[15:29:54] [PASSED] 0x56A2 (DG2)
[15:29:54] [PASSED] 0x56BE (DG2)
[15:29:54] [PASSED] 0x56BF (DG2)
[15:29:54] [PASSED] 0x5690 (DG2)
[15:29:54] [PASSED] 0x5691 (DG2)
[15:29:54] [PASSED] 0x5692 (DG2)
[15:29:54] [PASSED] 0x56A5 (DG2)
[15:29:54] [PASSED] 0x56A6 (DG2)
[15:29:54] [PASSED] 0x56B0 (DG2)
[15:29:54] [PASSED] 0x56B1 (DG2)
[15:29:54] [PASSED] 0x56BA (DG2)
[15:29:54] [PASSED] 0x56BB (DG2)
[15:29:54] [PASSED] 0x56BC (DG2)
[15:29:54] [PASSED] 0x56BD (DG2)
[15:29:54] [PASSED] 0x5693 (DG2)
[15:29:54] [PASSED] 0x5694 (DG2)
[15:29:54] [PASSED] 0x5695 (DG2)
[15:29:54] [PASSED] 0x56A3 (DG2)
[15:29:54] [PASSED] 0x56A4 (DG2)
[15:29:54] [PASSED] 0x56B2 (DG2)
[15:29:54] [PASSED] 0x56B3 (DG2)
[15:29:54] [PASSED] 0x5696 (DG2)
[15:29:54] [PASSED] 0x5697 (DG2)
[15:29:54] [PASSED] 0xB69 (PVC)
[15:29:54] [PASSED] 0xB6E (PVC)
[15:29:54] [PASSED] 0xBD4 (PVC)
[15:29:54] [PASSED] 0xBD5 (PVC)
[15:29:54] [PASSED] 0xBD6 (PVC)
[15:29:54] [PASSED] 0xBD7 (PVC)
[15:29:54] [PASSED] 0xBD8 (PVC)
[15:29:54] [PASSED] 0xBD9 (PVC)
[15:29:54] [PASSED] 0xBDA (PVC)
[15:29:54] [PASSED] 0xBDB (PVC)
[15:29:54] [PASSED] 0xBE0 (PVC)
[15:29:54] [PASSED] 0xBE1 (PVC)
[15:29:54] [PASSED] 0xBE5 (PVC)
[15:29:54] [PASSED] 0x7D40 (METEORLAKE)
[15:29:54] [PASSED] 0x7D45 (METEORLAKE)
[15:29:54] [PASSED] 0x7D55 (METEORLAKE)
[15:29:54] [PASSED] 0x7D60 (METEORLAKE)
[15:29:54] [PASSED] 0x7DD5 (METEORLAKE)
[15:29:54] [PASSED] 0x6420 (LUNARLAKE)
[15:29:54] [PASSED] 0x64A0 (LUNARLAKE)
[15:29:54] [PASSED] 0x64B0 (LUNARLAKE)
[15:29:54] [PASSED] 0xE202 (BATTLEMAGE)
[15:29:54] [PASSED] 0xE209 (BATTLEMAGE)
[15:29:54] [PASSED] 0xE20B (BATTLEMAGE)
[15:29:54] [PASSED] 0xE20C (BATTLEMAGE)
[15:29:54] [PASSED] 0xE20D (BATTLEMAGE)
[15:29:54] [PASSED] 0xE210 (BATTLEMAGE)
[15:29:54] [PASSED] 0xE211 (BATTLEMAGE)
[15:29:54] [PASSED] 0xE212 (BATTLEMAGE)
[15:29:54] [PASSED] 0xE216 (BATTLEMAGE)
[15:29:54] [PASSED] 0xE220 (BATTLEMAGE)
[15:29:54] [PASSED] 0xE221 (BATTLEMAGE)
[15:29:54] [PASSED] 0xE222 (BATTLEMAGE)
[15:29:54] [PASSED] 0xE223 (BATTLEMAGE)
[15:29:54] [PASSED] 0xB080 (PANTHERLAKE)
[15:29:54] [PASSED] 0xB081 (PANTHERLAKE)
[15:29:54] [PASSED] 0xB082 (PANTHERLAKE)
[15:29:54] [PASSED] 0xB083 (PANTHERLAKE)
[15:29:54] [PASSED] 0xB084 (PANTHERLAKE)
[15:29:54] [PASSED] 0xB085 (PANTHERLAKE)
[15:29:54] [PASSED] 0xB086 (PANTHERLAKE)
[15:29:54] [PASSED] 0xB087 (PANTHERLAKE)
[15:29:54] [PASSED] 0xB08F (PANTHERLAKE)
[15:29:54] [PASSED] 0xB090 (PANTHERLAKE)
[15:29:54] [PASSED] 0xB0A0 (PANTHERLAKE)
[15:29:54] [PASSED] 0xB0B0 (PANTHERLAKE)
[15:29:54] [PASSED] 0xFD80 (PANTHERLAKE)
[15:29:54] [PASSED] 0xFD81 (PANTHERLAKE)
[15:29:54] [PASSED] 0xD740 (NOVALAKE_S)
[15:29:54] [PASSED] 0xD741 (NOVALAKE_S)
[15:29:54] [PASSED] 0xD742 (NOVALAKE_S)
[15:29:54] [PASSED] 0xD743 (NOVALAKE_S)
[15:29:54] [PASSED] 0xD744 (NOVALAKE_S)
[15:29:54] [PASSED] 0xD745 (NOVALAKE_S)
[15:29:54] [PASSED] 0x674C (CRESCENTISLAND)
[15:29:54] [PASSED] 0xD750 (NOVALAKE_P)
[15:29:54] [PASSED] 0xD751 (NOVALAKE_P)
[15:29:54] [PASSED] 0xD752 (NOVALAKE_P)
[15:29:54] [PASSED] 0xD753 (NOVALAKE_P)
[15:29:54] [PASSED] 0xD754 (NOVALAKE_P)
[15:29:54] [PASSED] 0xD755 (NOVALAKE_P)
[15:29:54] [PASSED] 0xD756 (NOVALAKE_P)
[15:29:54] [PASSED] 0xD757 (NOVALAKE_P)
[15:29:54] [PASSED] 0xD75F (NOVALAKE_P)
[15:29:54] =============== [PASSED] check_platform_desc ===============
[15:29:54] ===================== [PASSED] xe_pci ======================
[15:29:54] =================== xe_rtp (2 subtests) ====================
[15:29:54] =============== xe_rtp_process_to_sr_tests ================
[15:29:54] [PASSED] coalesce-same-reg
[15:29:54] [PASSED] no-match-no-add
[15:29:54] [PASSED] match-or
[15:29:54] [PASSED] match-or-xfail
[15:29:54] [PASSED] no-match-no-add-multiple-rules
[15:29:54] [PASSED] two-regs-two-entries
[15:29:54] [PASSED] clr-one-set-other
[15:29:54] [PASSED] set-field
[15:29:54] [PASSED] conflict-duplicate
stty: 'standard input': Inappropriate ioctl for device
[15:29:54] [PASSED] conflict-not-disjoint
[15:29:54] [PASSED] conflict-reg-type
[15:29:54] =========== [PASSED] xe_rtp_process_to_sr_tests ============
[15:29:54] ================== xe_rtp_process_tests ===================
[15:29:54] [PASSED] active1
[15:29:54] [PASSED] active2
[15:29:54] [PASSED] active-inactive
[15:29:54] [PASSED] inactive-active
[15:29:54] [PASSED] inactive-1st_or_active-inactive
[15:29:54] [PASSED] inactive-2nd_or_active-inactive
[15:29:54] [PASSED] inactive-last_or_active-inactive
[15:29:54] [PASSED] inactive-no_or_active-inactive
[15:29:54] ============== [PASSED] xe_rtp_process_tests ===============
[15:29:54] ===================== [PASSED] xe_rtp ======================
[15:29:54] ==================== xe_wa (1 subtest) =====================
[15:29:54] ======================== xe_wa_gt =========================
[15:29:54] [PASSED] TIGERLAKE B0
[15:29:54] [PASSED] DG1 A0
[15:29:54] [PASSED] DG1 B0
[15:29:54] [PASSED] ALDERLAKE_S A0
[15:29:54] [PASSED] ALDERLAKE_S B0
[15:29:54] [PASSED] ALDERLAKE_S C0
[15:29:54] [PASSED] ALDERLAKE_S D0
[15:29:54] [PASSED] ALDERLAKE_P A0
[15:29:54] [PASSED] ALDERLAKE_P B0
[15:29:54] [PASSED] ALDERLAKE_P C0
[15:29:54] [PASSED] ALDERLAKE_S RPLS D0
[15:29:54] [PASSED] ALDERLAKE_P RPLU E0
[15:29:54] [PASSED] DG2 G10 C0
[15:29:54] [PASSED] DG2 G11 B1
[15:29:54] [PASSED] DG2 G12 A1
[15:29:54] [PASSED] METEORLAKE 12.70(Xe_LPG) A0 13.00(Xe_LPM+) A0
[15:29:54] [PASSED] METEORLAKE 12.71(Xe_LPG) A0 13.00(Xe_LPM+) A0
[15:29:54] [PASSED] METEORLAKE 12.74(Xe_LPG+) A0 13.00(Xe_LPM+) A0
[15:29:54] [PASSED] LUNARLAKE 20.04(Xe2_LPG) A0 20.00(Xe2_LPM) A0
[15:29:54] [PASSED] LUNARLAKE 20.04(Xe2_LPG) B0 20.00(Xe2_LPM) A0
[15:29:54] [PASSED] BATTLEMAGE 20.01(Xe2_HPG) A0 13.01(Xe2_HPM) A1
[15:29:54] [PASSED] PANTHERLAKE 30.00(Xe3_LPG) A0 30.00(Xe3_LPM) A0
[15:29:54] ==================== [PASSED] xe_wa_gt =====================
[15:29:54] ====================== [PASSED] xe_wa ======================
[15:29:54] ============================================================
[15:29:54] Testing complete. Ran 597 tests: passed: 579, skipped: 18
[15:29:54] Elapsed time: 42.987s total, 4.346s configuring, 37.973s building, 0.635s running
+ /kernel/tools/testing/kunit/kunit.py run --kunitconfig /kernel/drivers/gpu/drm/tests/.kunitconfig
[15:29:54] Configuring KUnit Kernel ...
Regenerating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[15:29:56] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=25
[15:30:25] Starting KUnit Kernel (1/1)...
[15:30:25] ============================================================
Running tests with:
$ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[15:30:25] ============ drm_test_pick_cmdline (2 subtests) ============
[15:30:25] [PASSED] drm_test_pick_cmdline_res_1920_1080_60
[15:30:25] =============== drm_test_pick_cmdline_named ===============
[15:30:25] [PASSED] NTSC
[15:30:25] [PASSED] NTSC-J
[15:30:25] [PASSED] PAL
[15:30:25] [PASSED] PAL-M
[15:30:25] =========== [PASSED] drm_test_pick_cmdline_named ===========
[15:30:25] ============== [PASSED] drm_test_pick_cmdline ==============
[15:30:25] == drm_test_atomic_get_connector_for_encoder (1 subtest) ===
[15:30:25] [PASSED] drm_test_drm_atomic_get_connector_for_encoder
[15:30:25] ==== [PASSED] drm_test_atomic_get_connector_for_encoder ====
[15:30:25] =========== drm_validate_clone_mode (2 subtests) ===========
[15:30:25] ============== drm_test_check_in_clone_mode ===============
[15:30:25] [PASSED] in_clone_mode
[15:30:25] [PASSED] not_in_clone_mode
[15:30:25] ========== [PASSED] drm_test_check_in_clone_mode ===========
[15:30:25] =============== drm_test_check_valid_clones ===============
[15:30:25] [PASSED] not_in_clone_mode
[15:30:25] [PASSED] valid_clone
[15:30:25] [PASSED] invalid_clone
[15:30:25] =========== [PASSED] drm_test_check_valid_clones ===========
[15:30:25] ============= [PASSED] drm_validate_clone_mode =============
[15:30:25] ============= drm_validate_modeset (1 subtest) =============
[15:30:25] [PASSED] drm_test_check_connector_changed_modeset
[15:30:25] ============== [PASSED] drm_validate_modeset ===============
[15:30:25] ====== drm_test_bridge_get_current_state (2 subtests) ======
[15:30:25] [PASSED] drm_test_drm_bridge_get_current_state_atomic
[15:30:25] [PASSED] drm_test_drm_bridge_get_current_state_legacy
[15:30:25] ======== [PASSED] drm_test_bridge_get_current_state ========
[15:30:25] ====== drm_test_bridge_helper_reset_crtc (3 subtests) ======
[15:30:25] [PASSED] drm_test_drm_bridge_helper_reset_crtc_atomic
[15:30:25] [PASSED] drm_test_drm_bridge_helper_reset_crtc_atomic_disabled
[15:30:25] [PASSED] drm_test_drm_bridge_helper_reset_crtc_legacy
[15:30:25] ======== [PASSED] drm_test_bridge_helper_reset_crtc ========
[15:30:25] ============== drm_bridge_alloc (2 subtests) ===============
[15:30:25] [PASSED] drm_test_drm_bridge_alloc_basic
[15:30:25] [PASSED] drm_test_drm_bridge_alloc_get_put
[15:30:25] ================ [PASSED] drm_bridge_alloc =================
[15:30:25] ============= drm_cmdline_parser (40 subtests) =============
[15:30:25] [PASSED] drm_test_cmdline_force_d_only
[15:30:25] [PASSED] drm_test_cmdline_force_D_only_dvi
[15:30:25] [PASSED] drm_test_cmdline_force_D_only_hdmi
[15:30:25] [PASSED] drm_test_cmdline_force_D_only_not_digital
[15:30:25] [PASSED] drm_test_cmdline_force_e_only
[15:30:25] [PASSED] drm_test_cmdline_res
[15:30:25] [PASSED] drm_test_cmdline_res_vesa
[15:30:25] [PASSED] drm_test_cmdline_res_vesa_rblank
[15:30:25] [PASSED] drm_test_cmdline_res_rblank
[15:30:25] [PASSED] drm_test_cmdline_res_bpp
[15:30:25] [PASSED] drm_test_cmdline_res_refresh
[15:30:25] [PASSED] drm_test_cmdline_res_bpp_refresh
[15:30:25] [PASSED] drm_test_cmdline_res_bpp_refresh_interlaced
[15:30:25] [PASSED] drm_test_cmdline_res_bpp_refresh_margins
[15:30:25] [PASSED] drm_test_cmdline_res_bpp_refresh_force_off
[15:30:25] [PASSED] drm_test_cmdline_res_bpp_refresh_force_on
[15:30:25] [PASSED] drm_test_cmdline_res_bpp_refresh_force_on_analog
[15:30:25] [PASSED] drm_test_cmdline_res_bpp_refresh_force_on_digital
[15:30:25] [PASSED] drm_test_cmdline_res_bpp_refresh_interlaced_margins_force_on
[15:30:25] [PASSED] drm_test_cmdline_res_margins_force_on
[15:30:25] [PASSED] drm_test_cmdline_res_vesa_margins
[15:30:25] [PASSED] drm_test_cmdline_name
[15:30:25] [PASSED] drm_test_cmdline_name_bpp
[15:30:25] [PASSED] drm_test_cmdline_name_option
[15:30:25] [PASSED] drm_test_cmdline_name_bpp_option
[15:30:25] [PASSED] drm_test_cmdline_rotate_0
[15:30:25] [PASSED] drm_test_cmdline_rotate_90
[15:30:25] [PASSED] drm_test_cmdline_rotate_180
[15:30:25] [PASSED] drm_test_cmdline_rotate_270
[15:30:25] [PASSED] drm_test_cmdline_hmirror
[15:30:25] [PASSED] drm_test_cmdline_vmirror
[15:30:25] [PASSED] drm_test_cmdline_margin_options
[15:30:25] [PASSED] drm_test_cmdline_multiple_options
[15:30:25] [PASSED] drm_test_cmdline_bpp_extra_and_option
[15:30:25] [PASSED] drm_test_cmdline_extra_and_option
[15:30:25] [PASSED] drm_test_cmdline_freestanding_options
[15:30:25] [PASSED] drm_test_cmdline_freestanding_force_e_and_options
[15:30:25] [PASSED] drm_test_cmdline_panel_orientation
[15:30:25] ================ drm_test_cmdline_invalid =================
[15:30:25] [PASSED] margin_only
[15:30:25] [PASSED] interlace_only
[15:30:25] [PASSED] res_missing_x
[15:30:25] [PASSED] res_missing_y
[15:30:25] [PASSED] res_bad_y
[15:30:25] [PASSED] res_missing_y_bpp
[15:30:25] [PASSED] res_bad_bpp
[15:30:25] [PASSED] res_bad_refresh
[15:30:25] [PASSED] res_bpp_refresh_force_on_off
[15:30:25] [PASSED] res_invalid_mode
[15:30:25] [PASSED] res_bpp_wrong_place_mode
[15:30:25] [PASSED] name_bpp_refresh
[15:30:25] [PASSED] name_refresh
[15:30:25] [PASSED] name_refresh_wrong_mode
[15:30:25] [PASSED] name_refresh_invalid_mode
[15:30:25] [PASSED] rotate_multiple
[15:30:25] [PASSED] rotate_invalid_val
[15:30:25] [PASSED] rotate_truncated
[15:30:25] [PASSED] invalid_option
[15:30:25] [PASSED] invalid_tv_option
[15:30:25] [PASSED] truncated_tv_option
[15:30:25] ============ [PASSED] drm_test_cmdline_invalid =============
[15:30:25] =============== drm_test_cmdline_tv_options ===============
[15:30:25] [PASSED] NTSC
[15:30:25] [PASSED] NTSC_443
[15:30:25] [PASSED] NTSC_J
[15:30:25] [PASSED] PAL
[15:30:25] [PASSED] PAL_M
[15:30:25] [PASSED] PAL_N
[15:30:25] [PASSED] SECAM
[15:30:25] [PASSED] MONO_525
[15:30:25] [PASSED] MONO_625
[15:30:25] =========== [PASSED] drm_test_cmdline_tv_options ===========
[15:30:25] =============== [PASSED] drm_cmdline_parser ================
[15:30:25] ========== drmm_connector_hdmi_init (20 subtests) ==========
[15:30:25] [PASSED] drm_test_connector_hdmi_init_valid
[15:30:25] [PASSED] drm_test_connector_hdmi_init_bpc_8
[15:30:25] [PASSED] drm_test_connector_hdmi_init_bpc_10
[15:30:25] [PASSED] drm_test_connector_hdmi_init_bpc_12
[15:30:25] [PASSED] drm_test_connector_hdmi_init_bpc_invalid
[15:30:25] [PASSED] drm_test_connector_hdmi_init_bpc_null
[15:30:25] [PASSED] drm_test_connector_hdmi_init_formats_empty
[15:30:25] [PASSED] drm_test_connector_hdmi_init_formats_no_rgb
[15:30:25] === drm_test_connector_hdmi_init_formats_yuv420_allowed ===
[15:30:25] [PASSED] supported_formats=0x9 yuv420_allowed=1
[15:30:25] [PASSED] supported_formats=0x9 yuv420_allowed=0
[15:30:25] [PASSED] supported_formats=0x3 yuv420_allowed=1
[15:30:25] [PASSED] supported_formats=0x3 yuv420_allowed=0
[15:30:25] === [PASSED] drm_test_connector_hdmi_init_formats_yuv420_allowed ===
[15:30:25] [PASSED] drm_test_connector_hdmi_init_null_ddc
[15:30:25] [PASSED] drm_test_connector_hdmi_init_null_product
[15:30:25] [PASSED] drm_test_connector_hdmi_init_null_vendor
[15:30:25] [PASSED] drm_test_connector_hdmi_init_product_length_exact
[15:30:25] [PASSED] drm_test_connector_hdmi_init_product_length_too_long
[15:30:25] [PASSED] drm_test_connector_hdmi_init_product_valid
[15:30:25] [PASSED] drm_test_connector_hdmi_init_vendor_length_exact
[15:30:25] [PASSED] drm_test_connector_hdmi_init_vendor_length_too_long
[15:30:25] [PASSED] drm_test_connector_hdmi_init_vendor_valid
[15:30:25] ========= drm_test_connector_hdmi_init_type_valid =========
[15:30:25] [PASSED] HDMI-A
[15:30:25] [PASSED] HDMI-B
[15:30:25] ===== [PASSED] drm_test_connector_hdmi_init_type_valid =====
[15:30:25] ======== drm_test_connector_hdmi_init_type_invalid ========
[15:30:25] [PASSED] Unknown
[15:30:25] [PASSED] VGA
[15:30:25] [PASSED] DVI-I
[15:30:25] [PASSED] DVI-D
[15:30:25] [PASSED] DVI-A
[15:30:25] [PASSED] Composite
[15:30:25] [PASSED] SVIDEO
[15:30:25] [PASSED] LVDS
[15:30:25] [PASSED] Component
[15:30:25] [PASSED] DIN
[15:30:25] [PASSED] DP
[15:30:25] [PASSED] TV
[15:30:25] [PASSED] eDP
[15:30:25] [PASSED] Virtual
[15:30:25] [PASSED] DSI
[15:30:25] [PASSED] DPI
[15:30:25] [PASSED] Writeback
[15:30:25] [PASSED] SPI
[15:30:25] [PASSED] USB
[15:30:25] ==== [PASSED] drm_test_connector_hdmi_init_type_invalid ====
[15:30:25] ============ [PASSED] drmm_connector_hdmi_init =============
[15:30:25] ============= drmm_connector_init (3 subtests) =============
[15:30:25] [PASSED] drm_test_drmm_connector_init
[15:30:25] [PASSED] drm_test_drmm_connector_init_null_ddc
[15:30:25] ========= drm_test_drmm_connector_init_type_valid =========
[15:30:25] [PASSED] Unknown
[15:30:25] [PASSED] VGA
[15:30:25] [PASSED] DVI-I
[15:30:25] [PASSED] DVI-D
[15:30:25] [PASSED] DVI-A
[15:30:25] [PASSED] Composite
[15:30:25] [PASSED] SVIDEO
[15:30:25] [PASSED] LVDS
[15:30:25] [PASSED] Component
[15:30:25] [PASSED] DIN
[15:30:25] [PASSED] DP
[15:30:25] [PASSED] HDMI-A
[15:30:25] [PASSED] HDMI-B
[15:30:25] [PASSED] TV
[15:30:25] [PASSED] eDP
[15:30:25] [PASSED] Virtual
[15:30:25] [PASSED] DSI
[15:30:25] [PASSED] DPI
[15:30:25] [PASSED] Writeback
[15:30:25] [PASSED] SPI
[15:30:25] [PASSED] USB
[15:30:25] ===== [PASSED] drm_test_drmm_connector_init_type_valid =====
[15:30:25] =============== [PASSED] drmm_connector_init ===============
[15:30:25] ========= drm_connector_dynamic_init (6 subtests) ==========
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_init
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_init_null_ddc
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_init_not_added
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_init_properties
[15:30:25] ===== drm_test_drm_connector_dynamic_init_type_valid ======
[15:30:25] [PASSED] Unknown
[15:30:25] [PASSED] VGA
[15:30:25] [PASSED] DVI-I
[15:30:25] [PASSED] DVI-D
[15:30:25] [PASSED] DVI-A
[15:30:25] [PASSED] Composite
[15:30:25] [PASSED] SVIDEO
[15:30:25] [PASSED] LVDS
[15:30:25] [PASSED] Component
[15:30:25] [PASSED] DIN
[15:30:25] [PASSED] DP
[15:30:25] [PASSED] HDMI-A
[15:30:25] [PASSED] HDMI-B
[15:30:25] [PASSED] TV
[15:30:25] [PASSED] eDP
[15:30:25] [PASSED] Virtual
[15:30:25] [PASSED] DSI
[15:30:25] [PASSED] DPI
[15:30:25] [PASSED] Writeback
[15:30:25] [PASSED] SPI
[15:30:25] [PASSED] USB
[15:30:25] = [PASSED] drm_test_drm_connector_dynamic_init_type_valid ==
[15:30:25] ======== drm_test_drm_connector_dynamic_init_name =========
[15:30:25] [PASSED] Unknown
[15:30:25] [PASSED] VGA
[15:30:25] [PASSED] DVI-I
[15:30:25] [PASSED] DVI-D
[15:30:25] [PASSED] DVI-A
[15:30:25] [PASSED] Composite
[15:30:25] [PASSED] SVIDEO
[15:30:25] [PASSED] LVDS
[15:30:25] [PASSED] Component
[15:30:25] [PASSED] DIN
[15:30:25] [PASSED] DP
[15:30:25] [PASSED] HDMI-A
[15:30:25] [PASSED] HDMI-B
[15:30:25] [PASSED] TV
[15:30:25] [PASSED] eDP
[15:30:25] [PASSED] Virtual
[15:30:25] [PASSED] DSI
[15:30:25] [PASSED] DPI
[15:30:25] [PASSED] Writeback
[15:30:25] [PASSED] SPI
[15:30:25] [PASSED] USB
[15:30:25] ==== [PASSED] drm_test_drm_connector_dynamic_init_name =====
[15:30:25] =========== [PASSED] drm_connector_dynamic_init ============
[15:30:25] ==== drm_connector_dynamic_register_early (4 subtests) =====
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_register_early_on_list
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_register_early_defer
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_register_early_no_init
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_register_early_no_mode_object
[15:30:25] ====== [PASSED] drm_connector_dynamic_register_early =======
[15:30:25] ======= drm_connector_dynamic_register (7 subtests) ========
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_register_on_list
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_register_no_defer
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_register_no_init
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_register_mode_object
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_register_sysfs
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_register_sysfs_name
[15:30:25] [PASSED] drm_test_drm_connector_dynamic_register_debugfs
[15:30:25] ========= [PASSED] drm_connector_dynamic_register ==========
[15:30:25] = drm_connector_attach_broadcast_rgb_property (2 subtests) =
[15:30:25] [PASSED] drm_test_drm_connector_attach_broadcast_rgb_property
[15:30:25] [PASSED] drm_test_drm_connector_attach_broadcast_rgb_property_hdmi_connector
[15:30:25] === [PASSED] drm_connector_attach_broadcast_rgb_property ===
[15:30:25] ========== drm_get_tv_mode_from_name (2 subtests) ==========
[15:30:25] ========== drm_test_get_tv_mode_from_name_valid ===========
[15:30:25] [PASSED] NTSC
[15:30:25] [PASSED] NTSC-443
[15:30:25] [PASSED] NTSC-J
[15:30:25] [PASSED] PAL
[15:30:25] [PASSED] PAL-M
[15:30:25] [PASSED] PAL-N
[15:30:25] [PASSED] SECAM
[15:30:25] [PASSED] Mono
[15:30:25] ====== [PASSED] drm_test_get_tv_mode_from_name_valid =======
[15:30:25] [PASSED] drm_test_get_tv_mode_from_name_truncated
[15:30:25] ============ [PASSED] drm_get_tv_mode_from_name ============
[15:30:25] = drm_test_connector_hdmi_compute_mode_clock (12 subtests) =
[15:30:25] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb
[15:30:25] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_10bpc
[15:30:25] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_10bpc_vic_1
[15:30:25] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_12bpc
[15:30:25] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_12bpc_vic_1
[15:30:25] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_double
[15:30:25] = drm_test_connector_hdmi_compute_mode_clock_yuv420_valid =
[15:30:25] [PASSED] VIC 96
[15:30:25] [PASSED] VIC 97
[15:30:25] [PASSED] VIC 101
[15:30:25] [PASSED] VIC 102
[15:30:25] [PASSED] VIC 106
[15:30:25] [PASSED] VIC 107
[15:30:25] === [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv420_valid ===
[15:30:25] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv420_10_bpc
[15:30:25] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv420_12_bpc
[15:30:25] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv422_8_bpc
[15:30:25] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv422_10_bpc
[15:30:25] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv422_12_bpc
[15:30:25] === [PASSED] drm_test_connector_hdmi_compute_mode_clock ====
[15:30:25] == drm_hdmi_connector_get_broadcast_rgb_name (2 subtests) ==
[15:30:25] === drm_test_drm_hdmi_connector_get_broadcast_rgb_name ====
[15:30:25] [PASSED] Automatic
[15:30:25] [PASSED] Full
[15:30:25] [PASSED] Limited 16:235
[15:30:25] === [PASSED] drm_test_drm_hdmi_connector_get_broadcast_rgb_name ===
[15:30:25] [PASSED] drm_test_drm_hdmi_connector_get_broadcast_rgb_name_invalid
[15:30:25] ==== [PASSED] drm_hdmi_connector_get_broadcast_rgb_name ====
[15:30:25] == drm_hdmi_connector_get_output_format_name (2 subtests) ==
[15:30:25] === drm_test_drm_hdmi_connector_get_output_format_name ====
[15:30:25] [PASSED] RGB
[15:30:25] [PASSED] YUV 4:2:0
[15:30:25] [PASSED] YUV 4:2:2
[15:30:25] [PASSED] YUV 4:4:4
[15:30:25] === [PASSED] drm_test_drm_hdmi_connector_get_output_format_name ===
[15:30:25] [PASSED] drm_test_drm_hdmi_connector_get_output_format_name_invalid
[15:30:25] ==== [PASSED] drm_hdmi_connector_get_output_format_name ====
[15:30:25] ============= drm_damage_helper (21 subtests) ==============
[15:30:25] [PASSED] drm_test_damage_iter_no_damage
[15:30:25] [PASSED] drm_test_damage_iter_no_damage_fractional_src
[15:30:25] [PASSED] drm_test_damage_iter_no_damage_src_moved
[15:30:25] [PASSED] drm_test_damage_iter_no_damage_fractional_src_moved
[15:30:25] [PASSED] drm_test_damage_iter_no_damage_not_visible
[15:30:25] [PASSED] drm_test_damage_iter_no_damage_no_crtc
[15:30:25] [PASSED] drm_test_damage_iter_no_damage_no_fb
[15:30:25] [PASSED] drm_test_damage_iter_simple_damage
[15:30:25] [PASSED] drm_test_damage_iter_single_damage
[15:30:25] [PASSED] drm_test_damage_iter_single_damage_intersect_src
[15:30:25] [PASSED] drm_test_damage_iter_single_damage_outside_src
[15:30:25] [PASSED] drm_test_damage_iter_single_damage_fractional_src
[15:30:25] [PASSED] drm_test_damage_iter_single_damage_intersect_fractional_src
[15:30:25] [PASSED] drm_test_damage_iter_single_damage_outside_fractional_src
[15:30:25] [PASSED] drm_test_damage_iter_single_damage_src_moved
[15:30:25] [PASSED] drm_test_damage_iter_single_damage_fractional_src_moved
[15:30:25] [PASSED] drm_test_damage_iter_damage
[15:30:25] [PASSED] drm_test_damage_iter_damage_one_intersect
[15:30:25] [PASSED] drm_test_damage_iter_damage_one_outside
[15:30:25] [PASSED] drm_test_damage_iter_damage_src_moved
[15:30:25] [PASSED] drm_test_damage_iter_damage_not_visible
[15:30:25] ================ [PASSED] drm_damage_helper ================
[15:30:25] ============== drm_dp_mst_helper (3 subtests) ==============
[15:30:25] ============== drm_test_dp_mst_calc_pbn_mode ==============
[15:30:25] [PASSED] Clock 154000 BPP 30 DSC disabled
[15:30:25] [PASSED] Clock 234000 BPP 30 DSC disabled
[15:30:25] [PASSED] Clock 297000 BPP 24 DSC disabled
[15:30:25] [PASSED] Clock 332880 BPP 24 DSC enabled
[15:30:25] [PASSED] Clock 324540 BPP 24 DSC enabled
[15:30:25] ========== [PASSED] drm_test_dp_mst_calc_pbn_mode ==========
[15:30:25] ============== drm_test_dp_mst_calc_pbn_div ===============
[15:30:25] [PASSED] Link rate 2000000 lane count 4
[15:30:25] [PASSED] Link rate 2000000 lane count 2
[15:30:25] [PASSED] Link rate 2000000 lane count 1
[15:30:25] [PASSED] Link rate 1350000 lane count 4
[15:30:25] [PASSED] Link rate 1350000 lane count 2
[15:30:25] [PASSED] Link rate 1350000 lane count 1
[15:30:25] [PASSED] Link rate 1000000 lane count 4
[15:30:25] [PASSED] Link rate 1000000 lane count 2
[15:30:25] [PASSED] Link rate 1000000 lane count 1
[15:30:25] [PASSED] Link rate 810000 lane count 4
[15:30:25] [PASSED] Link rate 810000 lane count 2
[15:30:25] [PASSED] Link rate 810000 lane count 1
[15:30:25] [PASSED] Link rate 540000 lane count 4
[15:30:25] [PASSED] Link rate 540000 lane count 2
[15:30:25] [PASSED] Link rate 540000 lane count 1
[15:30:25] [PASSED] Link rate 270000 lane count 4
[15:30:25] [PASSED] Link rate 270000 lane count 2
[15:30:25] [PASSED] Link rate 270000 lane count 1
[15:30:25] [PASSED] Link rate 162000 lane count 4
[15:30:25] [PASSED] Link rate 162000 lane count 2
[15:30:25] [PASSED] Link rate 162000 lane count 1
[15:30:25] ========== [PASSED] drm_test_dp_mst_calc_pbn_div ===========
[15:30:25] ========= drm_test_dp_mst_sideband_msg_req_decode =========
[15:30:25] [PASSED] DP_ENUM_PATH_RESOURCES with port number
[15:30:25] [PASSED] DP_POWER_UP_PHY with port number
[15:30:25] [PASSED] DP_POWER_DOWN_PHY with port number
[15:30:25] [PASSED] DP_ALLOCATE_PAYLOAD with SDP stream sinks
[15:30:25] [PASSED] DP_ALLOCATE_PAYLOAD with port number
[15:30:25] [PASSED] DP_ALLOCATE_PAYLOAD with VCPI
[15:30:25] [PASSED] DP_ALLOCATE_PAYLOAD with PBN
[15:30:25] [PASSED] DP_QUERY_PAYLOAD with port number
[15:30:25] [PASSED] DP_QUERY_PAYLOAD with VCPI
[15:30:25] [PASSED] DP_REMOTE_DPCD_READ with port number
[15:30:25] [PASSED] DP_REMOTE_DPCD_READ with DPCD address
[15:30:25] [PASSED] DP_REMOTE_DPCD_READ with max number of bytes
[15:30:25] [PASSED] DP_REMOTE_DPCD_WRITE with port number
[15:30:25] [PASSED] DP_REMOTE_DPCD_WRITE with DPCD address
[15:30:25] [PASSED] DP_REMOTE_DPCD_WRITE with data array
[15:30:25] [PASSED] DP_REMOTE_I2C_READ with port number
[15:30:25] [PASSED] DP_REMOTE_I2C_READ with I2C device ID
[15:30:25] [PASSED] DP_REMOTE_I2C_READ with transactions array
[15:30:25] [PASSED] DP_REMOTE_I2C_WRITE with port number
[15:30:25] [PASSED] DP_REMOTE_I2C_WRITE with I2C device ID
[15:30:25] [PASSED] DP_REMOTE_I2C_WRITE with data array
[15:30:25] [PASSED] DP_QUERY_STREAM_ENC_STATUS with stream ID
[15:30:25] [PASSED] DP_QUERY_STREAM_ENC_STATUS with client ID
[15:30:25] [PASSED] DP_QUERY_STREAM_ENC_STATUS with stream event
[15:30:25] [PASSED] DP_QUERY_STREAM_ENC_STATUS with valid stream event
[15:30:25] [PASSED] DP_QUERY_STREAM_ENC_STATUS with stream behavior
[15:30:25] [PASSED] DP_QUERY_STREAM_ENC_STATUS with a valid stream behavior
[15:30:25] ===== [PASSED] drm_test_dp_mst_sideband_msg_req_decode =====
[15:30:25] ================ [PASSED] drm_dp_mst_helper ================
[15:30:25] ================== drm_exec (7 subtests) ===================
[15:30:25] [PASSED] sanitycheck
[15:30:25] [PASSED] test_lock
[15:30:25] [PASSED] test_lock_unlock
[15:30:25] [PASSED] test_duplicates
[15:30:25] [PASSED] test_prepare
[15:30:25] [PASSED] test_prepare_array
[15:30:25] [PASSED] test_multiple_loops
[15:30:25] ==================== [PASSED] drm_exec =====================
[15:30:25] =========== drm_format_helper_test (17 subtests) ===========
[15:30:25] ============== drm_test_fb_xrgb8888_to_gray8 ==============
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ========== [PASSED] drm_test_fb_xrgb8888_to_gray8 ==========
[15:30:25] ============= drm_test_fb_xrgb8888_to_rgb332 ==============
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ========= [PASSED] drm_test_fb_xrgb8888_to_rgb332 ==========
[15:30:25] ============= drm_test_fb_xrgb8888_to_rgb565 ==============
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ========= [PASSED] drm_test_fb_xrgb8888_to_rgb565 ==========
[15:30:25] ============ drm_test_fb_xrgb8888_to_xrgb1555 =============
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ======== [PASSED] drm_test_fb_xrgb8888_to_xrgb1555 =========
[15:30:25] ============ drm_test_fb_xrgb8888_to_argb1555 =============
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ======== [PASSED] drm_test_fb_xrgb8888_to_argb1555 =========
[15:30:25] ============ drm_test_fb_xrgb8888_to_rgba5551 =============
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ======== [PASSED] drm_test_fb_xrgb8888_to_rgba5551 =========
[15:30:25] ============= drm_test_fb_xrgb8888_to_rgb888 ==============
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ========= [PASSED] drm_test_fb_xrgb8888_to_rgb888 ==========
[15:30:25] ============= drm_test_fb_xrgb8888_to_bgr888 ==============
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ========= [PASSED] drm_test_fb_xrgb8888_to_bgr888 ==========
[15:30:25] ============ drm_test_fb_xrgb8888_to_argb8888 =============
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ======== [PASSED] drm_test_fb_xrgb8888_to_argb8888 =========
[15:30:25] =========== drm_test_fb_xrgb8888_to_xrgb2101010 ===========
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ======= [PASSED] drm_test_fb_xrgb8888_to_xrgb2101010 =======
[15:30:25] =========== drm_test_fb_xrgb8888_to_argb2101010 ===========
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ======= [PASSED] drm_test_fb_xrgb8888_to_argb2101010 =======
[15:30:25] ============== drm_test_fb_xrgb8888_to_mono ===============
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ========== [PASSED] drm_test_fb_xrgb8888_to_mono ===========
[15:30:25] ==================== drm_test_fb_swab =====================
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ================ [PASSED] drm_test_fb_swab =================
[15:30:25] ============ drm_test_fb_xrgb8888_to_xbgr8888 =============
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ======== [PASSED] drm_test_fb_xrgb8888_to_xbgr8888 =========
[15:30:25] ============ drm_test_fb_xrgb8888_to_abgr8888 =============
[15:30:25] [PASSED] single_pixel_source_buffer
[15:30:25] [PASSED] single_pixel_clip_rectangle
[15:30:25] [PASSED] well_known_colors
[15:30:25] [PASSED] destination_pitch
[15:30:25] ======== [PASSED] drm_test_fb_xrgb8888_to_abgr8888 =========
[15:30:25] ================= drm_test_fb_clip_offset =================
[15:30:25] [PASSED] pass through
[15:30:25] [PASSED] horizontal offset
[15:30:25] [PASSED] vertical offset
[15:30:25] [PASSED] horizontal and vertical offset
[15:30:25] [PASSED] horizontal offset (custom pitch)
[15:30:25] [PASSED] vertical offset (custom pitch)
[15:30:25] [PASSED] horizontal and vertical offset (custom pitch)
[15:30:25] ============= [PASSED] drm_test_fb_clip_offset =============
[15:30:25] =================== drm_test_fb_memcpy ====================
[15:30:25] [PASSED] single_pixel_source_buffer: XR24 little-endian (0x34325258)
[15:30:25] [PASSED] single_pixel_source_buffer: XRA8 little-endian (0x38415258)
[15:30:25] [PASSED] single_pixel_source_buffer: YU24 little-endian (0x34325559)
[15:30:25] [PASSED] single_pixel_clip_rectangle: XB24 little-endian (0x34324258)
[15:30:25] [PASSED] single_pixel_clip_rectangle: XRA8 little-endian (0x38415258)
[15:30:25] [PASSED] single_pixel_clip_rectangle: YU24 little-endian (0x34325559)
[15:30:25] [PASSED] well_known_colors: XB24 little-endian (0x34324258)
[15:30:25] [PASSED] well_known_colors: XRA8 little-endian (0x38415258)
[15:30:25] [PASSED] well_known_colors: YU24 little-endian (0x34325559)
[15:30:25] [PASSED] destination_pitch: XB24 little-endian (0x34324258)
[15:30:25] [PASSED] destination_pitch: XRA8 little-endian (0x38415258)
[15:30:25] [PASSED] destination_pitch: YU24 little-endian (0x34325559)
[15:30:25] =============== [PASSED] drm_test_fb_memcpy ================
[15:30:25] ============= [PASSED] drm_format_helper_test ==============
[15:30:25] ================= drm_format (18 subtests) =================
[15:30:25] [PASSED] drm_test_format_block_width_invalid
[15:30:25] [PASSED] drm_test_format_block_width_one_plane
[15:30:25] [PASSED] drm_test_format_block_width_two_plane
[15:30:25] [PASSED] drm_test_format_block_width_three_plane
[15:30:25] [PASSED] drm_test_format_block_width_tiled
[15:30:25] [PASSED] drm_test_format_block_height_invalid
[15:30:25] [PASSED] drm_test_format_block_height_one_plane
[15:30:25] [PASSED] drm_test_format_block_height_two_plane
[15:30:25] [PASSED] drm_test_format_block_height_three_plane
[15:30:25] [PASSED] drm_test_format_block_height_tiled
[15:30:25] [PASSED] drm_test_format_min_pitch_invalid
[15:30:25] [PASSED] drm_test_format_min_pitch_one_plane_8bpp
[15:30:25] [PASSED] drm_test_format_min_pitch_one_plane_16bpp
[15:30:25] [PASSED] drm_test_format_min_pitch_one_plane_24bpp
[15:30:25] [PASSED] drm_test_format_min_pitch_one_plane_32bpp
[15:30:25] [PASSED] drm_test_format_min_pitch_two_plane
[15:30:25] [PASSED] drm_test_format_min_pitch_three_plane_8bpp
[15:30:25] [PASSED] drm_test_format_min_pitch_tiled
[15:30:25] =================== [PASSED] drm_format ====================
[15:30:25] ============== drm_framebuffer (10 subtests) ===============
[15:30:25] ========== drm_test_framebuffer_check_src_coords ==========
[15:30:25] [PASSED] Success: source fits into fb
[15:30:25] [PASSED] Fail: overflowing fb with x-axis coordinate
[15:30:25] [PASSED] Fail: overflowing fb with y-axis coordinate
[15:30:25] [PASSED] Fail: overflowing fb with source width
[15:30:25] [PASSED] Fail: overflowing fb with source height
[15:30:25] ====== [PASSED] drm_test_framebuffer_check_src_coords ======
[15:30:25] [PASSED] drm_test_framebuffer_cleanup
[15:30:25] =============== drm_test_framebuffer_create ===============
[15:30:25] [PASSED] ABGR8888 normal sizes
[15:30:25] [PASSED] ABGR8888 max sizes
[15:30:25] [PASSED] ABGR8888 pitch greater than min required
[15:30:25] [PASSED] ABGR8888 pitch less than min required
[15:30:25] [PASSED] ABGR8888 Invalid width
[15:30:25] [PASSED] ABGR8888 Invalid buffer handle
[15:30:25] [PASSED] No pixel format
[15:30:25] [PASSED] ABGR8888 Width 0
[15:30:25] [PASSED] ABGR8888 Height 0
[15:30:25] [PASSED] ABGR8888 Out of bound height * pitch combination
[15:30:25] [PASSED] ABGR8888 Large buffer offset
[15:30:25] [PASSED] ABGR8888 Buffer offset for inexistent plane
[15:30:25] [PASSED] ABGR8888 Invalid flag
[15:30:25] [PASSED] ABGR8888 Set DRM_MODE_FB_MODIFIERS without modifiers
[15:30:25] [PASSED] ABGR8888 Valid buffer modifier
[15:30:25] [PASSED] ABGR8888 Invalid buffer modifier(DRM_FORMAT_MOD_SAMSUNG_64_32_TILE)
[15:30:25] [PASSED] ABGR8888 Extra pitches without DRM_MODE_FB_MODIFIERS
[15:30:25] [PASSED] ABGR8888 Extra pitches with DRM_MODE_FB_MODIFIERS
[15:30:25] [PASSED] NV12 Normal sizes
[15:30:25] [PASSED] NV12 Max sizes
[15:30:25] [PASSED] NV12 Invalid pitch
[15:30:25] [PASSED] NV12 Invalid modifier/missing DRM_MODE_FB_MODIFIERS flag
[15:30:25] [PASSED] NV12 different modifier per-plane
[15:30:25] [PASSED] NV12 with DRM_FORMAT_MOD_SAMSUNG_64_32_TILE
[15:30:25] [PASSED] NV12 Valid modifiers without DRM_MODE_FB_MODIFIERS
[15:30:25] [PASSED] NV12 Modifier for inexistent plane
[15:30:25] [PASSED] NV12 Handle for inexistent plane
[15:30:25] [PASSED] NV12 Handle for inexistent plane without DRM_MODE_FB_MODIFIERS
[15:30:25] [PASSED] YVU420 DRM_MODE_FB_MODIFIERS set without modifier
[15:30:25] [PASSED] YVU420 Normal sizes
[15:30:25] [PASSED] YVU420 Max sizes
[15:30:25] [PASSED] YVU420 Invalid pitch
[15:30:25] [PASSED] YVU420 Different pitches
[15:30:25] [PASSED] YVU420 Different buffer offsets/pitches
[15:30:25] [PASSED] YVU420 Modifier set just for plane 0, without DRM_MODE_FB_MODIFIERS
[15:30:25] [PASSED] YVU420 Modifier set just for planes 0, 1, without DRM_MODE_FB_MODIFIERS
[15:30:25] [PASSED] YVU420 Modifier set just for plane 0, 1, with DRM_MODE_FB_MODIFIERS
[15:30:25] [PASSED] YVU420 Valid modifier
[15:30:25] [PASSED] YVU420 Different modifiers per plane
[15:30:25] [PASSED] YVU420 Modifier for inexistent plane
[15:30:25] [PASSED] YUV420_10BIT Invalid modifier(DRM_FORMAT_MOD_LINEAR)
[15:30:25] [PASSED] X0L2 Normal sizes
[15:30:25] [PASSED] X0L2 Max sizes
[15:30:25] [PASSED] X0L2 Invalid pitch
[15:30:25] [PASSED] X0L2 Pitch greater than minimum required
[15:30:25] [PASSED] X0L2 Handle for inexistent plane
[15:30:25] [PASSED] X0L2 Offset for inexistent plane, without DRM_MODE_FB_MODIFIERS set
[15:30:25] [PASSED] X0L2 Modifier without DRM_MODE_FB_MODIFIERS set
[15:30:25] [PASSED] X0L2 Valid modifier
[15:30:25] [PASSED] X0L2 Modifier for inexistent plane
[15:30:25] =========== [PASSED] drm_test_framebuffer_create ===========
[15:30:25] [PASSED] drm_test_framebuffer_free
[15:30:25] [PASSED] drm_test_framebuffer_init
[15:30:25] [PASSED] drm_test_framebuffer_init_bad_format
[15:30:25] [PASSED] drm_test_framebuffer_init_dev_mismatch
[15:30:25] [PASSED] drm_test_framebuffer_lookup
[15:30:25] [PASSED] drm_test_framebuffer_lookup_inexistent
[15:30:25] [PASSED] drm_test_framebuffer_modifiers_not_supported
[15:30:25] ================= [PASSED] drm_framebuffer =================
[15:30:25] ================ drm_gem_shmem (8 subtests) ================
[15:30:25] [PASSED] drm_gem_shmem_test_obj_create
[15:30:25] [PASSED] drm_gem_shmem_test_obj_create_private
[15:30:25] [PASSED] drm_gem_shmem_test_pin_pages
[15:30:25] [PASSED] drm_gem_shmem_test_vmap
[15:30:25] [PASSED] drm_gem_shmem_test_get_sg_table
[15:30:25] [PASSED] drm_gem_shmem_test_get_pages_sgt
[15:30:25] [PASSED] drm_gem_shmem_test_madvise
[15:30:25] [PASSED] drm_gem_shmem_test_purge
[15:30:25] ================== [PASSED] drm_gem_shmem ==================
[15:30:25] === drm_atomic_helper_connector_hdmi_check (27 subtests) ===
[15:30:25] [PASSED] drm_test_check_broadcast_rgb_auto_cea_mode
[15:30:25] [PASSED] drm_test_check_broadcast_rgb_auto_cea_mode_vic_1
[15:30:25] [PASSED] drm_test_check_broadcast_rgb_full_cea_mode
[15:30:25] [PASSED] drm_test_check_broadcast_rgb_full_cea_mode_vic_1
[15:30:25] [PASSED] drm_test_check_broadcast_rgb_limited_cea_mode
[15:30:25] [PASSED] drm_test_check_broadcast_rgb_limited_cea_mode_vic_1
[15:30:25] ====== drm_test_check_broadcast_rgb_cea_mode_yuv420 =======
[15:30:25] [PASSED] Automatic
[15:30:25] [PASSED] Full
[15:30:25] [PASSED] Limited 16:235
[15:30:25] == [PASSED] drm_test_check_broadcast_rgb_cea_mode_yuv420 ===
[15:30:25] [PASSED] drm_test_check_broadcast_rgb_crtc_mode_changed
[15:30:25] [PASSED] drm_test_check_broadcast_rgb_crtc_mode_not_changed
[15:30:25] [PASSED] drm_test_check_disable_connector
[15:30:25] [PASSED] drm_test_check_hdmi_funcs_reject_rate
[15:30:25] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_rgb
[15:30:25] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_yuv420
[15:30:25] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_ignore_yuv422
[15:30:25] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_ignore_yuv420
[15:30:25] [PASSED] drm_test_check_driver_unsupported_fallback_yuv420
[15:30:25] [PASSED] drm_test_check_output_bpc_crtc_mode_changed
[15:30:25] [PASSED] drm_test_check_output_bpc_crtc_mode_not_changed
[15:30:25] [PASSED] drm_test_check_output_bpc_dvi
[15:30:25] [PASSED] drm_test_check_output_bpc_format_vic_1
[15:30:25] [PASSED] drm_test_check_output_bpc_format_display_8bpc_only
[15:30:25] [PASSED] drm_test_check_output_bpc_format_display_rgb_only
[15:30:25] [PASSED] drm_test_check_output_bpc_format_driver_8bpc_only
[15:30:25] [PASSED] drm_test_check_output_bpc_format_driver_rgb_only
[15:30:25] [PASSED] drm_test_check_tmds_char_rate_rgb_8bpc
[15:30:25] [PASSED] drm_test_check_tmds_char_rate_rgb_10bpc
[15:30:25] [PASSED] drm_test_check_tmds_char_rate_rgb_12bpc
[15:30:25] ===== [PASSED] drm_atomic_helper_connector_hdmi_check ======
[15:30:25] === drm_atomic_helper_connector_hdmi_reset (6 subtests) ====
[15:30:25] [PASSED] drm_test_check_broadcast_rgb_value
[15:30:25] [PASSED] drm_test_check_bpc_8_value
[15:30:25] [PASSED] drm_test_check_bpc_10_value
[15:30:25] [PASSED] drm_test_check_bpc_12_value
[15:30:25] [PASSED] drm_test_check_format_value
[15:30:25] [PASSED] drm_test_check_tmds_char_value
[15:30:25] ===== [PASSED] drm_atomic_helper_connector_hdmi_reset ======
[15:30:25] = drm_atomic_helper_connector_hdmi_mode_valid (4 subtests) =
[15:30:25] [PASSED] drm_test_check_mode_valid
[15:30:25] [PASSED] drm_test_check_mode_valid_reject
[15:30:25] [PASSED] drm_test_check_mode_valid_reject_rate
[15:30:25] [PASSED] drm_test_check_mode_valid_reject_max_clock
[15:30:25] === [PASSED] drm_atomic_helper_connector_hdmi_mode_valid ===
[15:30:25] = drm_atomic_helper_connector_hdmi_infoframes (5 subtests) =
[15:30:25] [PASSED] drm_test_check_infoframes
[15:30:25] [PASSED] drm_test_check_reject_avi_infoframe
[15:30:25] [PASSED] drm_test_check_reject_hdr_infoframe_bpc_8
[15:30:25] [PASSED] drm_test_check_reject_hdr_infoframe_bpc_10
[15:30:25] [PASSED] drm_test_check_reject_audio_infoframe
[15:30:25] === [PASSED] drm_atomic_helper_connector_hdmi_infoframes ===
[15:30:25] ================= drm_managed (2 subtests) =================
[15:30:25] [PASSED] drm_test_managed_release_action
[15:30:25] [PASSED] drm_test_managed_run_action
[15:30:25] =================== [PASSED] drm_managed ===================
[15:30:25] =================== drm_mm (6 subtests) ====================
[15:30:25] [PASSED] drm_test_mm_init
[15:30:25] [PASSED] drm_test_mm_debug
[15:30:25] [PASSED] drm_test_mm_align32
[15:30:25] [PASSED] drm_test_mm_align64
[15:30:25] [PASSED] drm_test_mm_lowest
[15:30:25] [PASSED] drm_test_mm_highest
[15:30:25] ===================== [PASSED] drm_mm ======================
[15:30:25] ============= drm_modes_analog_tv (5 subtests) =============
[15:30:25] [PASSED] drm_test_modes_analog_tv_mono_576i
[15:30:25] [PASSED] drm_test_modes_analog_tv_ntsc_480i
[15:30:25] [PASSED] drm_test_modes_analog_tv_ntsc_480i_inlined
[15:30:25] [PASSED] drm_test_modes_analog_tv_pal_576i
[15:30:25] [PASSED] drm_test_modes_analog_tv_pal_576i_inlined
[15:30:25] =============== [PASSED] drm_modes_analog_tv ===============
[15:30:25] ============== drm_plane_helper (2 subtests) ===============
[15:30:25] =============== drm_test_check_plane_state ================
[15:30:25] [PASSED] clipping_simple
[15:30:25] [PASSED] clipping_rotate_reflect
[15:30:25] [PASSED] positioning_simple
[15:30:25] [PASSED] upscaling
[15:30:25] [PASSED] downscaling
[15:30:25] [PASSED] rounding1
[15:30:25] [PASSED] rounding2
[15:30:25] [PASSED] rounding3
[15:30:25] [PASSED] rounding4
[15:30:25] =========== [PASSED] drm_test_check_plane_state ============
[15:30:25] =========== drm_test_check_invalid_plane_state ============
[15:30:25] [PASSED] positioning_invalid
[15:30:25] [PASSED] upscaling_invalid
[15:30:25] [PASSED] downscaling_invalid
[15:30:25] ======= [PASSED] drm_test_check_invalid_plane_state ========
[15:30:25] ================ [PASSED] drm_plane_helper =================
[15:30:25] ====== drm_connector_helper_tv_get_modes (1 subtest) =======
[15:30:25] ====== drm_test_connector_helper_tv_get_modes_check =======
[15:30:25] [PASSED] None
[15:30:25] [PASSED] PAL
[15:30:25] [PASSED] NTSC
[15:30:25] [PASSED] Both, NTSC Default
[15:30:25] [PASSED] Both, PAL Default
[15:30:25] [PASSED] Both, NTSC Default, with PAL on command-line
[15:30:25] [PASSED] Both, PAL Default, with NTSC on command-line
[15:30:25] == [PASSED] drm_test_connector_helper_tv_get_modes_check ===
[15:30:25] ======== [PASSED] drm_connector_helper_tv_get_modes ========
[15:30:25] ================== drm_rect (9 subtests) ===================
[15:30:25] [PASSED] drm_test_rect_clip_scaled_div_by_zero
[15:30:25] [PASSED] drm_test_rect_clip_scaled_not_clipped
[15:30:25] [PASSED] drm_test_rect_clip_scaled_clipped
[15:30:25] [PASSED] drm_test_rect_clip_scaled_signed_vs_unsigned
[15:30:25] ================= drm_test_rect_intersect =================
[15:30:25] [PASSED] top-left x bottom-right: 2x2+1+1 x 2x2+0+0
[15:30:25] [PASSED] top-right x bottom-left: 2x2+0+0 x 2x2+1-1
[15:30:25] [PASSED] bottom-left x top-right: 2x2+1-1 x 2x2+0+0
[15:30:25] [PASSED] bottom-right x top-left: 2x2+0+0 x 2x2+1+1
[15:30:25] [PASSED] right x left: 2x1+0+0 x 3x1+1+0
[15:30:25] [PASSED] left x right: 3x1+1+0 x 2x1+0+0
[15:30:25] [PASSED] up x bottom: 1x2+0+0 x 1x3+0-1
[15:30:25] [PASSED] bottom x up: 1x3+0-1 x 1x2+0+0
[15:30:25] [PASSED] touching corner: 1x1+0+0 x 2x2+1+1
[15:30:25] [PASSED] touching side: 1x1+0+0 x 1x1+1+0
[15:30:25] [PASSED] equal rects: 2x2+0+0 x 2x2+0+0
[15:30:25] [PASSED] inside another: 2x2+0+0 x 1x1+1+1
[15:30:25] [PASSED] far away: 1x1+0+0 x 1x1+3+6
[15:30:25] [PASSED] points intersecting: 0x0+5+10 x 0x0+5+10
[15:30:25] [PASSED] points not intersecting: 0x0+0+0 x 0x0+5+10
[15:30:25] ============= [PASSED] drm_test_rect_intersect =============
[15:30:25] ================ drm_test_rect_calc_hscale ================
[15:30:25] [PASSED] normal use
[15:30:25] [PASSED] out of max range
[15:30:25] [PASSED] out of min range
[15:30:25] [PASSED] zero dst
[15:30:25] [PASSED] negative src
[15:30:25] [PASSED] negative dst
[15:30:25] ============ [PASSED] drm_test_rect_calc_hscale ============
[15:30:25] ================ drm_test_rect_calc_vscale ================
[15:30:25] [PASSED] normal use
[15:30:25] [PASSED] out of max range
[15:30:25] [PASSED] out of min range
[15:30:25] [PASSED] zero dst
[15:30:25] [PASSED] negative src
[15:30:25] [PASSED] negative dst
stty: 'standard input': Inappropriate ioctl for device
[15:30:25] ============ [PASSED] drm_test_rect_calc_vscale ============
[15:30:25] ================== drm_test_rect_rotate ===================
[15:30:25] [PASSED] reflect-x
[15:30:25] [PASSED] reflect-y
[15:30:25] [PASSED] rotate-0
[15:30:25] [PASSED] rotate-90
[15:30:25] [PASSED] rotate-180
[15:30:25] [PASSED] rotate-270
[15:30:25] ============== [PASSED] drm_test_rect_rotate ===============
[15:30:25] ================ drm_test_rect_rotate_inv =================
[15:30:25] [PASSED] reflect-x
[15:30:25] [PASSED] reflect-y
[15:30:25] [PASSED] rotate-0
[15:30:25] [PASSED] rotate-90
[15:30:25] [PASSED] rotate-180
[15:30:25] [PASSED] rotate-270
[15:30:25] ============ [PASSED] drm_test_rect_rotate_inv =============
[15:30:25] ==================== [PASSED] drm_rect =====================
[15:30:25] ============ drm_sysfb_modeset_test (1 subtest) ============
[15:30:25] ============ drm_test_sysfb_build_fourcc_list =============
[15:30:25] [PASSED] no native formats
[15:30:25] [PASSED] XRGB8888 as native format
[15:30:25] [PASSED] remove duplicates
[15:30:25] [PASSED] convert alpha formats
[15:30:25] [PASSED] random formats
[15:30:25] ======== [PASSED] drm_test_sysfb_build_fourcc_list =========
[15:30:25] ============= [PASSED] drm_sysfb_modeset_test ==============
[15:30:25] ================== drm_fixp (2 subtests) ===================
[15:30:25] [PASSED] drm_test_int2fixp
[15:30:25] [PASSED] drm_test_sm2fixp
[15:30:25] ==================== [PASSED] drm_fixp =====================
[15:30:25] ============================================================
[15:30:25] Testing complete. Ran 621 tests: passed: 621
[15:30:25] Elapsed time: 30.784s total, 1.659s configuring, 28.906s building, 0.167s running
+ /kernel/tools/testing/kunit/kunit.py run --kunitconfig /kernel/drivers/gpu/drm/ttm/tests/.kunitconfig
[15:30:25] Configuring KUnit Kernel ...
Regenerating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[15:30:27] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=25
[15:30:36] Starting KUnit Kernel (1/1)...
[15:30:36] ============================================================
Running tests with:
$ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[15:30:36] ================= ttm_device (5 subtests) ==================
[15:30:36] [PASSED] ttm_device_init_basic
[15:30:36] [PASSED] ttm_device_init_multiple
[15:30:36] [PASSED] ttm_device_fini_basic
[15:30:36] [PASSED] ttm_device_init_no_vma_man
[15:30:36] ================== ttm_device_init_pools ==================
[15:30:36] [PASSED] No DMA allocations, no DMA32 required
[15:30:36] [PASSED] DMA allocations, DMA32 required
[15:30:36] [PASSED] No DMA allocations, DMA32 required
[15:30:36] [PASSED] DMA allocations, no DMA32 required
[15:30:36] ============== [PASSED] ttm_device_init_pools ==============
[15:30:36] =================== [PASSED] ttm_device ====================
[15:30:36] ================== ttm_pool (8 subtests) ===================
[15:30:36] ================== ttm_pool_alloc_basic ===================
[15:30:36] [PASSED] One page
[15:30:36] [PASSED] More than one page
[15:30:36] [PASSED] Above the allocation limit
[15:30:36] [PASSED] One page, with coherent DMA mappings enabled
[15:30:36] [PASSED] Above the allocation limit, with coherent DMA mappings enabled
[15:30:36] ============== [PASSED] ttm_pool_alloc_basic ===============
[15:30:36] ============== ttm_pool_alloc_basic_dma_addr ==============
[15:30:36] [PASSED] One page
[15:30:36] [PASSED] More than one page
[15:30:36] [PASSED] Above the allocation limit
[15:30:36] [PASSED] One page, with coherent DMA mappings enabled
[15:30:36] [PASSED] Above the allocation limit, with coherent DMA mappings enabled
[15:30:36] ========== [PASSED] ttm_pool_alloc_basic_dma_addr ==========
[15:30:36] [PASSED] ttm_pool_alloc_order_caching_match
[15:30:36] [PASSED] ttm_pool_alloc_caching_mismatch
[15:30:36] [PASSED] ttm_pool_alloc_order_mismatch
[15:30:36] [PASSED] ttm_pool_free_dma_alloc
[15:30:36] [PASSED] ttm_pool_free_no_dma_alloc
[15:30:36] [PASSED] ttm_pool_fini_basic
[15:30:36] ==================== [PASSED] ttm_pool =====================
[15:30:36] ================ ttm_resource (8 subtests) =================
[15:30:36] ================= ttm_resource_init_basic =================
[15:30:36] [PASSED] Init resource in TTM_PL_SYSTEM
[15:30:36] [PASSED] Init resource in TTM_PL_VRAM
[15:30:36] [PASSED] Init resource in a private placement
[15:30:36] [PASSED] Init resource in TTM_PL_SYSTEM, set placement flags
[15:30:36] ============= [PASSED] ttm_resource_init_basic =============
[15:30:36] [PASSED] ttm_resource_init_pinned
[15:30:36] [PASSED] ttm_resource_fini_basic
[15:30:36] [PASSED] ttm_resource_manager_init_basic
[15:30:36] [PASSED] ttm_resource_manager_usage_basic
[15:30:36] [PASSED] ttm_resource_manager_set_used_basic
[15:30:36] [PASSED] ttm_sys_man_alloc_basic
[15:30:36] [PASSED] ttm_sys_man_free_basic
[15:30:36] ================== [PASSED] ttm_resource ===================
[15:30:36] =================== ttm_tt (15 subtests) ===================
[15:30:36] ==================== ttm_tt_init_basic ====================
[15:30:36] [PASSED] Page-aligned size
[15:30:36] [PASSED] Extra pages requested
[15:30:36] ================ [PASSED] ttm_tt_init_basic ================
[15:30:36] [PASSED] ttm_tt_init_misaligned
[15:30:36] [PASSED] ttm_tt_fini_basic
[15:30:36] [PASSED] ttm_tt_fini_sg
[15:30:36] [PASSED] ttm_tt_fini_shmem
[15:30:36] [PASSED] ttm_tt_create_basic
[15:30:36] [PASSED] ttm_tt_create_invalid_bo_type
[15:30:36] [PASSED] ttm_tt_create_ttm_exists
[15:30:36] [PASSED] ttm_tt_create_failed
[15:30:36] [PASSED] ttm_tt_destroy_basic
[15:30:36] [PASSED] ttm_tt_populate_null_ttm
[15:30:36] [PASSED] ttm_tt_populate_populated_ttm
[15:30:36] [PASSED] ttm_tt_unpopulate_basic
[15:30:36] [PASSED] ttm_tt_unpopulate_empty_ttm
[15:30:36] [PASSED] ttm_tt_swapin_basic
[15:30:36] ===================== [PASSED] ttm_tt ======================
[15:30:36] =================== ttm_bo (14 subtests) ===================
[15:30:36] =========== ttm_bo_reserve_optimistic_no_ticket ===========
[15:30:36] [PASSED] Cannot be interrupted and sleeps
[15:30:36] [PASSED] Cannot be interrupted, locks straight away
[15:30:36] [PASSED] Can be interrupted, sleeps
[15:30:36] ======= [PASSED] ttm_bo_reserve_optimistic_no_ticket =======
[15:30:36] [PASSED] ttm_bo_reserve_locked_no_sleep
[15:30:36] [PASSED] ttm_bo_reserve_no_wait_ticket
[15:30:36] [PASSED] ttm_bo_reserve_double_resv
[15:30:36] [PASSED] ttm_bo_reserve_interrupted
[15:30:36] [PASSED] ttm_bo_reserve_deadlock
[15:30:36] [PASSED] ttm_bo_unreserve_basic
[15:30:36] [PASSED] ttm_bo_unreserve_pinned
[15:30:36] [PASSED] ttm_bo_unreserve_bulk
[15:30:36] [PASSED] ttm_bo_fini_basic
[15:30:36] [PASSED] ttm_bo_fini_shared_resv
[15:30:36] [PASSED] ttm_bo_pin_basic
[15:30:36] [PASSED] ttm_bo_pin_unpin_resource
[15:30:36] [PASSED] ttm_bo_multiple_pin_one_unpin
[15:30:36] ===================== [PASSED] ttm_bo ======================
[15:30:36] ============== ttm_bo_validate (22 subtests) ===============
[15:30:36] ============== ttm_bo_init_reserved_sys_man ===============
[15:30:36] [PASSED] Buffer object for userspace
[15:30:36] [PASSED] Kernel buffer object
[15:30:36] [PASSED] Shared buffer object
[15:30:36] ========== [PASSED] ttm_bo_init_reserved_sys_man ===========
[15:30:36] ============== ttm_bo_init_reserved_mock_man ==============
[15:30:36] [PASSED] Buffer object for userspace
[15:30:36] [PASSED] Kernel buffer object
[15:30:36] [PASSED] Shared buffer object
[15:30:36] ========== [PASSED] ttm_bo_init_reserved_mock_man ==========
[15:30:36] [PASSED] ttm_bo_init_reserved_resv
[15:30:36] ================== ttm_bo_validate_basic ==================
[15:30:36] [PASSED] Buffer object for userspace
[15:30:36] [PASSED] Kernel buffer object
[15:30:36] [PASSED] Shared buffer object
[15:30:36] ============== [PASSED] ttm_bo_validate_basic ==============
[15:30:36] [PASSED] ttm_bo_validate_invalid_placement
[15:30:36] ============= ttm_bo_validate_same_placement ==============
[15:30:36] [PASSED] System manager
[15:30:36] [PASSED] VRAM manager
[15:30:36] ========= [PASSED] ttm_bo_validate_same_placement ==========
[15:30:36] [PASSED] ttm_bo_validate_failed_alloc
[15:30:36] [PASSED] ttm_bo_validate_pinned
[15:30:36] [PASSED] ttm_bo_validate_busy_placement
[15:30:36] ================ ttm_bo_validate_multihop =================
[15:30:36] [PASSED] Buffer object for userspace
[15:30:36] [PASSED] Kernel buffer object
[15:30:36] [PASSED] Shared buffer object
[15:30:36] ============ [PASSED] ttm_bo_validate_multihop =============
[15:30:36] ========== ttm_bo_validate_no_placement_signaled ==========
[15:30:36] [PASSED] Buffer object in system domain, no page vector
[15:30:36] [PASSED] Buffer object in system domain with an existing page vector
[15:30:36] ====== [PASSED] ttm_bo_validate_no_placement_signaled ======
[15:30:36] ======== ttm_bo_validate_no_placement_not_signaled ========
[15:30:36] [PASSED] Buffer object for userspace
[15:30:36] [PASSED] Kernel buffer object
[15:30:36] [PASSED] Shared buffer object
[15:30:36] ==== [PASSED] ttm_bo_validate_no_placement_not_signaled ====
[15:30:36] [PASSED] ttm_bo_validate_move_fence_signaled
[15:30:36] ========= ttm_bo_validate_move_fence_not_signaled =========
[15:30:36] [PASSED] Waits for GPU
[15:30:36] [PASSED] Tries to lock straight away
[15:30:36] ===== [PASSED] ttm_bo_validate_move_fence_not_signaled =====
[15:30:36] [PASSED] ttm_bo_validate_swapout
[15:30:36] [PASSED] ttm_bo_validate_happy_evict
[15:30:36] [PASSED] ttm_bo_validate_all_pinned_evict
[15:30:36] [PASSED] ttm_bo_validate_allowed_only_evict
[15:30:36] [PASSED] ttm_bo_validate_deleted_evict
[15:30:36] [PASSED] ttm_bo_validate_busy_domain_evict
[15:30:36] [PASSED] ttm_bo_validate_evict_gutting
[15:30:36] [PASSED] ttm_bo_validate_recrusive_evict
stty: 'standard input': Inappropriate ioctl for device
[15:30:36] ================= [PASSED] ttm_bo_validate =================
[15:30:36] ============================================================
[15:30:36] Testing complete. Ran 102 tests: passed: 102
[15:30:36] Elapsed time: 11.008s total, 1.661s configuring, 9.131s building, 0.177s running
+ cleanup
++ stat -c %u:%g /kernel
+ chown -R 1003:1003 /kernel
^ permalink raw reply [flat|nested] 33+ messages in thread
* ✓ Xe.CI.BAT: success for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev2)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (2 preceding siblings ...)
2026-03-13 15:30 ` ✓ CI.KUnit: success " Patchwork
@ 2026-03-13 16:09 ` Patchwork
2026-03-14 19:51 ` ✓ Xe.CI.FULL: " Patchwork
` (11 subsequent siblings)
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-13 16:09 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
[-- Attachment #1: Type: text/plain, Size: 2933 bytes --]
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev2)
URL : https://patchwork.freedesktop.org/series/162134/
State : success
== Summary ==
CI Bug Log - changes from xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132_BAT -> xe-pw-162134v2_BAT
====================================================
Summary
-------
**SUCCESS**
No regressions found.
Participating hosts (14 -> 14)
------------------------------
No changes in participating hosts
Known issues
------------
Here are the changes found in xe-pw-162134v2_BAT that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@kms_flip@basic-flip-vs-wf_vblank@d-edp1:
- bat-adlp-7: [PASS][1] -> [DMESG-WARN][2] ([Intel XE#7483])
[1]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@d-edp1.html
[2]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@d-edp1.html
#### Possible fixes ####
* igt@kms_flip@basic-flip-vs-wf_vblank@c-edp1:
- bat-adlp-7: [DMESG-WARN][3] ([Intel XE#7483]) -> [PASS][4]
[3]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@c-edp1.html
[4]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@c-edp1.html
* igt@xe_waitfence@abstime:
- bat-dg2-oem2: [TIMEOUT][5] ([Intel XE#6506]) -> [PASS][6]
[5]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/bat-dg2-oem2/igt@xe_waitfence@abstime.html
[6]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/bat-dg2-oem2/igt@xe_waitfence@abstime.html
* igt@xe_waitfence@engine:
- bat-dg2-oem2: [FAIL][7] ([Intel XE#6519]) -> [PASS][8]
[7]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/bat-dg2-oem2/igt@xe_waitfence@engine.html
[8]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/bat-dg2-oem2/igt@xe_waitfence@engine.html
[Intel XE#6506]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6506
[Intel XE#6519]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6519
[Intel XE#7483]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7483
Build changes
-------------
* IGT: IGT_8801 -> IGT_8802
* Linux: xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132 -> xe-pw-162134v2
IGT_8801: 246d93c1df887e151d038cee9eb0fc31650c4fb0 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git
IGT_8802: 8802
xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132: 45618ec6cfed86e72cf6c2325c8f947bfbe7c132
xe-pw-162134v2: 162134v2
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/index.html
[-- Attachment #2: Type: text/html, Size: 3669 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread
* ✓ Xe.CI.FULL: success for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev2)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (3 preceding siblings ...)
2026-03-13 16:09 ` ✓ Xe.CI.BAT: " Patchwork
@ 2026-03-14 19:51 ` Patchwork
2026-03-25 18:33 ` ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev3) Patchwork
` (10 subsequent siblings)
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-14 19:51 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
[-- Attachment #1: Type: text/plain, Size: 58192 bytes --]
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev2)
URL : https://patchwork.freedesktop.org/series/162134/
State : success
== Summary ==
CI Bug Log - changes from xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132_FULL -> xe-pw-162134v2_FULL
====================================================
Summary
-------
**SUCCESS**
No regressions found.
Participating hosts (2 -> 2)
------------------------------
No changes in participating hosts
Known issues
------------
Here are the changes found in xe-pw-162134v2_FULL that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@kms_big_fb@x-tiled-16bpp-rotate-90:
- shard-bmg: NOTRUN -> [SKIP][1] ([Intel XE#2327])
[1]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_big_fb@x-tiled-16bpp-rotate-90.html
* igt@kms_big_fb@yf-tiled-8bpp-rotate-90:
- shard-bmg: NOTRUN -> [SKIP][2] ([Intel XE#1124])
[2]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-4/igt@kms_big_fb@yf-tiled-8bpp-rotate-90.html
* igt@kms_bw@connected-linear-tiling-2-displays-3840x2160p:
- shard-bmg: [PASS][3] -> [SKIP][4] ([Intel XE#2314] / [Intel XE#2894] / [Intel XE#7373])
[3]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-9/igt@kms_bw@connected-linear-tiling-2-displays-3840x2160p.html
[4]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_bw@connected-linear-tiling-2-displays-3840x2160p.html
* igt@kms_bw@linear-tiling-1-displays-2560x1440p:
- shard-bmg: NOTRUN -> [SKIP][5] ([Intel XE#367] / [Intel XE#7354])
[5]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@kms_bw@linear-tiling-1-displays-2560x1440p.html
* igt@kms_ccs@bad-rotation-90-y-tiled-ccs:
- shard-bmg: NOTRUN -> [SKIP][6] ([Intel XE#2887])
[6]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-4/igt@kms_ccs@bad-rotation-90-y-tiled-ccs.html
* igt@kms_ccs@crc-primary-suspend-y-tiled-ccs:
- shard-bmg: NOTRUN -> [SKIP][7] ([Intel XE#3432])
[7]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-2/igt@kms_ccs@crc-primary-suspend-y-tiled-ccs.html
* igt@kms_ccs@crc-sprite-planes-basic-4-tiled-lnl-ccs@pipe-a-hdmi-a-3:
- shard-bmg: NOTRUN -> [SKIP][8] ([Intel XE#2652]) +7 other tests skip
[8]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@kms_ccs@crc-sprite-planes-basic-4-tiled-lnl-ccs@pipe-a-hdmi-a-3.html
* igt@kms_chamelium_audio@dp-audio:
- shard-bmg: NOTRUN -> [SKIP][9] ([Intel XE#2252]) +1 other test skip
[9]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@kms_chamelium_audio@dp-audio.html
* igt@kms_content_protection@lic-type-0-hdcp14@pipe-a-dp-2:
- shard-bmg: NOTRUN -> [FAIL][10] ([Intel XE#1178] / [Intel XE#3304] / [Intel XE#7374]) +1 other test fail
[10]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@kms_content_protection@lic-type-0-hdcp14@pipe-a-dp-2.html
* igt@kms_cursor_crc@cursor-onscreen-64x21:
- shard-bmg: NOTRUN -> [SKIP][11] ([Intel XE#2320])
[11]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_cursor_crc@cursor-onscreen-64x21.html
* igt@kms_cursor_crc@cursor-sliding-512x512:
- shard-bmg: NOTRUN -> [SKIP][12] ([Intel XE#2321] / [Intel XE#7355])
[12]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@kms_cursor_crc@cursor-sliding-512x512.html
* igt@kms_cursor_legacy@2x-flip-vs-cursor-legacy:
- shard-bmg: [PASS][13] -> [SKIP][14] ([Intel XE#2291]) +1 other test skip
[13]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-3/igt@kms_cursor_legacy@2x-flip-vs-cursor-legacy.html
[14]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_cursor_legacy@2x-flip-vs-cursor-legacy.html
* igt@kms_cursor_legacy@cursorb-vs-flipa-atomic-transitions-varying-size:
- shard-bmg: NOTRUN -> [SKIP][15] ([Intel XE#2291])
[15]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_cursor_legacy@cursorb-vs-flipa-atomic-transitions-varying-size.html
* igt@kms_cursor_legacy@cursorb-vs-flipa-legacy:
- shard-lnl: NOTRUN -> [SKIP][16] ([Intel XE#309] / [Intel XE#7343])
[16]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-4/igt@kms_cursor_legacy@cursorb-vs-flipa-legacy.html
* igt@kms_cursor_legacy@cursorb-vs-flipa-varying-size:
- shard-bmg: [PASS][17] -> [SKIP][18] ([Intel XE#2291] / [Intel XE#7343])
[17]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-8/igt@kms_cursor_legacy@cursorb-vs-flipa-varying-size.html
[18]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_cursor_legacy@cursorb-vs-flipa-varying-size.html
* igt@kms_dirtyfb@fbc-dirtyfb-ioctl:
- shard-bmg: NOTRUN -> [SKIP][19] ([Intel XE#4210] / [Intel XE#7467])
[19]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-6/igt@kms_dirtyfb@fbc-dirtyfb-ioctl.html
* igt@kms_feature_discovery@display-2x:
- shard-bmg: [PASS][20] -> [SKIP][21] ([Intel XE#2373] / [Intel XE#7344])
[20]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-7/igt@kms_feature_discovery@display-2x.html
[21]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_feature_discovery@display-2x.html
* igt@kms_flip@2x-nonexisting-fb:
- shard-bmg: [PASS][22] -> [SKIP][23] ([Intel XE#2316]) +5 other tests skip
[22]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_flip@2x-nonexisting-fb.html
[23]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_flip@2x-nonexisting-fb.html
* igt@kms_flip@flip-vs-expired-vblank-interruptible:
- shard-lnl: [PASS][24] -> [FAIL][25] ([Intel XE#301]) +1 other test fail
[24]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-7/igt@kms_flip@flip-vs-expired-vblank-interruptible.html
[25]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-6/igt@kms_flip@flip-vs-expired-vblank-interruptible.html
* igt@kms_flip_scaled_crc@flip-32bpp-4tile-to-32bpp-4tiledg2rcccs-downscaling:
- shard-lnl: NOTRUN -> [SKIP][26] ([Intel XE#7178] / [Intel XE#7349])
[26]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-4/igt@kms_flip_scaled_crc@flip-32bpp-4tile-to-32bpp-4tiledg2rcccs-downscaling.html
- shard-bmg: NOTRUN -> [SKIP][27] ([Intel XE#7178] / [Intel XE#7349])
[27]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-9/igt@kms_flip_scaled_crc@flip-32bpp-4tile-to-32bpp-4tiledg2rcccs-downscaling.html
* igt@kms_flip_scaled_crc@flip-32bpp-yftileccs-to-64bpp-yftile-upscaling:
- shard-bmg: NOTRUN -> [SKIP][28] ([Intel XE#7178] / [Intel XE#7351])
[28]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@kms_flip_scaled_crc@flip-32bpp-yftileccs-to-64bpp-yftile-upscaling.html
* igt@kms_frontbuffer_tracking@drrs-2p-primscrn-cur-indfb-draw-render:
- shard-bmg: NOTRUN -> [SKIP][29] ([Intel XE#2312]) +1 other test skip
[29]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_frontbuffer_tracking@drrs-2p-primscrn-cur-indfb-draw-render.html
* igt@kms_frontbuffer_tracking@fbc-2p-primscrn-cur-indfb-move:
- shard-bmg: NOTRUN -> [SKIP][30] ([Intel XE#4141]) +3 other tests skip
[30]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-2/igt@kms_frontbuffer_tracking@fbc-2p-primscrn-cur-indfb-move.html
* igt@kms_frontbuffer_tracking@fbcdrrs-1p-primscrn-spr-indfb-draw-render:
- shard-lnl: NOTRUN -> [SKIP][31] ([Intel XE#6312] / [Intel XE#651])
[31]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-6/igt@kms_frontbuffer_tracking@fbcdrrs-1p-primscrn-spr-indfb-draw-render.html
* igt@kms_frontbuffer_tracking@fbcdrrs-2p-primscrn-shrfb-plflip-blt:
- shard-bmg: NOTRUN -> [SKIP][32] ([Intel XE#2311]) +10 other tests skip
[32]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-9/igt@kms_frontbuffer_tracking@fbcdrrs-2p-primscrn-shrfb-plflip-blt.html
* igt@kms_frontbuffer_tracking@fbcdrrs-argb161616f-draw-blt:
- shard-bmg: NOTRUN -> [SKIP][33] ([Intel XE#7061] / [Intel XE#7356])
[33]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_frontbuffer_tracking@fbcdrrs-argb161616f-draw-blt.html
* igt@kms_frontbuffer_tracking@fbcpsr-rgb565-draw-blt:
- shard-bmg: NOTRUN -> [SKIP][34] ([Intel XE#2313]) +6 other tests skip
[34]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-9/igt@kms_frontbuffer_tracking@fbcpsr-rgb565-draw-blt.html
* igt@kms_frontbuffer_tracking@fbcpsr-tiling-y:
- shard-lnl: NOTRUN -> [SKIP][35] ([Intel XE#1469] / [Intel XE#7399])
[35]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-4/igt@kms_frontbuffer_tracking@fbcpsr-tiling-y.html
- shard-bmg: NOTRUN -> [SKIP][36] ([Intel XE#2352] / [Intel XE#7399])
[36]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-9/igt@kms_frontbuffer_tracking@fbcpsr-tiling-y.html
* igt@kms_frontbuffer_tracking@plane-fbc-rte:
- shard-bmg: NOTRUN -> [SKIP][37] ([Intel XE#2350] / [Intel XE#7503])
[37]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_frontbuffer_tracking@plane-fbc-rte.html
* igt@kms_plane_multiple@2x-tiling-yf:
- shard-bmg: NOTRUN -> [SKIP][38] ([Intel XE#4596])
[38]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_plane_multiple@2x-tiling-yf.html
* igt@kms_plane_scaling@intel-max-src-size:
- shard-bmg: [PASS][39] -> [SKIP][40] ([Intel XE#2685] / [Intel XE#3307])
[39]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-9/igt@kms_plane_scaling@intel-max-src-size.html
[40]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-10/igt@kms_plane_scaling@intel-max-src-size.html
* igt@kms_psr2_sf@psr2-cursor-plane-update-sf:
- shard-bmg: NOTRUN -> [SKIP][41] ([Intel XE#1489]) +1 other test skip
[41]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@kms_psr2_sf@psr2-cursor-plane-update-sf.html
* igt@kms_psr@psr-no-drrs:
- shard-bmg: NOTRUN -> [SKIP][42] ([Intel XE#2234] / [Intel XE#2850]) +3 other tests skip
[42]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-4/igt@kms_psr@psr-no-drrs.html
* igt@kms_psr_stress_test@flip-primary-invalidate-overlay:
- shard-lnl: [PASS][43] -> [SKIP][44] ([Intel XE#4692] / [Intel XE#7508])
[43]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-5/igt@kms_psr_stress_test@flip-primary-invalidate-overlay.html
[44]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-5/igt@kms_psr_stress_test@flip-primary-invalidate-overlay.html
* igt@kms_rotation_crc@bad-tiling:
- shard-bmg: NOTRUN -> [SKIP][45] ([Intel XE#3414] / [Intel XE#3904] / [Intel XE#7342])
[45]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@kms_rotation_crc@bad-tiling.html
* igt@kms_sharpness_filter@filter-modifiers:
- shard-bmg: NOTRUN -> [SKIP][46] ([Intel XE#6503]) +1 other test skip
[46]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-4/igt@kms_sharpness_filter@filter-modifiers.html
* igt@xe_create@multigpu-create-massive-size:
- shard-bmg: NOTRUN -> [SKIP][47] ([Intel XE#2504] / [Intel XE#7319] / [Intel XE#7350])
[47]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-2/igt@xe_create@multigpu-create-massive-size.html
* igt@xe_eudebug@vm-bind-clear-faultable:
- shard-bmg: NOTRUN -> [SKIP][48] ([Intel XE#4837]) +2 other tests skip
[48]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-10/igt@xe_eudebug@vm-bind-clear-faultable.html
* igt@xe_eudebug_online@breakpoint-many-sessions-single-tile:
- shard-bmg: NOTRUN -> [SKIP][49] ([Intel XE#4837] / [Intel XE#6665])
[49]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@xe_eudebug_online@breakpoint-many-sessions-single-tile.html
* igt@xe_evict@evict-small-external-multi-queue-cm:
- shard-bmg: NOTRUN -> [SKIP][50] ([Intel XE#7140])
[50]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-3/igt@xe_evict@evict-small-external-multi-queue-cm.html
- shard-lnl: NOTRUN -> [SKIP][51] ([Intel XE#6540] / [Intel XE#688])
[51]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-2/igt@xe_evict@evict-small-external-multi-queue-cm.html
* igt@xe_exec_balancer@twice-cm-virtual-userptr-invalidate-race:
- shard-lnl: NOTRUN -> [SKIP][52] ([Intel XE#7482]) +1 other test skip
[52]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-7/igt@xe_exec_balancer@twice-cm-virtual-userptr-invalidate-race.html
* igt@xe_exec_basic@multigpu-many-execqueues-many-vm-bindexecqueue:
- shard-bmg: NOTRUN -> [SKIP][53] ([Intel XE#2322] / [Intel XE#7372]) +2 other tests skip
[53]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@xe_exec_basic@multigpu-many-execqueues-many-vm-bindexecqueue.html
* igt@xe_exec_fault_mode@many-multi-queue-userptr-invalidate-imm:
- shard-bmg: NOTRUN -> [SKIP][54] ([Intel XE#7136]) +1 other test skip
[54]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@xe_exec_fault_mode@many-multi-queue-userptr-invalidate-imm.html
* igt@xe_exec_multi_queue@two-queues-priority:
- shard-bmg: NOTRUN -> [SKIP][55] ([Intel XE#6874]) +8 other tests skip
[55]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-9/igt@xe_exec_multi_queue@two-queues-priority.html
- shard-lnl: NOTRUN -> [SKIP][56] ([Intel XE#6874])
[56]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-4/igt@xe_exec_multi_queue@two-queues-priority.html
* igt@xe_exec_system_allocator@pat-index-madvise-pat-idx-uc-single-vma:
- shard-lnl: [PASS][57] -> [FAIL][58] ([Intel XE#5625])
[57]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-7/igt@xe_exec_system_allocator@pat-index-madvise-pat-idx-uc-single-vma.html
[58]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-3/igt@xe_exec_system_allocator@pat-index-madvise-pat-idx-uc-single-vma.html
* igt@xe_exec_threads@threads-multi-queue-rebind:
- shard-bmg: NOTRUN -> [SKIP][59] ([Intel XE#7138]) +3 other tests skip
[59]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-4/igt@xe_exec_threads@threads-multi-queue-rebind.html
* igt@xe_pat@pat-index-xelpg:
- shard-bmg: NOTRUN -> [SKIP][60] ([Intel XE#2236])
[60]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-3/igt@xe_pat@pat-index-xelpg.html
* igt@xe_pm_residency@cpg-basic:
- shard-lnl: NOTRUN -> [SKIP][61] ([Intel XE#584] / [Intel XE#7369])
[61]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-3/igt@xe_pm_residency@cpg-basic.html
* igt@xe_pxp@pxp-optout:
- shard-bmg: NOTRUN -> [SKIP][62] ([Intel XE#4733] / [Intel XE#7417]) +1 other test skip
[62]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-4/igt@xe_pxp@pxp-optout.html
#### Possible fixes ####
* igt@fbdev@read:
- shard-bmg: [FAIL][63] -> [PASS][64]
[63]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@fbdev@read.html
[64]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-4/igt@fbdev@read.html
* igt@kms_cursor_crc@cursor-sliding-256x256:
- shard-bmg: [FAIL][65] ([Intel XE#6747]) -> [PASS][66] +1 other test pass
[65]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_cursor_crc@cursor-sliding-256x256.html
[66]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-3/igt@kms_cursor_crc@cursor-sliding-256x256.html
* igt@kms_cursor_legacy@cursorb-vs-flipa-toggle:
- shard-bmg: [SKIP][67] ([Intel XE#2291]) -> [PASS][68]
[67]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-5/igt@kms_cursor_legacy@cursorb-vs-flipa-toggle.html
[68]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@kms_cursor_legacy@cursorb-vs-flipa-toggle.html
* igt@kms_flip@2x-flip-vs-absolute-wf_vblank-interruptible:
- shard-bmg: [SKIP][69] ([Intel XE#2316]) -> [PASS][70] +7 other tests pass
[69]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-5/igt@kms_flip@2x-flip-vs-absolute-wf_vblank-interruptible.html
[70]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-4/igt@kms_flip@2x-flip-vs-absolute-wf_vblank-interruptible.html
* igt@kms_joiner@basic-force-big-joiner:
- shard-bmg: [SKIP][71] ([Intel XE#7086]) -> [PASS][72]
[71]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-5/igt@kms_joiner@basic-force-big-joiner.html
[72]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-10/igt@kms_joiner@basic-force-big-joiner.html
* igt@xe_evict@evict-mixed-many-threads-small:
- shard-bmg: [INCOMPLETE][73] ([Intel XE#6321]) -> [PASS][74] +1 other test pass
[73]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-6/igt@xe_evict@evict-mixed-many-threads-small.html
[74]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@xe_evict@evict-mixed-many-threads-small.html
* igt@xe_exec_fault_mode@twice-userptr-rebind:
- shard-bmg: [SKIP][75] ([Intel XE#6703]) -> [PASS][76] +78 other tests pass
[75]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@xe_exec_fault_mode@twice-userptr-rebind.html
[76]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@xe_exec_fault_mode@twice-userptr-rebind.html
* igt@xe_exec_system_allocator@pat-index-madvise-pat-idx-uc-multi-vma:
- shard-lnl: [FAIL][77] ([Intel XE#5625]) -> [PASS][78]
[77]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-4/igt@xe_exec_system_allocator@pat-index-madvise-pat-idx-uc-multi-vma.html
[78]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-2/igt@xe_exec_system_allocator@pat-index-madvise-pat-idx-uc-multi-vma.html
* igt@xe_exec_system_allocator@threads-many-large-execqueues-mmap-free-race-nomemset:
- shard-bmg: [INCOMPLETE][79] -> [PASS][80]
[79]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-9/igt@xe_exec_system_allocator@threads-many-large-execqueues-mmap-free-race-nomemset.html
[80]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-6/igt@xe_exec_system_allocator@threads-many-large-execqueues-mmap-free-race-nomemset.html
* igt@xe_exec_system_allocator@twice-large-malloc-multi-fault:
- shard-bmg: [DMESG-FAIL][81] ([Intel XE#5545] / [Intel XE#6652]) -> [PASS][82]
[81]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@xe_exec_system_allocator@twice-large-malloc-multi-fault.html
[82]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-2/igt@xe_exec_system_allocator@twice-large-malloc-multi-fault.html
* igt@xe_module_load@load:
- shard-lnl: ([PASS][83], [PASS][84], [PASS][85], [PASS][86], [PASS][87], [PASS][88], [PASS][89], [PASS][90], [PASS][91], [SKIP][92], [PASS][93], [PASS][94], [PASS][95], [PASS][96], [PASS][97], [PASS][98], [PASS][99], [PASS][100], [PASS][101], [PASS][102], [PASS][103], [PASS][104], [PASS][105], [PASS][106], [PASS][107], [PASS][108]) ([Intel XE#378] / [Intel XE#7405]) -> ([PASS][109], [PASS][110], [PASS][111], [PASS][112], [PASS][113], [PASS][114], [PASS][115], [PASS][116], [PASS][117], [PASS][118], [PASS][119], [PASS][120], [PASS][121], [PASS][122], [PASS][123], [PASS][124], [PASS][125], [PASS][126], [PASS][127], [PASS][128], [PASS][129], [PASS][130], [PASS][131], [PASS][132], [PASS][133])
[83]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-1/igt@xe_module_load@load.html
[84]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-2/igt@xe_module_load@load.html
[85]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-2/igt@xe_module_load@load.html
[86]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-1/igt@xe_module_load@load.html
[87]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-6/igt@xe_module_load@load.html
[88]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-6/igt@xe_module_load@load.html
[89]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-6/igt@xe_module_load@load.html
[90]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-5/igt@xe_module_load@load.html
[91]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-6/igt@xe_module_load@load.html
[92]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-8/igt@xe_module_load@load.html
[93]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-5/igt@xe_module_load@load.html
[94]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-5/igt@xe_module_load@load.html
[95]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-3/igt@xe_module_load@load.html
[96]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-3/igt@xe_module_load@load.html
[97]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-3/igt@xe_module_load@load.html
[98]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-8/igt@xe_module_load@load.html
[99]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-8/igt@xe_module_load@load.html
[100]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-8/igt@xe_module_load@load.html
[101]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-7/igt@xe_module_load@load.html
[102]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-7/igt@xe_module_load@load.html
[103]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-7/igt@xe_module_load@load.html
[104]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-4/igt@xe_module_load@load.html
[105]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-4/igt@xe_module_load@load.html
[106]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-4/igt@xe_module_load@load.html
[107]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-1/igt@xe_module_load@load.html
[108]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-lnl-2/igt@xe_module_load@load.html
[109]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-1/igt@xe_module_load@load.html
[110]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-1/igt@xe_module_load@load.html
[111]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-3/igt@xe_module_load@load.html
[112]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-3/igt@xe_module_load@load.html
[113]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-3/igt@xe_module_load@load.html
[114]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-1/igt@xe_module_load@load.html
[115]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-6/igt@xe_module_load@load.html
[116]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-6/igt@xe_module_load@load.html
[117]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-2/igt@xe_module_load@load.html
[118]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-7/igt@xe_module_load@load.html
[119]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-7/igt@xe_module_load@load.html
[120]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-8/igt@xe_module_load@load.html
[121]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-8/igt@xe_module_load@load.html
[122]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-2/igt@xe_module_load@load.html
[123]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-2/igt@xe_module_load@load.html
[124]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-4/igt@xe_module_load@load.html
[125]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-7/igt@xe_module_load@load.html
[126]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-5/igt@xe_module_load@load.html
[127]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-8/igt@xe_module_load@load.html
[128]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-4/igt@xe_module_load@load.html
[129]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-6/igt@xe_module_load@load.html
[130]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-4/igt@xe_module_load@load.html
[131]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-5/igt@xe_module_load@load.html
[132]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-5/igt@xe_module_load@load.html
[133]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-lnl-8/igt@xe_module_load@load.html
- shard-bmg: ([PASS][134], [SKIP][135], [PASS][136], [PASS][137], [PASS][138], [PASS][139], [PASS][140], [PASS][141], [PASS][142], [PASS][143], [PASS][144], [PASS][145], [PASS][146], [PASS][147], [PASS][148], [PASS][149], [PASS][150], [PASS][151], [PASS][152], [PASS][153], [PASS][154], [PASS][155], [PASS][156], [PASS][157], [PASS][158], [PASS][159]) ([Intel XE#2457] / [Intel XE#7405]) -> ([PASS][160], [PASS][161], [PASS][162], [PASS][163], [PASS][164], [PASS][165], [PASS][166], [PASS][167], [PASS][168], [PASS][169], [PASS][170], [PASS][171], [PASS][172], [PASS][173], [PASS][174], [PASS][175], [PASS][176], [PASS][177], [PASS][178], [PASS][179], [PASS][180], [PASS][181], [PASS][182], [PASS][183], [PASS][184])
[134]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-10/igt@xe_module_load@load.html
[135]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-3/igt@xe_module_load@load.html
[136]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-5/igt@xe_module_load@load.html
[137]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-4/igt@xe_module_load@load.html
[138]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-4/igt@xe_module_load@load.html
[139]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-9/igt@xe_module_load@load.html
[140]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-9/igt@xe_module_load@load.html
[141]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-3/igt@xe_module_load@load.html
[142]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-3/igt@xe_module_load@load.html
[143]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-3/igt@xe_module_load@load.html
[144]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@xe_module_load@load.html
[145]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-5/igt@xe_module_load@load.html
[146]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-5/igt@xe_module_load@load.html
[147]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-7/igt@xe_module_load@load.html
[148]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-8/igt@xe_module_load@load.html
[149]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-6/igt@xe_module_load@load.html
[150]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-6/igt@xe_module_load@load.html
[151]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-6/igt@xe_module_load@load.html
[152]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-10/igt@xe_module_load@load.html
[153]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-7/igt@xe_module_load@load.html
[154]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-10/igt@xe_module_load@load.html
[155]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-7/igt@xe_module_load@load.html
[156]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-4/igt@xe_module_load@load.html
[157]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@xe_module_load@load.html
[158]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@xe_module_load@load.html
[159]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-8/igt@xe_module_load@load.html
[160]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-3/igt@xe_module_load@load.html
[161]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-3/igt@xe_module_load@load.html
[162]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@xe_module_load@load.html
[163]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-9/igt@xe_module_load@load.html
[164]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-9/igt@xe_module_load@load.html
[165]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@xe_module_load@load.html
[166]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@xe_module_load@load.html
[167]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@xe_module_load@load.html
[168]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-2/igt@xe_module_load@load.html
[169]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-2/igt@xe_module_load@load.html
[170]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-6/igt@xe_module_load@load.html
[171]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-6/igt@xe_module_load@load.html
[172]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@xe_module_load@load.html
[173]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@xe_module_load@load.html
[174]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-10/igt@xe_module_load@load.html
[175]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-4/igt@xe_module_load@load.html
[176]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-4/igt@xe_module_load@load.html
[177]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-6/igt@xe_module_load@load.html
[178]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-9/igt@xe_module_load@load.html
[179]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-6/igt@xe_module_load@load.html
[180]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@xe_module_load@load.html
[181]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@xe_module_load@load.html
[182]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@xe_module_load@load.html
[183]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-10/igt@xe_module_load@load.html
[184]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@xe_module_load@load.html
* igt@xe_sriov_auto_provisioning@resources-released-on-vfs-disabling@numvfs-random:
- shard-bmg: [FAIL][185] ([Intel XE#5937]) -> [PASS][186] +1 other test pass
[185]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-4/igt@xe_sriov_auto_provisioning@resources-released-on-vfs-disabling@numvfs-random.html
[186]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@xe_sriov_auto_provisioning@resources-released-on-vfs-disabling@numvfs-random.html
#### Warnings ####
* igt@kms_big_fb@yf-tiled-16bpp-rotate-180:
- shard-bmg: [SKIP][187] ([Intel XE#6703]) -> [SKIP][188] ([Intel XE#1124])
[187]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_big_fb@yf-tiled-16bpp-rotate-180.html
[188]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-10/igt@kms_big_fb@yf-tiled-16bpp-rotate-180.html
* igt@kms_ccs@bad-aux-stride-y-tiled-gen12-mc-ccs:
- shard-bmg: [SKIP][189] ([Intel XE#6703]) -> [SKIP][190] ([Intel XE#2887]) +1 other test skip
[189]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_ccs@bad-aux-stride-y-tiled-gen12-mc-ccs.html
[190]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-6/igt@kms_ccs@bad-aux-stride-y-tiled-gen12-mc-ccs.html
* igt@kms_ccs@crc-sprite-planes-basic-4-tiled-lnl-ccs:
- shard-bmg: [SKIP][191] ([Intel XE#6703]) -> [SKIP][192] ([Intel XE#2652])
[191]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_ccs@crc-sprite-planes-basic-4-tiled-lnl-ccs.html
[192]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@kms_ccs@crc-sprite-planes-basic-4-tiled-lnl-ccs.html
* igt@kms_chamelium_hpd@hdmi-hpd-storm-disable:
- shard-bmg: [SKIP][193] ([Intel XE#6703]) -> [SKIP][194] ([Intel XE#2252]) +1 other test skip
[193]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_chamelium_hpd@hdmi-hpd-storm-disable.html
[194]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@kms_chamelium_hpd@hdmi-hpd-storm-disable.html
* igt@kms_content_protection@lic-type-0-hdcp14:
- shard-bmg: [SKIP][195] ([Intel XE#7194]) -> [FAIL][196] ([Intel XE#1178] / [Intel XE#3304] / [Intel XE#7374]) +1 other test fail
[195]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-5/igt@kms_content_protection@lic-type-0-hdcp14.html
[196]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@kms_content_protection@lic-type-0-hdcp14.html
* igt@kms_content_protection@srm:
- shard-bmg: [FAIL][197] ([Intel XE#1178] / [Intel XE#3304] / [Intel XE#7374]) -> [SKIP][198] ([Intel XE#2341])
[197]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-4/igt@kms_content_protection@srm.html
[198]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_content_protection@srm.html
* igt@kms_content_protection@uevent-hdcp14:
- shard-bmg: [FAIL][199] ([Intel XE#6707] / [Intel XE#7439]) -> [SKIP][200] ([Intel XE#7194])
[199]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-3/igt@kms_content_protection@uevent-hdcp14.html
[200]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_content_protection@uevent-hdcp14.html
* igt@kms_cursor_crc@cursor-sliding-64x21:
- shard-bmg: [SKIP][201] ([Intel XE#6703]) -> [SKIP][202] ([Intel XE#2320])
[201]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_cursor_crc@cursor-sliding-64x21.html
[202]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@kms_cursor_crc@cursor-sliding-64x21.html
* igt@kms_flip@2x-flip-vs-dpms-off-vs-modeset:
- shard-bmg: [SKIP][203] ([Intel XE#6703]) -> [SKIP][204] ([Intel XE#2316])
[203]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_flip@2x-flip-vs-dpms-off-vs-modeset.html
[204]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_flip@2x-flip-vs-dpms-off-vs-modeset.html
* igt@kms_flip_scaled_crc@flip-64bpp-yftile-to-32bpp-yftile-downscaling:
- shard-bmg: [SKIP][205] ([Intel XE#6557] / [Intel XE#6703]) -> [SKIP][206] ([Intel XE#7178] / [Intel XE#7351])
[205]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_flip_scaled_crc@flip-64bpp-yftile-to-32bpp-yftile-downscaling.html
[206]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-10/igt@kms_flip_scaled_crc@flip-64bpp-yftile-to-32bpp-yftile-downscaling.html
* igt@kms_frontbuffer_tracking@drrs-2p-scndscrn-pri-indfb-draw-mmap-wc:
- shard-bmg: [SKIP][207] ([Intel XE#2312]) -> [SKIP][208] ([Intel XE#2311]) +8 other tests skip
[207]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-5/igt@kms_frontbuffer_tracking@drrs-2p-scndscrn-pri-indfb-draw-mmap-wc.html
[208]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@kms_frontbuffer_tracking@drrs-2p-scndscrn-pri-indfb-draw-mmap-wc.html
* igt@kms_frontbuffer_tracking@fbc-1p-offscreen-pri-shrfb-draw-blt:
- shard-bmg: [SKIP][209] ([Intel XE#6703]) -> [SKIP][210] ([Intel XE#4141]) +2 other tests skip
[209]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_frontbuffer_tracking@fbc-1p-offscreen-pri-shrfb-draw-blt.html
[210]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-2/igt@kms_frontbuffer_tracking@fbc-1p-offscreen-pri-shrfb-draw-blt.html
* igt@kms_frontbuffer_tracking@fbc-2p-scndscrn-spr-indfb-draw-render:
- shard-bmg: [SKIP][211] ([Intel XE#4141]) -> [SKIP][212] ([Intel XE#2312]) +5 other tests skip
[211]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-3/igt@kms_frontbuffer_tracking@fbc-2p-scndscrn-spr-indfb-draw-render.html
[212]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_frontbuffer_tracking@fbc-2p-scndscrn-spr-indfb-draw-render.html
* igt@kms_frontbuffer_tracking@fbc-2p-scndscrn-spr-indfb-onoff:
- shard-bmg: [SKIP][213] ([Intel XE#2312]) -> [SKIP][214] ([Intel XE#4141]) +2 other tests skip
[213]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-5/igt@kms_frontbuffer_tracking@fbc-2p-scndscrn-spr-indfb-onoff.html
[214]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@kms_frontbuffer_tracking@fbc-2p-scndscrn-spr-indfb-onoff.html
* igt@kms_frontbuffer_tracking@fbcdrrs-2p-primscrn-indfb-msflip-blt:
- shard-bmg: [SKIP][215] ([Intel XE#6703]) -> [SKIP][216] ([Intel XE#2311]) +2 other tests skip
[215]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_frontbuffer_tracking@fbcdrrs-2p-primscrn-indfb-msflip-blt.html
[216]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-9/igt@kms_frontbuffer_tracking@fbcdrrs-2p-primscrn-indfb-msflip-blt.html
* igt@kms_frontbuffer_tracking@fbcdrrs-2p-primscrn-spr-indfb-onoff:
- shard-bmg: [SKIP][217] ([Intel XE#2311]) -> [SKIP][218] ([Intel XE#2312]) +8 other tests skip
[217]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-10/igt@kms_frontbuffer_tracking@fbcdrrs-2p-primscrn-spr-indfb-onoff.html
[218]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_frontbuffer_tracking@fbcdrrs-2p-primscrn-spr-indfb-onoff.html
* igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-shrfb-plflip-blt:
- shard-bmg: [SKIP][219] ([Intel XE#6703]) -> [SKIP][220] ([Intel XE#2312]) +1 other test skip
[219]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-shrfb-plflip-blt.html
[220]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-shrfb-plflip-blt.html
* igt@kms_frontbuffer_tracking@psr-1p-primscrn-cur-indfb-draw-render:
- shard-bmg: [SKIP][221] ([Intel XE#6703]) -> [SKIP][222] ([Intel XE#2313]) +1 other test skip
[221]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_frontbuffer_tracking@psr-1p-primscrn-cur-indfb-draw-render.html
[222]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_frontbuffer_tracking@psr-1p-primscrn-cur-indfb-draw-render.html
* igt@kms_frontbuffer_tracking@psr-2p-primscrn-spr-indfb-fullscreen:
- shard-bmg: [SKIP][223] ([Intel XE#2313]) -> [SKIP][224] ([Intel XE#2312]) +9 other tests skip
[223]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-3/igt@kms_frontbuffer_tracking@psr-2p-primscrn-spr-indfb-fullscreen.html
[224]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-5/igt@kms_frontbuffer_tracking@psr-2p-primscrn-spr-indfb-fullscreen.html
* igt@kms_frontbuffer_tracking@psr-2p-scndscrn-cur-indfb-onoff:
- shard-bmg: [SKIP][225] ([Intel XE#2312]) -> [SKIP][226] ([Intel XE#2313]) +5 other tests skip
[225]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-5/igt@kms_frontbuffer_tracking@psr-2p-scndscrn-cur-indfb-onoff.html
[226]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@kms_frontbuffer_tracking@psr-2p-scndscrn-cur-indfb-onoff.html
* igt@kms_frontbuffer_tracking@psr-abgr161616f-draw-blt:
- shard-bmg: [SKIP][227] ([Intel XE#6703]) -> [SKIP][228] ([Intel XE#7061] / [Intel XE#7356])
[227]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_frontbuffer_tracking@psr-abgr161616f-draw-blt.html
[228]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-6/igt@kms_frontbuffer_tracking@psr-abgr161616f-draw-blt.html
* igt@kms_hdr@brightness-with-hdr:
- shard-bmg: [SKIP][229] ([Intel XE#3544]) -> [SKIP][230] ([Intel XE#3374] / [Intel XE#3544])
[229]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-4/igt@kms_hdr@brightness-with-hdr.html
[230]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-3/igt@kms_hdr@brightness-with-hdr.html
* igt@kms_psr2_sf@psr2-overlay-plane-update-continuous-sf:
- shard-bmg: [SKIP][231] ([Intel XE#6703]) -> [SKIP][232] ([Intel XE#1489])
[231]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_psr2_sf@psr2-overlay-plane-update-continuous-sf.html
[232]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-2/igt@kms_psr2_sf@psr2-overlay-plane-update-continuous-sf.html
* igt@kms_psr@psr2-sprite-plane-onoff:
- shard-bmg: [SKIP][233] ([Intel XE#6703]) -> [SKIP][234] ([Intel XE#2234] / [Intel XE#2850]) +1 other test skip
[233]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_psr@psr2-sprite-plane-onoff.html
[234]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@kms_psr@psr2-sprite-plane-onoff.html
* igt@kms_setmode@basic-clone-single-crtc:
- shard-bmg: [SKIP][235] ([Intel XE#6703]) -> [SKIP][236] ([Intel XE#1435])
[235]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@kms_setmode@basic-clone-single-crtc.html
[236]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-9/igt@kms_setmode@basic-clone-single-crtc.html
* igt@xe_eudebug_online@stopped-thread:
- shard-bmg: [SKIP][237] ([Intel XE#6703]) -> [SKIP][238] ([Intel XE#4837] / [Intel XE#6665]) +2 other tests skip
[237]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@xe_eudebug_online@stopped-thread.html
[238]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-2/igt@xe_eudebug_online@stopped-thread.html
* igt@xe_exec_basic@multigpu-many-execqueues-many-vm-bindexecqueue-userptr-invalidate:
- shard-bmg: [SKIP][239] ([Intel XE#6703]) -> [SKIP][240] ([Intel XE#2322] / [Intel XE#7372])
[239]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@xe_exec_basic@multigpu-many-execqueues-many-vm-bindexecqueue-userptr-invalidate.html
[240]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@xe_exec_basic@multigpu-many-execqueues-many-vm-bindexecqueue-userptr-invalidate.html
* igt@xe_exec_fault_mode@many-execqueues-multi-queue-userptr-rebind-imm:
- shard-bmg: [SKIP][241] ([Intel XE#6703]) -> [SKIP][242] ([Intel XE#7136]) +1 other test skip
[241]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@xe_exec_fault_mode@many-execqueues-multi-queue-userptr-rebind-imm.html
[242]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-2/igt@xe_exec_fault_mode@many-execqueues-multi-queue-userptr-rebind-imm.html
* igt@xe_exec_multi_queue@many-execs-preempt-mode-priority-smem:
- shard-bmg: [SKIP][243] ([Intel XE#6703]) -> [SKIP][244] ([Intel XE#6874]) +2 other tests skip
[243]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@xe_exec_multi_queue@many-execs-preempt-mode-priority-smem.html
[244]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-8/igt@xe_exec_multi_queue@many-execs-preempt-mode-priority-smem.html
* igt@xe_exec_threads@threads-multi-queue-mixed-fd-rebind:
- shard-bmg: [SKIP][245] ([Intel XE#6703]) -> [SKIP][246] ([Intel XE#7138]) +1 other test skip
[245]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@xe_exec_threads@threads-multi-queue-mixed-fd-rebind.html
[246]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-7/igt@xe_exec_threads@threads-multi-queue-mixed-fd-rebind.html
* igt@xe_pxp@pxp-stale-queue-post-termination-irq:
- shard-bmg: [SKIP][247] ([Intel XE#6703]) -> [SKIP][248] ([Intel XE#4733] / [Intel XE#7417])
[247]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@xe_pxp@pxp-stale-queue-post-termination-irq.html
[248]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-6/igt@xe_pxp@pxp-stale-queue-post-termination-irq.html
* igt@xe_query@multigpu-query-invalid-size:
- shard-bmg: [SKIP][249] ([Intel XE#6703]) -> [SKIP][250] ([Intel XE#944])
[249]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132/shard-bmg-2/igt@xe_query@multigpu-query-invalid-size.html
[250]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/shard-bmg-4/igt@xe_query@multigpu-query-invalid-size.html
[Intel XE#1124]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/1124
[Intel XE#1178]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/1178
[Intel XE#1435]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/1435
[Intel XE#1469]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/1469
[Intel XE#1489]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/1489
[Intel XE#2234]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2234
[Intel XE#2236]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2236
[Intel XE#2252]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2252
[Intel XE#2291]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2291
[Intel XE#2311]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2311
[Intel XE#2312]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2312
[Intel XE#2313]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2313
[Intel XE#2314]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2314
[Intel XE#2316]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2316
[Intel XE#2320]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2320
[Intel XE#2321]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2321
[Intel XE#2322]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2322
[Intel XE#2327]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2327
[Intel XE#2341]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2341
[Intel XE#2350]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2350
[Intel XE#2352]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2352
[Intel XE#2373]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2373
[Intel XE#2457]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2457
[Intel XE#2504]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2504
[Intel XE#2652]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2652
[Intel XE#2685]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2685
[Intel XE#2850]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2850
[Intel XE#2887]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2887
[Intel XE#2894]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2894
[Intel XE#301]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/301
[Intel XE#309]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/309
[Intel XE#3304]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/3304
[Intel XE#3307]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/3307
[Intel XE#3374]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/3374
[Intel XE#3414]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/3414
[Intel XE#3432]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/3432
[Intel XE#3544]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/3544
[Intel XE#367]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/367
[Intel XE#378]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/378
[Intel XE#3904]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/3904
[Intel XE#4141]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/4141
[Intel XE#4210]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/4210
[Intel XE#4596]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/4596
[Intel XE#4692]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/4692
[Intel XE#4733]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/4733
[Intel XE#4837]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/4837
[Intel XE#5545]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/5545
[Intel XE#5625]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/5625
[Intel XE#584]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/584
[Intel XE#5937]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/5937
[Intel XE#6312]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6312
[Intel XE#6321]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6321
[Intel XE#6503]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6503
[Intel XE#651]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/651
[Intel XE#6540]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6540
[Intel XE#6557]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6557
[Intel XE#6652]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6652
[Intel XE#6665]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6665
[Intel XE#6703]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6703
[Intel XE#6707]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6707
[Intel XE#6747]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6747
[Intel XE#6874]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6874
[Intel XE#688]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/688
[Intel XE#7061]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7061
[Intel XE#7086]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7086
[Intel XE#7136]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7136
[Intel XE#7138]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7138
[Intel XE#7140]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7140
[Intel XE#7178]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7178
[Intel XE#7194]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7194
[Intel XE#7319]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7319
[Intel XE#7342]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7342
[Intel XE#7343]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7343
[Intel XE#7344]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7344
[Intel XE#7349]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7349
[Intel XE#7350]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7350
[Intel XE#7351]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7351
[Intel XE#7354]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7354
[Intel XE#7355]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7355
[Intel XE#7356]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7356
[Intel XE#7369]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7369
[Intel XE#7372]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7372
[Intel XE#7373]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7373
[Intel XE#7374]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7374
[Intel XE#7399]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7399
[Intel XE#7405]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7405
[Intel XE#7417]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7417
[Intel XE#7439]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7439
[Intel XE#7467]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7467
[Intel XE#7482]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7482
[Intel XE#7503]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7503
[Intel XE#7508]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7508
[Intel XE#944]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/944
Build changes
-------------
* IGT: IGT_8801 -> IGT_8802
* Linux: xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132 -> xe-pw-162134v2
IGT_8801: 246d93c1df887e151d038cee9eb0fc31650c4fb0 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git
IGT_8802: 8802
xe-4713-45618ec6cfed86e72cf6c2325c8f947bfbe7c132: 45618ec6cfed86e72cf6c2325c8f947bfbe7c132
xe-pw-162134v2: 162134v2
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v2/index.html
[-- Attachment #2: Type: text/html, Size: 66616 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-13 15:17 ` [PATCH v2 1/1] drm: " Maarten Lankhorst
@ 2026-03-17 15:26 ` Thomas Hellström
2026-03-17 15:39 ` Maarten Lankhorst
2026-03-25 17:26 ` Guenter Roeck
1 sibling, 1 reply; 33+ messages in thread
From: Thomas Hellström @ 2026-03-17 15:26 UTC (permalink / raw)
To: Maarten Lankhorst, dri-devel; +Cc: intel-xe
On Fri, 2026-03-13 at 16:17 +0100, Maarten Lankhorst wrote:
> When trying to do a rather aggressive test of igt's "xe_module_load
> --r reload" with a full desktop environment and game running I
> noticed
> a few OOPSes when dereferencing freed pointers, related to
> framebuffers and property blobs after the compositor exits.
>
> Solve this by guarding the freeing in drm_file with
> drm_dev_enter/exit,
> and immediately put the references from struct drm_file objects
> during
> drm_dev_unplug().
>
> Related warnings for framebuffers on the subtest:
> [ 739.713076] ------------[ cut here ]------------
> WARN_ON(!list_empty(&dev->mode_config.fb_list))
> [ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at
> drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12:
> xe_module_load/13145
> ....
> [ 739.713328] Call Trace:
> [ 739.713330] <TASK>
> [ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe]
> [ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe]
> [ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
> [ 739.714041] xe_display_fini_early+0x33/0x50 [xe]
> [ 739.714284] devm_action_release+0xf/0x20
> [ 739.714294] devres_release_all+0xad/0xf0
> [ 739.714301] device_unbind_cleanup+0x12/0xa0
> [ 739.714305] device_release_driver_internal+0x1b7/0x210
> [ 739.714311] device_driver_detach+0x14/0x20
> [ 739.714315] unbind_store+0xa6/0xb0
> [ 739.714319] drv_attr_store+0x21/0x30
> [ 739.714322] sysfs_kf_write+0x48/0x60
> [ 739.714328] kernfs_fop_write_iter+0x16b/0x240
> [ 739.714333] vfs_write+0x266/0x520
> [ 739.714341] ksys_write+0x72/0xe0
> [ 739.714345] __x64_sys_write+0x19/0x20
> [ 739.714347] x64_sys_call+0xa15/0xa30
> [ 739.714355] do_syscall_64+0xd8/0xab0
> [ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53
>
> and
>
> [ 739.714459] ------------[ cut here ]------------
> [ 739.714461] xe 0000:67:00.0: [drm] drm_WARN_ON(!list_empty(&fb-
> >filp_head))
> [ 739.714464] WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at
> drm_framebuffer_free+0x6c/0x90 [drm], CPU#12: xe_module_load/13145
> [ 739.714715] RIP: 0010:drm_framebuffer_free+0x7a/0x90 [drm]
> ...
> [ 739.714869] Call Trace:
> [ 739.714871] <TASK>
> [ 739.714876] drm_mode_config_cleanup+0x26a/0x320 [drm]
> [ 739.714998] ? __drm_printfn_seq_file+0x20/0x20 [drm]
> [ 739.715115] ? drm_mode_config_cleanup+0x207/0x320 [drm]
> [ 739.715235] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
> [ 739.715576] xe_display_fini_early+0x33/0x50 [xe]
> [ 739.715821] devm_action_release+0xf/0x20
> [ 739.715828] devres_release_all+0xad/0xf0
> [ 739.715843] device_unbind_cleanup+0x12/0xa0
> [ 739.715850] device_release_driver_internal+0x1b7/0x210
> [ 739.715856] device_driver_detach+0x14/0x20
> [ 739.715860] unbind_store+0xa6/0xb0
> [ 739.715865] drv_attr_store+0x21/0x30
> [ 739.715868] sysfs_kf_write+0x48/0x60
> [ 739.715873] kernfs_fop_write_iter+0x16b/0x240
> [ 739.715878] vfs_write+0x266/0x520
> [ 739.715886] ksys_write+0x72/0xe0
> [ 739.715890] __x64_sys_write+0x19/0x20
> [ 739.715893] x64_sys_call+0xa15/0xa30
> [ 739.715900] do_syscall_64+0xd8/0xab0
> [ 739.715905] entry_SYSCALL_64_after_hwframe+0x4b/0x53
>
> and then finally file close blows up:
>
> [ 743.186530] Oops: general protection fault, probably for non-
> canonical address 0xdead000000000122: 0000 [#1] SMP
> [ 743.186535] CPU: 3 UID: 1000 PID: 3453 Comm: kwin_wayland Tainted:
> G W 7.0.0-rc1-valkyria+ #110 PREEMPT_{RT,(lazy)}
> [ 743.186537] Tainted: [W]=WARN
> [ 743.186538] Hardware name: Gigabyte Technology Co., Ltd. X299
> AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
> [ 743.186539] RIP: 0010:drm_framebuffer_cleanup+0x55/0xc0 [drm]
> [ 743.186588] Code: d8 72 73 0f b6 42 05 ff c3 39 c3 72 e8 49 8d bd
> 50 07 00 00 31 f6 e8 3a 80 d3 e1 49 8b 44 24 10 49 8d 7c 24 08 49 8b
> 54 24 08 <48> 3b 38 0f 85 95 7f 02 00 48 3b 7a 08 0f 85 8b 7f 02 00
> 48 89 42
> [ 743.186589] RSP: 0018:ffffc900085e3cf8 EFLAGS: 00010202
> [ 743.186591] RAX: dead000000000122 RBX: 0000000000000001 RCX:
> ffffffff8217ed03
> [ 743.186592] RDX: dead000000000100 RSI: 0000000000000000 RDI:
> ffff88814675ba08
> [ 743.186593] RBP: ffffc900085e3d10 R08: 0000000000000000 R09:
> 0000000000000000
> [ 743.186593] R10: 0000000000000000 R11: 0000000000000000 R12:
> ffff88814675ba00
> [ 743.186594] R13: ffff88810d778000 R14: ffff888119f6dca0 R15:
> ffff88810c660bb0
> [ 743.186595] FS: 00007ff377d21280(0000) GS:ffff888cec3f8000(0000)
> knlGS:0000000000000000
> [ 743.186596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 743.186596] CR2: 000055690b55e000 CR3: 0000000113586003 CR4:
> 00000000003706f0
> [ 743.186597] Call Trace:
> [ 743.186598] <TASK>
> [ 743.186603] intel_user_framebuffer_destroy+0x12/0x90 [xe]
> [ 743.186722] drm_framebuffer_free+0x3a/0x90 [drm]
> [ 743.186750] ? trace_hardirqs_on+0x5f/0x120
> [ 743.186754] drm_mode_object_put+0x51/0x70 [drm]
> [ 743.186786] drm_fb_release+0x105/0x190 [drm]
> [ 743.186812] ? rt_mutex_slowunlock+0x3aa/0x410
> [ 743.186817] ? rt_spin_lock+0xea/0x1b0
> [ 743.186819] drm_file_free+0x1e0/0x2c0 [drm]
> [ 743.186843] drm_release_noglobal+0x91/0xf0 [drm]
> [ 743.186865] __fput+0x100/0x2e0
> [ 743.186869] fput_close_sync+0x40/0xa0
> [ 743.186870] __x64_sys_close+0x3e/0x80
> [ 743.186873] x64_sys_call+0xa07/0xa30
> [ 743.186879] do_syscall_64+0xd8/0xab0
> [ 743.186881] entry_SYSCALL_64_after_hwframe+0x4b/0x53
> [ 743.186882] RIP: 0033:0x7ff37e567732
> [ 743.186884] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7
> 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24
> 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55
> bf 01 00
> [ 743.186885] RSP: 002b:00007ffc818169a8 EFLAGS: 00000246 ORIG_RAX:
> 0000000000000003
> [ 743.186886] RAX: ffffffffffffffda RBX: 00007ffc81816a30 RCX:
> 00007ff37e567732
> [ 743.186887] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
> 0000000000000012
> [ 743.186888] RBP: 00007ffc818169d0 R08: 0000000000000000 R09:
> 0000000000000000
> [ 743.186889] R10: 0000000000000000 R11: 0000000000000246 R12:
> 000055d60a7996e0
> [ 743.186889] R13: 00007ffc81816a90 R14: 00007ffc81816a90 R15:
> 000055d60a782a30
> [ 743.186892] </TASK>
> [ 743.186893] Modules linked in: rfcomm snd_hrtimer xt_CHECKSUM
> xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp
> xt_addrtype nft_compat x_tables nft_chain_nat nf_nat nf_conntrack
> nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep
> mtd_intel_dg snd_hda_codec_intelhdmi mtd snd_hda_codec_hdmi nls_utf8
> mxm_wmi intel_wmi_thunderbolt gigabyte_wmi wmi_bmof xe drm_gpuvm
> drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video
> drm_suballoc_helper gpu_sched drm_client_lib drm_exec
> drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit
> x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882
> snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel
> snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec
> snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress
> ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 i2c_mux
> snd i2c_smbus btusb btrtl btbcm btmtk btintel bluetooth ecdh_generic
> rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink
> [ 743.186938] ---[ end trace 0000000000000000 ]---
>
> And for property blobs:
>
> void drm_mode_config_cleanup(struct drm_device *dev)
> {
> ...
> list_for_each_entry_safe(blob, bt, &dev-
> >mode_config.property_blob_list,
> head_global) {
> drm_property_blob_put(blob);
> }
>
> Resulting in:
>
> [ 371.072940] BUG: unable to handle page fault for address:
> 000001ffffffffff
> [ 371.072944] #PF: supervisor read access in kernel mode
> [ 371.072945] #PF: error_code(0x0000) - not-present page
> [ 371.072947] PGD 0 P4D 0
> [ 371.072950] Oops: Oops: 0000 [#1] SMP
> [ 371.072953] CPU: 0 UID: 1000 PID: 3693 Comm: kwin_wayland Not
> tainted 7.0.0-rc1-valkyria+ #111 PREEMPT_{RT,(lazy)}
> [ 371.072956] Hardware name: Gigabyte Technology Co., Ltd. X299
> AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
> [ 371.072957] RIP: 0010:drm_property_destroy_user_blobs+0x3b/0x90
> [drm]
> [ 371.073019] Code: 00 00 48 83 ec 10 48 8b 86 30 01 00 00 48 39 c3
> 74 59 48 89 c2 48 8d 48 c8 48 8b 00 4c 8d 60 c8 eb 04 4c 8d 60 c8 48
> 8b 71 40 <48> 39 16 0f 85 39 32 01 00 48 3b 50 08 0f 85 2f 32 01 00
> 48 89 70
> [ 371.073021] RSP: 0018:ffffc90006a73de8 EFLAGS: 00010293
> [ 371.073022] RAX: 000001ffffffffff RBX: ffff888118a1a930 RCX:
> ffff8881b92355c0
> [ 371.073024] RDX: ffff8881b92355f8 RSI: 000001ffffffffff RDI:
> ffff888118be4000
> [ 371.073025] RBP: ffffc90006a73e08 R08: ffff8881009b7300 R09:
> ffff888cecc5b000
> [ 371.073026] R10: ffffc90006a73e90 R11: 0000000000000002 R12:
> 000001ffffffffc7
> [ 371.073027] R13: ffff888118a1a980 R14: ffff88810b366d20 R15:
> ffff888118a1a970
> [ 371.073028] FS: 00007f1faccbb280(0000) GS:ffff888cec2db000(0000)
> knlGS:0000000000000000
> [ 371.073029] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 371.073030] CR2: 000001ffffffffff CR3: 000000010655c001 CR4:
> 00000000003706f0
> [ 371.073031] Call Trace:
> [ 371.073033] <TASK>
> [ 371.073036] drm_file_free+0x1df/0x2a0 [drm]
> [ 371.073077] drm_release_noglobal+0x7a/0xe0 [drm]
> [ 371.073113] __fput+0xe2/0x2b0
> [ 371.073118] fput_close_sync+0x40/0xa0
> [ 371.073119] __x64_sys_close+0x3e/0x80
> [ 371.073122] x64_sys_call+0xa07/0xa30
> [ 371.073126] do_syscall_64+0xc0/0x840
> [ 371.073130] entry_SYSCALL_64_after_hwframe+0x4b/0x53
> [ 371.073132] RIP: 0033:0x7f1fb3501732
> [ 371.073133] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7
> 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24
> 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55
> bf 01 00
> [ 371.073135] RSP: 002b:00007ffe8e6f0278 EFLAGS: 00000246 ORIG_RAX:
> 0000000000000003
> [ 371.073136] RAX: ffffffffffffffda RBX: 00007ffe8e6f0300 RCX:
> 00007f1fb3501732
> [ 371.073137] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
> 0000000000000012
> [ 371.073138] RBP: 00007ffe8e6f02a0 R08: 0000000000000000 R09:
> 0000000000000000
> [ 371.073139] R10: 0000000000000000 R11: 0000000000000246 R12:
> 00005585ba46eea0
> [ 371.073140] R13: 00007ffe8e6f0360 R14: 00007ffe8e6f0360 R15:
> 00005585ba458a30
> [ 371.073143] </TASK>
> [ 371.073144] Modules linked in: rfcomm snd_hrtimer xt_addrtype
> xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4
> xt_tcpudp nft_compat x_tables nft_chain_nat nf_nat nf_conntrack
> nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep
> snd_hda_codec_intelhdmi snd_hda_codec_hdmi mtd_intel_dg mtd nls_utf8
> wmi_bmof mxm_wmi gigabyte_wmi intel_wmi_thunderbolt xe drm_gpuvm
> drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video
> drm_suballoc_helper gpu_sched drm_client_lib drm_exec
> drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit
> x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882
> snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel
> snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec
> snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress
> ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 btusb
> i2c_mux i2c_smbus btrtl snd btbcm btmtk btintel bluetooth
> ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev
> fuse nfnetlink
> [ 371.073198] CR2: 000001ffffffffff
> [ 371.073199] ---[ end trace 0000000000000000 ]---
>
> Add a guard around file close, and ensure the warnings from
> drm_mode_config
> do not trigger. Fix those by allowing an open reference to the file
> descriptor
> and cleaning up the file linked list entry in
> drm_mode_config_cleanup().
>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
> ---
> drivers/gpu/drm/drm_file.c | 5 ++++-
> drivers/gpu/drm/drm_mode_config.c | 9 ++++++---
> 2 files changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
> index ec820686b3021..f52141f842a1f 100644
> --- a/drivers/gpu/drm/drm_file.c
> +++ b/drivers/gpu/drm/drm_file.c
> @@ -233,6 +233,7 @@ static void drm_events_release(struct drm_file
> *file_priv)
> void drm_file_free(struct drm_file *file)
> {
> struct drm_device *dev;
> + int idx;
>
> if (!file)
> return;
> @@ -249,9 +250,11 @@ void drm_file_free(struct drm_file *file)
>
> drm_events_release(file);
>
> - if (drm_core_check_feature(dev, DRIVER_MODESET)) {
> + if (drm_core_check_feature(dev, DRIVER_MODESET) &&
> + drm_dev_enter(dev, &idx)) {
> drm_fb_release(file);
> drm_property_destroy_user_blobs(dev, file);
> + drm_dev_exit(idx);
> }
>
> if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
> diff --git a/drivers/gpu/drm/drm_mode_config.c
> b/drivers/gpu/drm/drm_mode_config.c
> index 84ae8a23a3678..e349418978f79 100644
> --- a/drivers/gpu/drm/drm_mode_config.c
> +++ b/drivers/gpu/drm/drm_mode_config.c
> @@ -583,10 +583,13 @@ void drm_mode_config_cleanup(struct drm_device
> *dev)
> */
> WARN_ON(!list_empty(&dev->mode_config.fb_list));
> list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list,
> head) {
> - struct drm_printer p = drm_dbg_printer(dev,
> DRM_UT_KMS, "[leaked fb]");
> + if (list_empty(&fb->filp_head) ||
> drm_framebuffer_read_refcount(fb) > 1) {
This looks a bit scary. Can someone manipulate the fb_list and even
free fbs while we are iterating? Or is all other manipulation blocked
by the device being unplugged?
> + struct drm_printer p = drm_dbg_printer(dev,
> DRM_UT_KMS, "[leaked fb]");
>
> - drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
> - drm_framebuffer_print_info(&p, 1, fb);
> + drm_printf(&p, "framebuffer[%u]:\n", fb-
> >base.id);
> + drm_framebuffer_print_info(&p, 1, fb);
> + }
> + list_del_init(&fb->filp_head);
> drm_framebuffer_free(&fb->base.refcount);
> }
>
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-17 15:26 ` Thomas Hellström
@ 2026-03-17 15:39 ` Maarten Lankhorst
2026-03-17 15:43 ` Hellstrom, Thomas
0 siblings, 1 reply; 33+ messages in thread
From: Maarten Lankhorst @ 2026-03-17 15:39 UTC (permalink / raw)
To: Thomas Hellström, dri-devel; +Cc: intel-xe
Den 2026-03-17 kl. 16:26, skrev Thomas Hellström:
> On Fri, 2026-03-13 at 16:17 +0100, Maarten Lankhorst wrote:
>> When trying to do a rather aggressive test of igt's "xe_module_load
>> --r reload" with a full desktop environment and game running I
>> noticed
>> a few OOPSes when dereferencing freed pointers, related to
>> framebuffers and property blobs after the compositor exits.
>>
>> Solve this by guarding the freeing in drm_file with
>> drm_dev_enter/exit,
>> and immediately put the references from struct drm_file objects
>> during
>> drm_dev_unplug().
>>
>> Related warnings for framebuffers on the subtest:
>> [ 739.713076] ------------[ cut here ]------------
>> WARN_ON(!list_empty(&dev->mode_config.fb_list))
>> [ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at
>> drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12:
>> xe_module_load/13145
>> ....
>> [ 739.713328] Call Trace:
>> [ 739.713330] <TASK>
>> [ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe]
>> [ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe]
>> [ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
>> [ 739.714041] xe_display_fini_early+0x33/0x50 [xe]
>> [ 739.714284] devm_action_release+0xf/0x20
>> [ 739.714294] devres_release_all+0xad/0xf0
>> [ 739.714301] device_unbind_cleanup+0x12/0xa0
>> [ 739.714305] device_release_driver_internal+0x1b7/0x210
>> [ 739.714311] device_driver_detach+0x14/0x20
>> [ 739.714315] unbind_store+0xa6/0xb0
>> [ 739.714319] drv_attr_store+0x21/0x30
>> [ 739.714322] sysfs_kf_write+0x48/0x60
>> [ 739.714328] kernfs_fop_write_iter+0x16b/0x240
>> [ 739.714333] vfs_write+0x266/0x520
>> [ 739.714341] ksys_write+0x72/0xe0
>> [ 739.714345] __x64_sys_write+0x19/0x20
>> [ 739.714347] x64_sys_call+0xa15/0xa30
>> [ 739.714355] do_syscall_64+0xd8/0xab0
>> [ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53
>>
>> and
>>
>> [ 739.714459] ------------[ cut here ]------------
>> [ 739.714461] xe 0000:67:00.0: [drm] drm_WARN_ON(!list_empty(&fb-
>>> filp_head))
>> [ 739.714464] WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at
>> drm_framebuffer_free+0x6c/0x90 [drm], CPU#12: xe_module_load/13145
>> [ 739.714715] RIP: 0010:drm_framebuffer_free+0x7a/0x90 [drm]
>> ...
>> [ 739.714869] Call Trace:
>> [ 739.714871] <TASK>
>> [ 739.714876] drm_mode_config_cleanup+0x26a/0x320 [drm]
>> [ 739.714998] ? __drm_printfn_seq_file+0x20/0x20 [drm]
>> [ 739.715115] ? drm_mode_config_cleanup+0x207/0x320 [drm]
>> [ 739.715235] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
>> [ 739.715576] xe_display_fini_early+0x33/0x50 [xe]
>> [ 739.715821] devm_action_release+0xf/0x20
>> [ 739.715828] devres_release_all+0xad/0xf0
>> [ 739.715843] device_unbind_cleanup+0x12/0xa0
>> [ 739.715850] device_release_driver_internal+0x1b7/0x210
>> [ 739.715856] device_driver_detach+0x14/0x20
>> [ 739.715860] unbind_store+0xa6/0xb0
>> [ 739.715865] drv_attr_store+0x21/0x30
>> [ 739.715868] sysfs_kf_write+0x48/0x60
>> [ 739.715873] kernfs_fop_write_iter+0x16b/0x240
>> [ 739.715878] vfs_write+0x266/0x520
>> [ 739.715886] ksys_write+0x72/0xe0
>> [ 739.715890] __x64_sys_write+0x19/0x20
>> [ 739.715893] x64_sys_call+0xa15/0xa30
>> [ 739.715900] do_syscall_64+0xd8/0xab0
>> [ 739.715905] entry_SYSCALL_64_after_hwframe+0x4b/0x53
>>
>> and then finally file close blows up:
>>
>> [ 743.186530] Oops: general protection fault, probably for non-
>> canonical address 0xdead000000000122: 0000 [#1] SMP
>> [ 743.186535] CPU: 3 UID: 1000 PID: 3453 Comm: kwin_wayland Tainted:
>> G W 7.0.0-rc1-valkyria+ #110 PREEMPT_{RT,(lazy)}
>> [ 743.186537] Tainted: [W]=WARN
>> [ 743.186538] Hardware name: Gigabyte Technology Co., Ltd. X299
>> AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
>> [ 743.186539] RIP: 0010:drm_framebuffer_cleanup+0x55/0xc0 [drm]
>> [ 743.186588] Code: d8 72 73 0f b6 42 05 ff c3 39 c3 72 e8 49 8d bd
>> 50 07 00 00 31 f6 e8 3a 80 d3 e1 49 8b 44 24 10 49 8d 7c 24 08 49 8b
>> 54 24 08 <48> 3b 38 0f 85 95 7f 02 00 48 3b 7a 08 0f 85 8b 7f 02 00
>> 48 89 42
>> [ 743.186589] RSP: 0018:ffffc900085e3cf8 EFLAGS: 00010202
>> [ 743.186591] RAX: dead000000000122 RBX: 0000000000000001 RCX:
>> ffffffff8217ed03
>> [ 743.186592] RDX: dead000000000100 RSI: 0000000000000000 RDI:
>> ffff88814675ba08
>> [ 743.186593] RBP: ffffc900085e3d10 R08: 0000000000000000 R09:
>> 0000000000000000
>> [ 743.186593] R10: 0000000000000000 R11: 0000000000000000 R12:
>> ffff88814675ba00
>> [ 743.186594] R13: ffff88810d778000 R14: ffff888119f6dca0 R15:
>> ffff88810c660bb0
>> [ 743.186595] FS: 00007ff377d21280(0000) GS:ffff888cec3f8000(0000)
>> knlGS:0000000000000000
>> [ 743.186596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 743.186596] CR2: 000055690b55e000 CR3: 0000000113586003 CR4:
>> 00000000003706f0
>> [ 743.186597] Call Trace:
>> [ 743.186598] <TASK>
>> [ 743.186603] intel_user_framebuffer_destroy+0x12/0x90 [xe]
>> [ 743.186722] drm_framebuffer_free+0x3a/0x90 [drm]
>> [ 743.186750] ? trace_hardirqs_on+0x5f/0x120
>> [ 743.186754] drm_mode_object_put+0x51/0x70 [drm]
>> [ 743.186786] drm_fb_release+0x105/0x190 [drm]
>> [ 743.186812] ? rt_mutex_slowunlock+0x3aa/0x410
>> [ 743.186817] ? rt_spin_lock+0xea/0x1b0
>> [ 743.186819] drm_file_free+0x1e0/0x2c0 [drm]
>> [ 743.186843] drm_release_noglobal+0x91/0xf0 [drm]
>> [ 743.186865] __fput+0x100/0x2e0
>> [ 743.186869] fput_close_sync+0x40/0xa0
>> [ 743.186870] __x64_sys_close+0x3e/0x80
>> [ 743.186873] x64_sys_call+0xa07/0xa30
>> [ 743.186879] do_syscall_64+0xd8/0xab0
>> [ 743.186881] entry_SYSCALL_64_after_hwframe+0x4b/0x53
>> [ 743.186882] RIP: 0033:0x7ff37e567732
>> [ 743.186884] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7
>> 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24
>> 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55
>> bf 01 00
>> [ 743.186885] RSP: 002b:00007ffc818169a8 EFLAGS: 00000246 ORIG_RAX:
>> 0000000000000003
>> [ 743.186886] RAX: ffffffffffffffda RBX: 00007ffc81816a30 RCX:
>> 00007ff37e567732
>> [ 743.186887] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
>> 0000000000000012
>> [ 743.186888] RBP: 00007ffc818169d0 R08: 0000000000000000 R09:
>> 0000000000000000
>> [ 743.186889] R10: 0000000000000000 R11: 0000000000000246 R12:
>> 000055d60a7996e0
>> [ 743.186889] R13: 00007ffc81816a90 R14: 00007ffc81816a90 R15:
>> 000055d60a782a30
>> [ 743.186892] </TASK>
>> [ 743.186893] Modules linked in: rfcomm snd_hrtimer xt_CHECKSUM
>> xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp
>> xt_addrtype nft_compat x_tables nft_chain_nat nf_nat nf_conntrack
>> nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep
>> mtd_intel_dg snd_hda_codec_intelhdmi mtd snd_hda_codec_hdmi nls_utf8
>> mxm_wmi intel_wmi_thunderbolt gigabyte_wmi wmi_bmof xe drm_gpuvm
>> drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video
>> drm_suballoc_helper gpu_sched drm_client_lib drm_exec
>> drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit
>> x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882
>> snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel
>> snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec
>> snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress
>> ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 i2c_mux
>> snd i2c_smbus btusb btrtl btbcm btmtk btintel bluetooth ecdh_generic
>> rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse nfnetlink
>> [ 743.186938] ---[ end trace 0000000000000000 ]---
>>
>> And for property blobs:
>>
>> void drm_mode_config_cleanup(struct drm_device *dev)
>> {
>> ...
>> list_for_each_entry_safe(blob, bt, &dev-
>>> mode_config.property_blob_list,
>> head_global) {
>> drm_property_blob_put(blob);
>> }
>>
>> Resulting in:
>>
>> [ 371.072940] BUG: unable to handle page fault for address:
>> 000001ffffffffff
>> [ 371.072944] #PF: supervisor read access in kernel mode
>> [ 371.072945] #PF: error_code(0x0000) - not-present page
>> [ 371.072947] PGD 0 P4D 0
>> [ 371.072950] Oops: Oops: 0000 [#1] SMP
>> [ 371.072953] CPU: 0 UID: 1000 PID: 3693 Comm: kwin_wayland Not
>> tainted 7.0.0-rc1-valkyria+ #111 PREEMPT_{RT,(lazy)}
>> [ 371.072956] Hardware name: Gigabyte Technology Co., Ltd. X299
>> AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
>> [ 371.072957] RIP: 0010:drm_property_destroy_user_blobs+0x3b/0x90
>> [drm]
>> [ 371.073019] Code: 00 00 48 83 ec 10 48 8b 86 30 01 00 00 48 39 c3
>> 74 59 48 89 c2 48 8d 48 c8 48 8b 00 4c 8d 60 c8 eb 04 4c 8d 60 c8 48
>> 8b 71 40 <48> 39 16 0f 85 39 32 01 00 48 3b 50 08 0f 85 2f 32 01 00
>> 48 89 70
>> [ 371.073021] RSP: 0018:ffffc90006a73de8 EFLAGS: 00010293
>> [ 371.073022] RAX: 000001ffffffffff RBX: ffff888118a1a930 RCX:
>> ffff8881b92355c0
>> [ 371.073024] RDX: ffff8881b92355f8 RSI: 000001ffffffffff RDI:
>> ffff888118be4000
>> [ 371.073025] RBP: ffffc90006a73e08 R08: ffff8881009b7300 R09:
>> ffff888cecc5b000
>> [ 371.073026] R10: ffffc90006a73e90 R11: 0000000000000002 R12:
>> 000001ffffffffc7
>> [ 371.073027] R13: ffff888118a1a980 R14: ffff88810b366d20 R15:
>> ffff888118a1a970
>> [ 371.073028] FS: 00007f1faccbb280(0000) GS:ffff888cec2db000(0000)
>> knlGS:0000000000000000
>> [ 371.073029] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 371.073030] CR2: 000001ffffffffff CR3: 000000010655c001 CR4:
>> 00000000003706f0
>> [ 371.073031] Call Trace:
>> [ 371.073033] <TASK>
>> [ 371.073036] drm_file_free+0x1df/0x2a0 [drm]
>> [ 371.073077] drm_release_noglobal+0x7a/0xe0 [drm]
>> [ 371.073113] __fput+0xe2/0x2b0
>> [ 371.073118] fput_close_sync+0x40/0xa0
>> [ 371.073119] __x64_sys_close+0x3e/0x80
>> [ 371.073122] x64_sys_call+0xa07/0xa30
>> [ 371.073126] do_syscall_64+0xc0/0x840
>> [ 371.073130] entry_SYSCALL_64_after_hwframe+0x4b/0x53
>> [ 371.073132] RIP: 0033:0x7f1fb3501732
>> [ 371.073133] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89 d7
>> 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24
>> 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55
>> bf 01 00
>> [ 371.073135] RSP: 002b:00007ffe8e6f0278 EFLAGS: 00000246 ORIG_RAX:
>> 0000000000000003
>> [ 371.073136] RAX: ffffffffffffffda RBX: 00007ffe8e6f0300 RCX:
>> 00007f1fb3501732
>> [ 371.073137] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
>> 0000000000000012
>> [ 371.073138] RBP: 00007ffe8e6f02a0 R08: 0000000000000000 R09:
>> 0000000000000000
>> [ 371.073139] R10: 0000000000000000 R11: 0000000000000246 R12:
>> 00005585ba46eea0
>> [ 371.073140] R13: 00007ffe8e6f0360 R14: 00007ffe8e6f0360 R15:
>> 00005585ba458a30
>> [ 371.073143] </TASK>
>> [ 371.073144] Modules linked in: rfcomm snd_hrtimer xt_addrtype
>> xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4
>> xt_tcpudp nft_compat x_tables nft_chain_nat nf_nat nf_conntrack
>> nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep
>> snd_hda_codec_intelhdmi snd_hda_codec_hdmi mtd_intel_dg mtd nls_utf8
>> wmi_bmof mxm_wmi gigabyte_wmi intel_wmi_thunderbolt xe drm_gpuvm
>> drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video
>> drm_suballoc_helper gpu_sched drm_client_lib drm_exec
>> drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit
>> x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_alc882
>> snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel
>> snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec
>> snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress
>> ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 btusb
>> i2c_mux i2c_smbus btrtl snd btbcm btmtk btintel bluetooth
>> ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev
>> fuse nfnetlink
>> [ 371.073198] CR2: 000001ffffffffff
>> [ 371.073199] ---[ end trace 0000000000000000 ]---
>>
>> Add a guard around file close, and ensure the warnings from
>> drm_mode_config
>> do not trigger. Fix those by allowing an open reference to the file
>> descriptor
>> and cleaning up the file linked list entry in
>> drm_mode_config_cleanup().
>>
>> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>> Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
>> ---
>> drivers/gpu/drm/drm_file.c | 5 ++++-
>> drivers/gpu/drm/drm_mode_config.c | 9 ++++++---
>> 2 files changed, 10 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
>> index ec820686b3021..f52141f842a1f 100644
>> --- a/drivers/gpu/drm/drm_file.c
>> +++ b/drivers/gpu/drm/drm_file.c
>> @@ -233,6 +233,7 @@ static void drm_events_release(struct drm_file
>> *file_priv)
>> void drm_file_free(struct drm_file *file)
>> {
>> struct drm_device *dev;
>> + int idx;
>>
>> if (!file)
>> return;
>> @@ -249,9 +250,11 @@ void drm_file_free(struct drm_file *file)
>>
>> drm_events_release(file);
>>
>> - if (drm_core_check_feature(dev, DRIVER_MODESET)) {
>> + if (drm_core_check_feature(dev, DRIVER_MODESET) &&
>> + drm_dev_enter(dev, &idx)) {
>> drm_fb_release(file);
>> drm_property_destroy_user_blobs(dev, file);
>> + drm_dev_exit(idx);
>> }
>>
>> if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
>> diff --git a/drivers/gpu/drm/drm_mode_config.c
>> b/drivers/gpu/drm/drm_mode_config.c
>> index 84ae8a23a3678..e349418978f79 100644
>> --- a/drivers/gpu/drm/drm_mode_config.c
>> +++ b/drivers/gpu/drm/drm_mode_config.c
>> @@ -583,10 +583,13 @@ void drm_mode_config_cleanup(struct drm_device
>> *dev)
>> */
>> WARN_ON(!list_empty(&dev->mode_config.fb_list));
>> list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list,
>> head) {
>> - struct drm_printer p = drm_dbg_printer(dev,
>> DRM_UT_KMS, "[leaked fb]");
>> + if (list_empty(&fb->filp_head) ||
>> drm_framebuffer_read_refcount(fb) > 1) {
>
> This looks a bit scary. Can someone manipulate the fb_list and even
> free fbs while we are iterating? Or is all other manipulation blocked
> by the device being unplugged?
The code already frees the framebuffer here as there is nothing running
that can still reference it.
The framebuffers are no longer used as everything display is already torn down,
and the device unplugged. That's what the drm_dev_enter/exit in drm_file.c are
there to protect.
Kind regards,
~Maarten Lankhorst
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-17 15:39 ` Maarten Lankhorst
@ 2026-03-17 15:43 ` Hellstrom, Thomas
2026-03-17 16:59 ` Maarten Lankhorst
0 siblings, 1 reply; 33+ messages in thread
From: Hellstrom, Thomas @ 2026-03-17 15:43 UTC (permalink / raw)
To: dev@lankhorst.se, dri-devel@lists.freedesktop.org
Cc: intel-xe@lists.freedesktop.org
On Tue, 2026-03-17 at 16:39 +0100, Maarten Lankhorst wrote:
>
>
> Den 2026-03-17 kl. 16:26, skrev Thomas Hellström:
> > On Fri, 2026-03-13 at 16:17 +0100, Maarten Lankhorst wrote:
> > > When trying to do a rather aggressive test of igt's
> > > "xe_module_load
> > > --r reload" with a full desktop environment and game running I
> > > noticed
> > > a few OOPSes when dereferencing freed pointers, related to
> > > framebuffers and property blobs after the compositor exits.
> > >
> > > Solve this by guarding the freeing in drm_file with
> > > drm_dev_enter/exit,
> > > and immediately put the references from struct drm_file objects
> > > during
> > > drm_dev_unplug().
> > >
> > > Related warnings for framebuffers on the subtest:
> > > [ 739.713076] ------------[ cut here ]------------
> > > WARN_ON(!list_empty(&dev->mode_config.fb_list))
> > > [ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at
> > > drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12:
> > > xe_module_load/13145
> > > ....
> > > [ 739.713328] Call Trace:
> > > [ 739.713330] <TASK>
> > > [ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe]
> > > [ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe]
> > > [ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
> > > [ 739.714041] xe_display_fini_early+0x33/0x50 [xe]
> > > [ 739.714284] devm_action_release+0xf/0x20
> > > [ 739.714294] devres_release_all+0xad/0xf0
> > > [ 739.714301] device_unbind_cleanup+0x12/0xa0
> > > [ 739.714305] device_release_driver_internal+0x1b7/0x210
> > > [ 739.714311] device_driver_detach+0x14/0x20
> > > [ 739.714315] unbind_store+0xa6/0xb0
> > > [ 739.714319] drv_attr_store+0x21/0x30
> > > [ 739.714322] sysfs_kf_write+0x48/0x60
> > > [ 739.714328] kernfs_fop_write_iter+0x16b/0x240
> > > [ 739.714333] vfs_write+0x266/0x520
> > > [ 739.714341] ksys_write+0x72/0xe0
> > > [ 739.714345] __x64_sys_write+0x19/0x20
> > > [ 739.714347] x64_sys_call+0xa15/0xa30
> > > [ 739.714355] do_syscall_64+0xd8/0xab0
> > > [ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53
> > >
> > > and
> > >
> > > [ 739.714459] ------------[ cut here ]------------
> > > [ 739.714461] xe 0000:67:00.0: [drm]
> > > drm_WARN_ON(!list_empty(&fb-
> > > > filp_head))
> > > [ 739.714464] WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at
> > > drm_framebuffer_free+0x6c/0x90 [drm], CPU#12:
> > > xe_module_load/13145
> > > [ 739.714715] RIP: 0010:drm_framebuffer_free+0x7a/0x90 [drm]
> > > ...
> > > [ 739.714869] Call Trace:
> > > [ 739.714871] <TASK>
> > > [ 739.714876] drm_mode_config_cleanup+0x26a/0x320 [drm]
> > > [ 739.714998] ? __drm_printfn_seq_file+0x20/0x20 [drm]
> > > [ 739.715115] ? drm_mode_config_cleanup+0x207/0x320 [drm]
> > > [ 739.715235] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
> > > [ 739.715576] xe_display_fini_early+0x33/0x50 [xe]
> > > [ 739.715821] devm_action_release+0xf/0x20
> > > [ 739.715828] devres_release_all+0xad/0xf0
> > > [ 739.715843] device_unbind_cleanup+0x12/0xa0
> > > [ 739.715850] device_release_driver_internal+0x1b7/0x210
> > > [ 739.715856] device_driver_detach+0x14/0x20
> > > [ 739.715860] unbind_store+0xa6/0xb0
> > > [ 739.715865] drv_attr_store+0x21/0x30
> > > [ 739.715868] sysfs_kf_write+0x48/0x60
> > > [ 739.715873] kernfs_fop_write_iter+0x16b/0x240
> > > [ 739.715878] vfs_write+0x266/0x520
> > > [ 739.715886] ksys_write+0x72/0xe0
> > > [ 739.715890] __x64_sys_write+0x19/0x20
> > > [ 739.715893] x64_sys_call+0xa15/0xa30
> > > [ 739.715900] do_syscall_64+0xd8/0xab0
> > > [ 739.715905] entry_SYSCALL_64_after_hwframe+0x4b/0x53
> > >
> > > and then finally file close blows up:
> > >
> > > [ 743.186530] Oops: general protection fault, probably for non-
> > > canonical address 0xdead000000000122: 0000 [#1] SMP
> > > [ 743.186535] CPU: 3 UID: 1000 PID: 3453 Comm: kwin_wayland
> > > Tainted:
> > > G W 7.0.0-rc1-valkyria+ #110 PREEMPT_{RT,(lazy)}
> > > [ 743.186537] Tainted: [W]=WARN
> > > [ 743.186538] Hardware name: Gigabyte Technology Co., Ltd. X299
> > > AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
> > > [ 743.186539] RIP: 0010:drm_framebuffer_cleanup+0x55/0xc0 [drm]
> > > [ 743.186588] Code: d8 72 73 0f b6 42 05 ff c3 39 c3 72 e8 49 8d
> > > bd
> > > 50 07 00 00 31 f6 e8 3a 80 d3 e1 49 8b 44 24 10 49 8d 7c 24 08 49
> > > 8b
> > > 54 24 08 <48> 3b 38 0f 85 95 7f 02 00 48 3b 7a 08 0f 85 8b 7f 02
> > > 00
> > > 48 89 42
> > > [ 743.186589] RSP: 0018:ffffc900085e3cf8 EFLAGS: 00010202
> > > [ 743.186591] RAX: dead000000000122 RBX: 0000000000000001 RCX:
> > > ffffffff8217ed03
> > > [ 743.186592] RDX: dead000000000100 RSI: 0000000000000000 RDI:
> > > ffff88814675ba08
> > > [ 743.186593] RBP: ffffc900085e3d10 R08: 0000000000000000 R09:
> > > 0000000000000000
> > > [ 743.186593] R10: 0000000000000000 R11: 0000000000000000 R12:
> > > ffff88814675ba00
> > > [ 743.186594] R13: ffff88810d778000 R14: ffff888119f6dca0 R15:
> > > ffff88810c660bb0
> > > [ 743.186595] FS: 00007ff377d21280(0000)
> > > GS:ffff888cec3f8000(0000)
> > > knlGS:0000000000000000
> > > [ 743.186596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > [ 743.186596] CR2: 000055690b55e000 CR3: 0000000113586003 CR4:
> > > 00000000003706f0
> > > [ 743.186597] Call Trace:
> > > [ 743.186598] <TASK>
> > > [ 743.186603] intel_user_framebuffer_destroy+0x12/0x90 [xe]
> > > [ 743.186722] drm_framebuffer_free+0x3a/0x90 [drm]
> > > [ 743.186750] ? trace_hardirqs_on+0x5f/0x120
> > > [ 743.186754] drm_mode_object_put+0x51/0x70 [drm]
> > > [ 743.186786] drm_fb_release+0x105/0x190 [drm]
> > > [ 743.186812] ? rt_mutex_slowunlock+0x3aa/0x410
> > > [ 743.186817] ? rt_spin_lock+0xea/0x1b0
> > > [ 743.186819] drm_file_free+0x1e0/0x2c0 [drm]
> > > [ 743.186843] drm_release_noglobal+0x91/0xf0 [drm]
> > > [ 743.186865] __fput+0x100/0x2e0
> > > [ 743.186869] fput_close_sync+0x40/0xa0
> > > [ 743.186870] __x64_sys_close+0x3e/0x80
> > > [ 743.186873] x64_sys_call+0xa07/0xa30
> > > [ 743.186879] do_syscall_64+0xd8/0xab0
> > > [ 743.186881] entry_SYSCALL_64_after_hwframe+0x4b/0x53
> > > [ 743.186882] RIP: 0033:0x7ff37e567732
> > > [ 743.186884] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89
> > > d7
> > > 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c
> > > 24
> > > 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
> > > 55
> > > bf 01 00
> > > [ 743.186885] RSP: 002b:00007ffc818169a8 EFLAGS: 00000246
> > > ORIG_RAX:
> > > 0000000000000003
> > > [ 743.186886] RAX: ffffffffffffffda RBX: 00007ffc81816a30 RCX:
> > > 00007ff37e567732
> > > [ 743.186887] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
> > > 0000000000000012
> > > [ 743.186888] RBP: 00007ffc818169d0 R08: 0000000000000000 R09:
> > > 0000000000000000
> > > [ 743.186889] R10: 0000000000000000 R11: 0000000000000246 R12:
> > > 000055d60a7996e0
> > > [ 743.186889] R13: 00007ffc81816a90 R14: 00007ffc81816a90 R15:
> > > 000055d60a782a30
> > > [ 743.186892] </TASK>
> > > [ 743.186893] Modules linked in: rfcomm snd_hrtimer xt_CHECKSUM
> > > xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp
> > > xt_addrtype nft_compat x_tables nft_chain_nat nf_nat nf_conntrack
> > > nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep
> > > mtd_intel_dg snd_hda_codec_intelhdmi mtd snd_hda_codec_hdmi
> > > nls_utf8
> > > mxm_wmi intel_wmi_thunderbolt gigabyte_wmi wmi_bmof xe drm_gpuvm
> > > drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video
> > > drm_suballoc_helper gpu_sched drm_client_lib drm_exec
> > > drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit
> > > x86_pkg_temp_thermal intel_powerclamp coretemp
> > > snd_hda_codec_alc882
> > > snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel
> > > snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec
> > > snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress
> > > ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801
> > > i2c_mux
> > > snd i2c_smbus btusb btrtl btbcm btmtk btintel bluetooth
> > > ecdh_generic
> > > rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse
> > > nfnetlink
> > > [ 743.186938] ---[ end trace 0000000000000000 ]---
> > >
> > > And for property blobs:
> > >
> > > void drm_mode_config_cleanup(struct drm_device *dev)
> > > {
> > > ...
> > > list_for_each_entry_safe(blob, bt, &dev-
> > > > mode_config.property_blob_list,
> > > head_global) {
> > > drm_property_blob_put(blob);
> > > }
> > >
> > > Resulting in:
> > >
> > > [ 371.072940] BUG: unable to handle page fault for address:
> > > 000001ffffffffff
> > > [ 371.072944] #PF: supervisor read access in kernel mode
> > > [ 371.072945] #PF: error_code(0x0000) - not-present page
> > > [ 371.072947] PGD 0 P4D 0
> > > [ 371.072950] Oops: Oops: 0000 [#1] SMP
> > > [ 371.072953] CPU: 0 UID: 1000 PID: 3693 Comm: kwin_wayland Not
> > > tainted 7.0.0-rc1-valkyria+ #111 PREEMPT_{RT,(lazy)}
> > > [ 371.072956] Hardware name: Gigabyte Technology Co., Ltd. X299
> > > AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
> > > [ 371.072957] RIP:
> > > 0010:drm_property_destroy_user_blobs+0x3b/0x90
> > > [drm]
> > > [ 371.073019] Code: 00 00 48 83 ec 10 48 8b 86 30 01 00 00 48 39
> > > c3
> > > 74 59 48 89 c2 48 8d 48 c8 48 8b 00 4c 8d 60 c8 eb 04 4c 8d 60 c8
> > > 48
> > > 8b 71 40 <48> 39 16 0f 85 39 32 01 00 48 3b 50 08 0f 85 2f 32 01
> > > 00
> > > 48 89 70
> > > [ 371.073021] RSP: 0018:ffffc90006a73de8 EFLAGS: 00010293
> > > [ 371.073022] RAX: 000001ffffffffff RBX: ffff888118a1a930 RCX:
> > > ffff8881b92355c0
> > > [ 371.073024] RDX: ffff8881b92355f8 RSI: 000001ffffffffff RDI:
> > > ffff888118be4000
> > > [ 371.073025] RBP: ffffc90006a73e08 R08: ffff8881009b7300 R09:
> > > ffff888cecc5b000
> > > [ 371.073026] R10: ffffc90006a73e90 R11: 0000000000000002 R12:
> > > 000001ffffffffc7
> > > [ 371.073027] R13: ffff888118a1a980 R14: ffff88810b366d20 R15:
> > > ffff888118a1a970
> > > [ 371.073028] FS: 00007f1faccbb280(0000)
> > > GS:ffff888cec2db000(0000)
> > > knlGS:0000000000000000
> > > [ 371.073029] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > [ 371.073030] CR2: 000001ffffffffff CR3: 000000010655c001 CR4:
> > > 00000000003706f0
> > > [ 371.073031] Call Trace:
> > > [ 371.073033] <TASK>
> > > [ 371.073036] drm_file_free+0x1df/0x2a0 [drm]
> > > [ 371.073077] drm_release_noglobal+0x7a/0xe0 [drm]
> > > [ 371.073113] __fput+0xe2/0x2b0
> > > [ 371.073118] fput_close_sync+0x40/0xa0
> > > [ 371.073119] __x64_sys_close+0x3e/0x80
> > > [ 371.073122] x64_sys_call+0xa07/0xa30
> > > [ 371.073126] do_syscall_64+0xc0/0x840
> > > [ 371.073130] entry_SYSCALL_64_after_hwframe+0x4b/0x53
> > > [ 371.073132] RIP: 0033:0x7f1fb3501732
> > > [ 371.073133] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89
> > > d7
> > > 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c
> > > 24
> > > 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
> > > 55
> > > bf 01 00
> > > [ 371.073135] RSP: 002b:00007ffe8e6f0278 EFLAGS: 00000246
> > > ORIG_RAX:
> > > 0000000000000003
> > > [ 371.073136] RAX: ffffffffffffffda RBX: 00007ffe8e6f0300 RCX:
> > > 00007f1fb3501732
> > > [ 371.073137] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
> > > 0000000000000012
> > > [ 371.073138] RBP: 00007ffe8e6f02a0 R08: 0000000000000000 R09:
> > > 0000000000000000
> > > [ 371.073139] R10: 0000000000000000 R11: 0000000000000246 R12:
> > > 00005585ba46eea0
> > > [ 371.073140] R13: 00007ffe8e6f0360 R14: 00007ffe8e6f0360 R15:
> > > 00005585ba458a30
> > > [ 371.073143] </TASK>
> > > [ 371.073144] Modules linked in: rfcomm snd_hrtimer xt_addrtype
> > > xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4
> > > xt_tcpudp nft_compat x_tables nft_chain_nat nf_nat nf_conntrack
> > > nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep
> > > snd_hda_codec_intelhdmi snd_hda_codec_hdmi mtd_intel_dg mtd
> > > nls_utf8
> > > wmi_bmof mxm_wmi gigabyte_wmi intel_wmi_thunderbolt xe drm_gpuvm
> > > drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video
> > > drm_suballoc_helper gpu_sched drm_client_lib drm_exec
> > > drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit
> > > x86_pkg_temp_thermal intel_powerclamp coretemp
> > > snd_hda_codec_alc882
> > > snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel
> > > snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec
> > > snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress
> > > ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 btusb
> > > i2c_mux i2c_smbus btrtl snd btbcm btmtk btintel bluetooth
> > > ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm
> > > i2c_dev
> > > fuse nfnetlink
> > > [ 371.073198] CR2: 000001ffffffffff
> > > [ 371.073199] ---[ end trace 0000000000000000 ]---
> > >
> > > Add a guard around file close, and ensure the warnings from
> > > drm_mode_config
> > > do not trigger. Fix those by allowing an open reference to the
> > > file
> > > descriptor
> > > and cleaning up the file linked list entry in
> > > drm_mode_config_cleanup().
> > >
> > > Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> > > Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
> > > ---
> > > drivers/gpu/drm/drm_file.c | 5 ++++-
> > > drivers/gpu/drm/drm_mode_config.c | 9 ++++++---
> > > 2 files changed, 10 insertions(+), 4 deletions(-)
> > >
> > > diff --git a/drivers/gpu/drm/drm_file.c
> > > b/drivers/gpu/drm/drm_file.c
> > > index ec820686b3021..f52141f842a1f 100644
> > > --- a/drivers/gpu/drm/drm_file.c
> > > +++ b/drivers/gpu/drm/drm_file.c
> > > @@ -233,6 +233,7 @@ static void drm_events_release(struct
> > > drm_file
> > > *file_priv)
> > > void drm_file_free(struct drm_file *file)
> > > {
> > > struct drm_device *dev;
> > > + int idx;
> > >
> > > if (!file)
> > > return;
> > > @@ -249,9 +250,11 @@ void drm_file_free(struct drm_file *file)
> > >
> > > drm_events_release(file);
> > >
> > > - if (drm_core_check_feature(dev, DRIVER_MODESET)) {
> > > + if (drm_core_check_feature(dev, DRIVER_MODESET) &&
> > > + drm_dev_enter(dev, &idx)) {
> > > drm_fb_release(file);
> > > drm_property_destroy_user_blobs(dev, file);
> > > + drm_dev_exit(idx);
> > > }
> > >
> > > if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
> > > diff --git a/drivers/gpu/drm/drm_mode_config.c
> > > b/drivers/gpu/drm/drm_mode_config.c
> > > index 84ae8a23a3678..e349418978f79 100644
> > > --- a/drivers/gpu/drm/drm_mode_config.c
> > > +++ b/drivers/gpu/drm/drm_mode_config.c
> > > @@ -583,10 +583,13 @@ void drm_mode_config_cleanup(struct
> > > drm_device
> > > *dev)
> > > */
> > > WARN_ON(!list_empty(&dev->mode_config.fb_list));
> > > list_for_each_entry_safe(fb, fbt, &dev-
> > > >mode_config.fb_list,
> > > head) {
> > > - struct drm_printer p = drm_dbg_printer(dev,
> > > DRM_UT_KMS, "[leaked fb]");
> > > + if (list_empty(&fb->filp_head) ||
> > > drm_framebuffer_read_refcount(fb) > 1) {
> >
> > This looks a bit scary. Can someone manipulate the fb_list and even
> > free fbs while we are iterating? Or is all other manipulation
> > blocked
> > by the device being unplugged?
> The code already frees the framebuffer here as there is nothing
> running
> that can still reference it.
>
> The framebuffers are no longer used as everything display is already
> torn down,
> and the device unplugged. That's what the drm_dev_enter/exit in
> drm_file.c are
> there to protect.
OK, great.
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>
> Kind regards,
> ~Maarten Lankhorst
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-17 15:43 ` Hellstrom, Thomas
@ 2026-03-17 16:59 ` Maarten Lankhorst
0 siblings, 0 replies; 33+ messages in thread
From: Maarten Lankhorst @ 2026-03-17 16:59 UTC (permalink / raw)
To: Hellstrom, Thomas, dri-devel@lists.freedesktop.org
Cc: intel-xe@lists.freedesktop.org
Hey,
Den 2026-03-17 kl. 16:43, skrev Hellstrom, Thomas:
> On Tue, 2026-03-17 at 16:39 +0100, Maarten Lankhorst wrote:
>>
>>
>> Den 2026-03-17 kl. 16:26, skrev Thomas Hellström:
>>> On Fri, 2026-03-13 at 16:17 +0100, Maarten Lankhorst wrote:
>>>> When trying to do a rather aggressive test of igt's
>>>> "xe_module_load
>>>> --r reload" with a full desktop environment and game running I
>>>> noticed
>>>> a few OOPSes when dereferencing freed pointers, related to
>>>> framebuffers and property blobs after the compositor exits.
>>>>
>>>> Solve this by guarding the freeing in drm_file with
>>>> drm_dev_enter/exit,
>>>> and immediately put the references from struct drm_file objects
>>>> during
>>>> drm_dev_unplug().
>>>>
>>>> Related warnings for framebuffers on the subtest:
>>>> [ 739.713076] ------------[ cut here ]------------
>>>> WARN_ON(!list_empty(&dev->mode_config.fb_list))
>>>> [ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at
>>>> drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12:
>>>> xe_module_load/13145
>>>> ....
>>>> [ 739.713328] Call Trace:
>>>> [ 739.713330] <TASK>
>>>> [ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe]
>>>> [ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe]
>>>> [ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
>>>> [ 739.714041] xe_display_fini_early+0x33/0x50 [xe]
>>>> [ 739.714284] devm_action_release+0xf/0x20
>>>> [ 739.714294] devres_release_all+0xad/0xf0
>>>> [ 739.714301] device_unbind_cleanup+0x12/0xa0
>>>> [ 739.714305] device_release_driver_internal+0x1b7/0x210
>>>> [ 739.714311] device_driver_detach+0x14/0x20
>>>> [ 739.714315] unbind_store+0xa6/0xb0
>>>> [ 739.714319] drv_attr_store+0x21/0x30
>>>> [ 739.714322] sysfs_kf_write+0x48/0x60
>>>> [ 739.714328] kernfs_fop_write_iter+0x16b/0x240
>>>> [ 739.714333] vfs_write+0x266/0x520
>>>> [ 739.714341] ksys_write+0x72/0xe0
>>>> [ 739.714345] __x64_sys_write+0x19/0x20
>>>> [ 739.714347] x64_sys_call+0xa15/0xa30
>>>> [ 739.714355] do_syscall_64+0xd8/0xab0
>>>> [ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53
>>>>
>>>> and
>>>>
>>>> [ 739.714459] ------------[ cut here ]------------
>>>> [ 739.714461] xe 0000:67:00.0: [drm]
>>>> drm_WARN_ON(!list_empty(&fb-
>>>>> filp_head))
>>>> [ 739.714464] WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at
>>>> drm_framebuffer_free+0x6c/0x90 [drm], CPU#12:
>>>> xe_module_load/13145
>>>> [ 739.714715] RIP: 0010:drm_framebuffer_free+0x7a/0x90 [drm]
>>>> ...
>>>> [ 739.714869] Call Trace:
>>>> [ 739.714871] <TASK>
>>>> [ 739.714876] drm_mode_config_cleanup+0x26a/0x320 [drm]
>>>> [ 739.714998] ? __drm_printfn_seq_file+0x20/0x20 [drm]
>>>> [ 739.715115] ? drm_mode_config_cleanup+0x207/0x320 [drm]
>>>> [ 739.715235] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
>>>> [ 739.715576] xe_display_fini_early+0x33/0x50 [xe]
>>>> [ 739.715821] devm_action_release+0xf/0x20
>>>> [ 739.715828] devres_release_all+0xad/0xf0
>>>> [ 739.715843] device_unbind_cleanup+0x12/0xa0
>>>> [ 739.715850] device_release_driver_internal+0x1b7/0x210
>>>> [ 739.715856] device_driver_detach+0x14/0x20
>>>> [ 739.715860] unbind_store+0xa6/0xb0
>>>> [ 739.715865] drv_attr_store+0x21/0x30
>>>> [ 739.715868] sysfs_kf_write+0x48/0x60
>>>> [ 739.715873] kernfs_fop_write_iter+0x16b/0x240
>>>> [ 739.715878] vfs_write+0x266/0x520
>>>> [ 739.715886] ksys_write+0x72/0xe0
>>>> [ 739.715890] __x64_sys_write+0x19/0x20
>>>> [ 739.715893] x64_sys_call+0xa15/0xa30
>>>> [ 739.715900] do_syscall_64+0xd8/0xab0
>>>> [ 739.715905] entry_SYSCALL_64_after_hwframe+0x4b/0x53
>>>>
>>>> and then finally file close blows up:
>>>>
>>>> [ 743.186530] Oops: general protection fault, probably for non-
>>>> canonical address 0xdead000000000122: 0000 [#1] SMP
>>>> [ 743.186535] CPU: 3 UID: 1000 PID: 3453 Comm: kwin_wayland
>>>> Tainted:
>>>> G W 7.0.0-rc1-valkyria+ #110 PREEMPT_{RT,(lazy)}
>>>> [ 743.186537] Tainted: [W]=WARN
>>>> [ 743.186538] Hardware name: Gigabyte Technology Co., Ltd. X299
>>>> AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
>>>> [ 743.186539] RIP: 0010:drm_framebuffer_cleanup+0x55/0xc0 [drm]
>>>> [ 743.186588] Code: d8 72 73 0f b6 42 05 ff c3 39 c3 72 e8 49 8d
>>>> bd
>>>> 50 07 00 00 31 f6 e8 3a 80 d3 e1 49 8b 44 24 10 49 8d 7c 24 08 49
>>>> 8b
>>>> 54 24 08 <48> 3b 38 0f 85 95 7f 02 00 48 3b 7a 08 0f 85 8b 7f 02
>>>> 00
>>>> 48 89 42
>>>> [ 743.186589] RSP: 0018:ffffc900085e3cf8 EFLAGS: 00010202
>>>> [ 743.186591] RAX: dead000000000122 RBX: 0000000000000001 RCX:
>>>> ffffffff8217ed03
>>>> [ 743.186592] RDX: dead000000000100 RSI: 0000000000000000 RDI:
>>>> ffff88814675ba08
>>>> [ 743.186593] RBP: ffffc900085e3d10 R08: 0000000000000000 R09:
>>>> 0000000000000000
>>>> [ 743.186593] R10: 0000000000000000 R11: 0000000000000000 R12:
>>>> ffff88814675ba00
>>>> [ 743.186594] R13: ffff88810d778000 R14: ffff888119f6dca0 R15:
>>>> ffff88810c660bb0
>>>> [ 743.186595] FS: 00007ff377d21280(0000)
>>>> GS:ffff888cec3f8000(0000)
>>>> knlGS:0000000000000000
>>>> [ 743.186596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>> [ 743.186596] CR2: 000055690b55e000 CR3: 0000000113586003 CR4:
>>>> 00000000003706f0
>>>> [ 743.186597] Call Trace:
>>>> [ 743.186598] <TASK>
>>>> [ 743.186603] intel_user_framebuffer_destroy+0x12/0x90 [xe]
>>>> [ 743.186722] drm_framebuffer_free+0x3a/0x90 [drm]
>>>> [ 743.186750] ? trace_hardirqs_on+0x5f/0x120
>>>> [ 743.186754] drm_mode_object_put+0x51/0x70 [drm]
>>>> [ 743.186786] drm_fb_release+0x105/0x190 [drm]
>>>> [ 743.186812] ? rt_mutex_slowunlock+0x3aa/0x410
>>>> [ 743.186817] ? rt_spin_lock+0xea/0x1b0
>>>> [ 743.186819] drm_file_free+0x1e0/0x2c0 [drm]
>>>> [ 743.186843] drm_release_noglobal+0x91/0xf0 [drm]
>>>> [ 743.186865] __fput+0x100/0x2e0
>>>> [ 743.186869] fput_close_sync+0x40/0xa0
>>>> [ 743.186870] __x64_sys_close+0x3e/0x80
>>>> [ 743.186873] x64_sys_call+0xa07/0xa30
>>>> [ 743.186879] do_syscall_64+0xd8/0xab0
>>>> [ 743.186881] entry_SYSCALL_64_after_hwframe+0x4b/0x53
>>>> [ 743.186882] RIP: 0033:0x7ff37e567732
>>>> [ 743.186884] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89
>>>> d7
>>>> 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c
>>>> 24
>>>> 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
>>>> 55
>>>> bf 01 00
>>>> [ 743.186885] RSP: 002b:00007ffc818169a8 EFLAGS: 00000246
>>>> ORIG_RAX:
>>>> 0000000000000003
>>>> [ 743.186886] RAX: ffffffffffffffda RBX: 00007ffc81816a30 RCX:
>>>> 00007ff37e567732
>>>> [ 743.186887] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
>>>> 0000000000000012
>>>> [ 743.186888] RBP: 00007ffc818169d0 R08: 0000000000000000 R09:
>>>> 0000000000000000
>>>> [ 743.186889] R10: 0000000000000000 R11: 0000000000000246 R12:
>>>> 000055d60a7996e0
>>>> [ 743.186889] R13: 00007ffc81816a90 R14: 00007ffc81816a90 R15:
>>>> 000055d60a782a30
>>>> [ 743.186892] </TASK>
>>>> [ 743.186893] Modules linked in: rfcomm snd_hrtimer xt_CHECKSUM
>>>> xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp
>>>> xt_addrtype nft_compat x_tables nft_chain_nat nf_nat nf_conntrack
>>>> nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep
>>>> mtd_intel_dg snd_hda_codec_intelhdmi mtd snd_hda_codec_hdmi
>>>> nls_utf8
>>>> mxm_wmi intel_wmi_thunderbolt gigabyte_wmi wmi_bmof xe drm_gpuvm
>>>> drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video
>>>> drm_suballoc_helper gpu_sched drm_client_lib drm_exec
>>>> drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit
>>>> x86_pkg_temp_thermal intel_powerclamp coretemp
>>>> snd_hda_codec_alc882
>>>> snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel
>>>> snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec
>>>> snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress
>>>> ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801
>>>> i2c_mux
>>>> snd i2c_smbus btusb btrtl btbcm btmtk btintel bluetooth
>>>> ecdh_generic
>>>> rfkill ecc mei_me mei ioatdma dca wmi nfsd drm i2c_dev fuse
>>>> nfnetlink
>>>> [ 743.186938] ---[ end trace 0000000000000000 ]---
>>>>
>>>> And for property blobs:
>>>>
>>>> void drm_mode_config_cleanup(struct drm_device *dev)
>>>> {
>>>> ...
>>>> list_for_each_entry_safe(blob, bt, &dev-
>>>>> mode_config.property_blob_list,
>>>> head_global) {
>>>> drm_property_blob_put(blob);
>>>> }
>>>>
>>>> Resulting in:
>>>>
>>>> [ 371.072940] BUG: unable to handle page fault for address:
>>>> 000001ffffffffff
>>>> [ 371.072944] #PF: supervisor read access in kernel mode
>>>> [ 371.072945] #PF: error_code(0x0000) - not-present page
>>>> [ 371.072947] PGD 0 P4D 0
>>>> [ 371.072950] Oops: Oops: 0000 [#1] SMP
>>>> [ 371.072953] CPU: 0 UID: 1000 PID: 3693 Comm: kwin_wayland Not
>>>> tainted 7.0.0-rc1-valkyria+ #111 PREEMPT_{RT,(lazy)}
>>>> [ 371.072956] Hardware name: Gigabyte Technology Co., Ltd. X299
>>>> AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021
>>>> [ 371.072957] RIP:
>>>> 0010:drm_property_destroy_user_blobs+0x3b/0x90
>>>> [drm]
>>>> [ 371.073019] Code: 00 00 48 83 ec 10 48 8b 86 30 01 00 00 48 39
>>>> c3
>>>> 74 59 48 89 c2 48 8d 48 c8 48 8b 00 4c 8d 60 c8 eb 04 4c 8d 60 c8
>>>> 48
>>>> 8b 71 40 <48> 39 16 0f 85 39 32 01 00 48 3b 50 08 0f 85 2f 32 01
>>>> 00
>>>> 48 89 70
>>>> [ 371.073021] RSP: 0018:ffffc90006a73de8 EFLAGS: 00010293
>>>> [ 371.073022] RAX: 000001ffffffffff RBX: ffff888118a1a930 RCX:
>>>> ffff8881b92355c0
>>>> [ 371.073024] RDX: ffff8881b92355f8 RSI: 000001ffffffffff RDI:
>>>> ffff888118be4000
>>>> [ 371.073025] RBP: ffffc90006a73e08 R08: ffff8881009b7300 R09:
>>>> ffff888cecc5b000
>>>> [ 371.073026] R10: ffffc90006a73e90 R11: 0000000000000002 R12:
>>>> 000001ffffffffc7
>>>> [ 371.073027] R13: ffff888118a1a980 R14: ffff88810b366d20 R15:
>>>> ffff888118a1a970
>>>> [ 371.073028] FS: 00007f1faccbb280(0000)
>>>> GS:ffff888cec2db000(0000)
>>>> knlGS:0000000000000000
>>>> [ 371.073029] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>> [ 371.073030] CR2: 000001ffffffffff CR3: 000000010655c001 CR4:
>>>> 00000000003706f0
>>>> [ 371.073031] Call Trace:
>>>> [ 371.073033] <TASK>
>>>> [ 371.073036] drm_file_free+0x1df/0x2a0 [drm]
>>>> [ 371.073077] drm_release_noglobal+0x7a/0xe0 [drm]
>>>> [ 371.073113] __fput+0xe2/0x2b0
>>>> [ 371.073118] fput_close_sync+0x40/0xa0
>>>> [ 371.073119] __x64_sys_close+0x3e/0x80
>>>> [ 371.073122] x64_sys_call+0xa07/0xa30
>>>> [ 371.073126] do_syscall_64+0xc0/0x840
>>>> [ 371.073130] entry_SYSCALL_64_after_hwframe+0x4b/0x53
>>>> [ 371.073132] RIP: 0033:0x7f1fb3501732
>>>> [ 371.073133] Code: 08 0f 85 a1 38 ff ff 49 89 fb 48 89 f0 48 89
>>>> d7
>>>> 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c
>>>> 24
>>>> 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
>>>> 55
>>>> bf 01 00
>>>> [ 371.073135] RSP: 002b:00007ffe8e6f0278 EFLAGS: 00000246
>>>> ORIG_RAX:
>>>> 0000000000000003
>>>> [ 371.073136] RAX: ffffffffffffffda RBX: 00007ffe8e6f0300 RCX:
>>>> 00007f1fb3501732
>>>> [ 371.073137] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
>>>> 0000000000000012
>>>> [ 371.073138] RBP: 00007ffe8e6f02a0 R08: 0000000000000000 R09:
>>>> 0000000000000000
>>>> [ 371.073139] R10: 0000000000000000 R11: 0000000000000246 R12:
>>>> 00005585ba46eea0
>>>> [ 371.073140] R13: 00007ffe8e6f0360 R14: 00007ffe8e6f0360 R15:
>>>> 00005585ba458a30
>>>> [ 371.073143] </TASK>
>>>> [ 371.073144] Modules linked in: rfcomm snd_hrtimer xt_addrtype
>>>> xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4
>>>> xt_tcpudp nft_compat x_tables nft_chain_nat nf_nat nf_conntrack
>>>> nf_defrag_ipv6 nf_defrag_ipv4 nf_tables overlay cfg80211 bnep
>>>> snd_hda_codec_intelhdmi snd_hda_codec_hdmi mtd_intel_dg mtd
>>>> nls_utf8
>>>> wmi_bmof mxm_wmi gigabyte_wmi intel_wmi_thunderbolt xe drm_gpuvm
>>>> drm_gpusvm_helper i2c_algo_bit drm_buddy drm_ttm_helper ttm video
>>>> drm_suballoc_helper gpu_sched drm_client_lib drm_exec
>>>> drm_display_helper cec drm_kunit_helpers drm_kms_helper kunit
>>>> x86_pkg_temp_thermal intel_powerclamp coretemp
>>>> snd_hda_codec_alc882
>>>> snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel
>>>> snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec
>>>> snd_hwdep snd_hda_core snd_intel_dspcfg snd_soc_core snd_compress
>>>> ac97_bus snd_pcm snd_seq snd_seq_device snd_timer i2c_i801 btusb
>>>> i2c_mux i2c_smbus btrtl snd btbcm btmtk btintel bluetooth
>>>> ecdh_generic rfkill ecc mei_me mei ioatdma dca wmi nfsd drm
>>>> i2c_dev
>>>> fuse nfnetlink
>>>> [ 371.073198] CR2: 000001ffffffffff
>>>> [ 371.073199] ---[ end trace 0000000000000000 ]---
>>>>
>>>> Add a guard around file close, and ensure the warnings from
>>>> drm_mode_config
>>>> do not trigger. Fix those by allowing an open reference to the
>>>> file
>>>> descriptor
>>>> and cleaning up the file linked list entry in
>>>> drm_mode_config_cleanup().
>>>>
>>>> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>>>> Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
>>>> ---
>>>> drivers/gpu/drm/drm_file.c | 5 ++++-
>>>> drivers/gpu/drm/drm_mode_config.c | 9 ++++++---
>>>> 2 files changed, 10 insertions(+), 4 deletions(-)
>>>>
>>>> diff --git a/drivers/gpu/drm/drm_file.c
>>>> b/drivers/gpu/drm/drm_file.c
>>>> index ec820686b3021..f52141f842a1f 100644
>>>> --- a/drivers/gpu/drm/drm_file.c
>>>> +++ b/drivers/gpu/drm/drm_file.c
>>>> @@ -233,6 +233,7 @@ static void drm_events_release(struct
>>>> drm_file
>>>> *file_priv)
>>>> void drm_file_free(struct drm_file *file)
>>>> {
>>>> struct drm_device *dev;
>>>> + int idx;
>>>>
>>>> if (!file)
>>>> return;
>>>> @@ -249,9 +250,11 @@ void drm_file_free(struct drm_file *file)
>>>>
>>>> drm_events_release(file);
>>>>
>>>> - if (drm_core_check_feature(dev, DRIVER_MODESET)) {
>>>> + if (drm_core_check_feature(dev, DRIVER_MODESET) &&
>>>> + drm_dev_enter(dev, &idx)) {
>>>> drm_fb_release(file);
>>>> drm_property_destroy_user_blobs(dev, file);
>>>> + drm_dev_exit(idx);
>>>> }
>>>>
>>>> if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
>>>> diff --git a/drivers/gpu/drm/drm_mode_config.c
>>>> b/drivers/gpu/drm/drm_mode_config.c
>>>> index 84ae8a23a3678..e349418978f79 100644
>>>> --- a/drivers/gpu/drm/drm_mode_config.c
>>>> +++ b/drivers/gpu/drm/drm_mode_config.c
>>>> @@ -583,10 +583,13 @@ void drm_mode_config_cleanup(struct
>>>> drm_device
>>>> *dev)
>>>> */
>>>> WARN_ON(!list_empty(&dev->mode_config.fb_list));
>>>> list_for_each_entry_safe(fb, fbt, &dev-
>>>>> mode_config.fb_list,
>>>> head) {
>>>> - struct drm_printer p = drm_dbg_printer(dev,
>>>> DRM_UT_KMS, "[leaked fb]");
>>>> + if (list_empty(&fb->filp_head) ||
>>>> drm_framebuffer_read_refcount(fb) > 1) {
>>>
>>> This looks a bit scary. Can someone manipulate the fb_list and even
>>> free fbs while we are iterating? Or is all other manipulation
>>> blocked
>>> by the device being unplugged?
>> The code already frees the framebuffer here as there is nothing
>> running
>> that can still reference it.
>>
>> The framebuffers are no longer used as everything display is already
>> torn down,
>> and the device unplugged. That's what the drm_dev_enter/exit in
>> drm_file.c are
>> there to protect.
>
> OK, great.
>
> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Since it covers existing problems I pushed it to fixes with some extra tags, added below.
Cc: <stable@vger.kernel.org> # v4.18+
Fixes: bee330f3d672 ("drm: Use srcu to protect drm_device.unplugged")
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-13 15:17 ` [PATCH v2 1/1] drm: " Maarten Lankhorst
2026-03-17 15:26 ` Thomas Hellström
@ 2026-03-25 17:26 ` Guenter Roeck
2026-03-25 18:05 ` Maarten Lankhorst
` (3 more replies)
1 sibling, 4 replies; 33+ messages in thread
From: Guenter Roeck @ 2026-03-25 17:26 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: dri-devel, intel-xe, Thomas Hellström
Hi,
On Fri, Mar 13, 2026 at 04:17:27PM +0100, Maarten Lankhorst wrote:
> When trying to do a rather aggressive test of igt's "xe_module_load
> --r reload" with a full desktop environment and game running I noticed
> a few OOPSes when dereferencing freed pointers, related to
> framebuffers and property blobs after the compositor exits.
>
> Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
> and immediately put the references from struct drm_file objects during
> drm_dev_unplug().
>
With this patch in v6.18.20, I get the warning backtraces below.
The backtraces are gone with the patch reverted.
Guenter
---
[ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 08:22:19 PDT 2026
[ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.18.20-spi+ root=UUID=ce436484-f920-47a8-a8c4-c17ff3a877e8 ro quiet splash amdgpu.gpu_recovery=1 amdgpu.ppfeaturemask=0xfff73fff vt.handoff=7
...
[ 4.254064] nouveau 0000:2b:00.0: NVIDIA GK208B (b060b0b1)
...
[ 5.440862] ------------[ cut here ]------------
[ 5.440864] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:537 drm_mode_config_cleanup+0x313/0x360
[ 5.440868] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
[ 5.440902] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Not tainted 6.18.20-spi+ #1 PREEMPT(full)
[ 5.440903] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
[ 5.440904] RIP: 0010:drm_mode_config_cleanup+0x313/0x360
[ 5.440906] Code: 8b 45 d0 65 48 2b 05 84 22 0b 02 75 64 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 48 8d 75 88 4c 89 e7 e8 1f 12 fe ff eb 10 48 8b 70 60 48 c7
[ 5.440907] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010202
[ 5.440908] RAX: ffff89bcc2268258 RBX: ffff89bcc2268290 RCX: 0000000000000000
[ 5.440909] RDX: ffff89bcc2269308 RSI: 0000000000000000 RDI: 0000000000000000
[ 5.440909] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
[ 5.440910] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
[ 5.440910] R13: ffff89bcc2268298 R14: ffff89bcc5c3f480 R15: dead000000000100
[ 5.440911] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
[ 5.440912] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5.440912] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
[ 5.440913] PKRU: 55555554
[ 5.440914] Call Trace:
[ 5.440914] <TASK>
[ 5.440916] ? drm_managed_release+0xc2/0x160
[ 5.440918] drm_mode_config_init_release+0xe/0x20
[ 5.440919] drm_managed_release+0x8f/0x160
[ 5.440920] drm_minor_release+0x5f/0x90
[ 5.440921] drm_release+0xda/0x140
[ 5.440923] __fput+0xed/0x2d0
[ 5.440925] fput_close_sync+0x3d/0xa0
[ 5.440927] __x64_sys_close+0x3e/0x90
[ 5.440928] x64_sys_call+0x1b5e/0x26a0
[ 5.440930] do_syscall_64+0x80/0x570
[ 5.440934] ? x64_sys_call+0x1144/0x26a0
[ 5.440935] ? do_syscall_64+0xb8/0x570
[ 5.440937] ? __vm_munmap+0xdb/0x190
[ 5.440939] ? __x64_sys_munmap+0x1b/0x30
[ 5.440941] ? x64_sys_call+0x1be5/0x26a0
[ 5.440942] ? do_syscall_64+0xb8/0x570
[ 5.440943] ? irqentry_exit+0x43/0x50
[ 5.440944] ? exc_page_fault+0x90/0x1b0
[ 5.440946] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 5.440947] RIP: 0033:0x713c256fa74c
[ 5.440948] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
[ 5.440949] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 5.440950] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
[ 5.440951] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
[ 5.440951] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
[ 5.440952] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
[ 5.440952] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
[ 5.440953] </TASK>
[ 5.440954] ---[ end trace 0000000000000000 ]---
[ 5.440955] [drm:drm_mode_config_cleanup] *ERROR* connector Unknown-1 leaked!
[ 5.440971] ------------[ cut here ]------------
[ 5.440971] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:571 drm_mode_config_cleanup+0x34f/0x360
[ 5.440973] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
[ 5.440995] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
[ 5.440997] Tainted: [W]=WARN
[ 5.440997] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
[ 5.440998] RIP: 0010:drm_mode_config_cleanup+0x34f/0x360
[ 5.440999] Code: 70 60 48 c7 c7 a7 90 93 ba e8 3d bb 00 00 48 8d 7d 88 e8 c4 32 fe ff 48 85 c0 75 e2 48 8d 7d 88 e8 d6 31 fe ff e9 7b fd ff ff <0f> 0b e9 79 fe ff ff 0f 0b eb 8e e8 01 a4 65 00 90 90 90 90 90 90
[ 5.441000] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010293
[ 5.441001] RAX: ffff89bcd7c61bc8 RBX: ffff89bcc2268368 RCX: 0000000000000000
[ 5.441001] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89bcc2268368
[ 5.441002] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
[ 5.441002] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
[ 5.441002] R13: ffff89bcc2268390 R14: ffff89bcc2268230 R15: dead000000000100
[ 5.441003] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
[ 5.441004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5.441004] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
[ 5.441005] PKRU: 55555554
[ 5.441005] Call Trace:
[ 5.441006] <TASK>
[ 5.441006] ? drm_managed_release+0xc2/0x160
[ 5.441008] drm_mode_config_init_release+0xe/0x20
[ 5.441009] drm_managed_release+0x8f/0x160
[ 5.441010] drm_minor_release+0x5f/0x90
[ 5.441011] drm_release+0xda/0x140
[ 5.441012] __fput+0xed/0x2d0
[ 5.441013] fput_close_sync+0x3d/0xa0
[ 5.441014] __x64_sys_close+0x3e/0x90
[ 5.441015] x64_sys_call+0x1b5e/0x26a0
[ 5.441017] do_syscall_64+0x80/0x570
[ 5.441018] ? x64_sys_call+0x1144/0x26a0
[ 5.441019] ? do_syscall_64+0xb8/0x570
[ 5.441021] ? __vm_munmap+0xdb/0x190
[ 5.441023] ? __x64_sys_munmap+0x1b/0x30
[ 5.441024] ? x64_sys_call+0x1be5/0x26a0
[ 5.441025] ? do_syscall_64+0xb8/0x570
[ 5.441026] ? irqentry_exit+0x43/0x50
[ 5.441027] ? exc_page_fault+0x90/0x1b0
[ 5.441029] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 5.441029] RIP: 0033:0x713c256fa74c
[ 5.441030] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
[ 5.441031] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 5.441031] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
[ 5.441032] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
[ 5.441032] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
[ 5.441033] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
[ 5.441033] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
[ 5.441035] </TASK>
[ 5.441035] ---[ end trace 0000000000000000 ]---
[ 5.441036] ------------[ cut here ]------------
[ 5.441036] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->vmap_use_count))
[ 5.441041] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:170 drm_gem_shmem_free+0x111/0x1a0
[ 5.441043] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
[ 5.441066] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
[ 5.441067] Tainted: [W]=WARN
[ 5.441067] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
[ 5.441068] RIP: 0010:drm_gem_shmem_free+0x111/0x1a0
[ 5.441069] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 68 4f 02 00 48 c7 c1 e8 03 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 8f 09 46 ff <0f> 0b e9 4b ff ff ff 48 8b 7b 08 48 85 ff 74 04 48 8b 7f 08 4c 8b
[ 5.441070] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
[ 5.441070] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
[ 5.441071] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 5.441071] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
[ 5.441072] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
[ 5.441072] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
[ 5.441073] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
[ 5.441073] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5.441074] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
[ 5.441075] PKRU: 55555554
[ 5.441075] Call Trace:
[ 5.441075] <TASK>
[ 5.441076] drm_gem_shmem_object_free+0x9/0x20
[ 5.441077] drm_gem_object_handle_put_unlocked+0x12c/0x140
[ 5.441079] drm_framebuffer_cleanup+0x60/0xe0
[ 5.441080] drm_gem_fb_destroy+0x79/0xc0
[ 5.441081] drm_framebuffer_free+0x43/0xa0
[ 5.441083] drm_mode_config_cleanup+0x29c/0x360
[ 5.441084] ? drm_mode_config_cleanup+0x1f2/0x360
[ 5.441085] ? drm_managed_release+0xc2/0x160
[ 5.441086] drm_mode_config_init_release+0xe/0x20
[ 5.441087] drm_managed_release+0x8f/0x160
[ 5.441088] drm_minor_release+0x5f/0x90
[ 5.441089] drm_release+0xda/0x140
[ 5.441090] __fput+0xed/0x2d0
[ 5.441091] fput_close_sync+0x3d/0xa0
[ 5.441092] __x64_sys_close+0x3e/0x90
[ 5.441094] x64_sys_call+0x1b5e/0x26a0
[ 5.441095] do_syscall_64+0x80/0x570
[ 5.441096] ? x64_sys_call+0x1144/0x26a0
[ 5.441097] ? do_syscall_64+0xb8/0x570
[ 5.441099] ? __vm_munmap+0xdb/0x190
[ 5.441101] ? __x64_sys_munmap+0x1b/0x30
[ 5.441102] ? x64_sys_call+0x1be5/0x26a0
[ 5.441103] ? do_syscall_64+0xb8/0x570
[ 5.441104] ? irqentry_exit+0x43/0x50
[ 5.441105] ? exc_page_fault+0x90/0x1b0
[ 5.441106] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 5.441107] RIP: 0033:0x713c256fa74c
[ 5.441108] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
[ 5.441109] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 5.441109] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
[ 5.441110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
[ 5.441110] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
[ 5.441111] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
[ 5.441111] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
[ 5.441112] </TASK>
[ 5.441113] ---[ end trace 0000000000000000 ]---
[ 5.441151] ------------[ cut here ]------------
[ 5.441152] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->pages_pin_count))
[ 5.441155] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:182 drm_gem_shmem_free+0x18d/0x1a0
[ 5.441157] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
[ 5.441179] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
[ 5.441180] Tainted: [W]=WARN
[ 5.441180] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
[ 5.441181] RIP: 0010:drm_gem_shmem_free+0x18d/0x1a0
[ 5.441182] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 ec 4e 02 00 48 c7 c1 58 04 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 13 09 46 ff <0f> 0b e9 35 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90
[ 5.441182] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
[ 5.441183] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
[ 5.441184] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 5.441184] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
[ 5.441184] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
[ 5.441185] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
[ 5.441186] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
[ 5.441186] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5.441187] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
[ 5.441187] PKRU: 55555554
[ 5.441188] Call Trace:
[ 5.441188] <TASK>
[ 5.441188] drm_gem_shmem_object_free+0x9/0x20
[ 5.441189] drm_gem_object_handle_put_unlocked+0x12c/0x140
[ 5.441191] drm_framebuffer_cleanup+0x60/0xe0
[ 5.441192] drm_gem_fb_destroy+0x79/0xc0
[ 5.441193] drm_framebuffer_free+0x43/0xa0
[ 5.441194] drm_mode_config_cleanup+0x29c/0x360
[ 5.441195] ? drm_mode_config_cleanup+0x1f2/0x360
[ 5.441196] ? drm_managed_release+0xc2/0x160
[ 5.441197] drm_mode_config_init_release+0xe/0x20
[ 5.441198] drm_managed_release+0x8f/0x160
[ 5.441199] drm_minor_release+0x5f/0x90
[ 5.441200] drm_release+0xda/0x140
[ 5.441201] __fput+0xed/0x2d0
[ 5.441202] fput_close_sync+0x3d/0xa0
[ 5.441204] __x64_sys_close+0x3e/0x90
[ 5.441205] x64_sys_call+0x1b5e/0x26a0
[ 5.441206] do_syscall_64+0x80/0x570
[ 5.441208] ? x64_sys_call+0x1144/0x26a0
[ 5.441209] ? do_syscall_64+0xb8/0x570
[ 5.441210] ? __vm_munmap+0xdb/0x190
[ 5.441212] ? __x64_sys_munmap+0x1b/0x30
[ 5.441213] ? x64_sys_call+0x1be5/0x26a0
[ 5.441214] ? do_syscall_64+0xb8/0x570
[ 5.441216] ? irqentry_exit+0x43/0x50
[ 5.441216] ? exc_page_fault+0x90/0x1b0
[ 5.441218] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 5.441219] RIP: 0033:0x713c256fa74c
[ 5.441219] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
[ 5.441234] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 5.441236] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
[ 5.441237] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
[ 5.441238] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
[ 5.441238] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
[ 5.441239] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
[ 5.441241] </TASK>
[ 5.441241] ---[ end trace 0000000000000000 ]---
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-25 17:26 ` Guenter Roeck
@ 2026-03-25 18:05 ` Maarten Lankhorst
2026-03-25 18:26 ` Guenter Roeck
2026-03-25 18:17 ` Maarten Lankhorst
` (2 subsequent siblings)
3 siblings, 1 reply; 33+ messages in thread
From: Maarten Lankhorst @ 2026-03-25 18:05 UTC (permalink / raw)
To: Guenter Roeck; +Cc: dri-devel, intel-xe, Thomas Hellström
Hey,
Den 2026-03-25 kl. 18:26, skrev Guenter Roeck:
> Hi,
>
> On Fri, Mar 13, 2026 at 04:17:27PM +0100, Maarten Lankhorst wrote:
>> When trying to do a rather aggressive test of igt's "xe_module_load
>> --r reload" with a full desktop environment and game running I noticed
>> a few OOPSes when dereferencing freed pointers, related to
>> framebuffers and property blobs after the compositor exits.
>>
>> Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
>> and immediately put the references from struct drm_file objects during
>> drm_dev_unplug().
>>
>
> With this patch in v6.18.20, I get the warning backtraces below.
> The backtraces are gone with the patch reverted.
>
> Guenter
That's a weird bug. What framebuffer driver is providing the simple fb?
Kind regards,
~Maarten Lankhorst
> ---
> [ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 08:22:19 PDT 2026
> [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.18.20-spi+ root=UUID=ce436484-f920-47a8-a8c4-c17ff3a877e8 ro quiet splash amdgpu.gpu_recovery=1 amdgpu.ppfeaturemask=0xfff73fff vt.handoff=7
> ...
> [ 4.254064] nouveau 0000:2b:00.0: NVIDIA GK208B (b060b0b1)
> ...
> [ 5.440862] ------------[ cut here ]------------
> [ 5.440864] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:537 drm_mode_config_cleanup+0x313/0x360
> [ 5.440868] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.440902] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Not tainted 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.440903] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.440904] RIP: 0010:drm_mode_config_cleanup+0x313/0x360
> [ 5.440906] Code: 8b 45 d0 65 48 2b 05 84 22 0b 02 75 64 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 48 8d 75 88 4c 89 e7 e8 1f 12 fe ff eb 10 48 8b 70 60 48 c7
> [ 5.440907] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010202
> [ 5.440908] RAX: ffff89bcc2268258 RBX: ffff89bcc2268290 RCX: 0000000000000000
> [ 5.440909] RDX: ffff89bcc2269308 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.440909] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
> [ 5.440910] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
> [ 5.440910] R13: ffff89bcc2268298 R14: ffff89bcc5c3f480 R15: dead000000000100
> [ 5.440911] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.440912] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.440912] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.440913] PKRU: 55555554
> [ 5.440914] Call Trace:
> [ 5.440914] <TASK>
> [ 5.440916] ? drm_managed_release+0xc2/0x160
> [ 5.440918] drm_mode_config_init_release+0xe/0x20
> [ 5.440919] drm_managed_release+0x8f/0x160
> [ 5.440920] drm_minor_release+0x5f/0x90
> [ 5.440921] drm_release+0xda/0x140
> [ 5.440923] __fput+0xed/0x2d0
> [ 5.440925] fput_close_sync+0x3d/0xa0
> [ 5.440927] __x64_sys_close+0x3e/0x90
> [ 5.440928] x64_sys_call+0x1b5e/0x26a0
> [ 5.440930] do_syscall_64+0x80/0x570
> [ 5.440934] ? x64_sys_call+0x1144/0x26a0
> [ 5.440935] ? do_syscall_64+0xb8/0x570
> [ 5.440937] ? __vm_munmap+0xdb/0x190
> [ 5.440939] ? __x64_sys_munmap+0x1b/0x30
> [ 5.440941] ? x64_sys_call+0x1be5/0x26a0
> [ 5.440942] ? do_syscall_64+0xb8/0x570
> [ 5.440943] ? irqentry_exit+0x43/0x50
> [ 5.440944] ? exc_page_fault+0x90/0x1b0
> [ 5.440946] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.440947] RIP: 0033:0x713c256fa74c
> [ 5.440948] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.440949] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.440950] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.440951] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.440951] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.440952] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.440952] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.440953] </TASK>
> [ 5.440954] ---[ end trace 0000000000000000 ]---
> [ 5.440955] [drm:drm_mode_config_cleanup] *ERROR* connector Unknown-1 leaked!
> [ 5.440971] ------------[ cut here ]------------
> [ 5.440971] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:571 drm_mode_config_cleanup+0x34f/0x360
> [ 5.440973] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.440995] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.440997] Tainted: [W]=WARN
> [ 5.440997] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.440998] RIP: 0010:drm_mode_config_cleanup+0x34f/0x360
> [ 5.440999] Code: 70 60 48 c7 c7 a7 90 93 ba e8 3d bb 00 00 48 8d 7d 88 e8 c4 32 fe ff 48 85 c0 75 e2 48 8d 7d 88 e8 d6 31 fe ff e9 7b fd ff ff <0f> 0b e9 79 fe ff ff 0f 0b eb 8e e8 01 a4 65 00 90 90 90 90 90 90
> [ 5.441000] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010293
> [ 5.441001] RAX: ffff89bcd7c61bc8 RBX: ffff89bcc2268368 RCX: 0000000000000000
> [ 5.441001] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89bcc2268368
> [ 5.441002] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441002] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
> [ 5.441002] R13: ffff89bcc2268390 R14: ffff89bcc2268230 R15: dead000000000100
> [ 5.441003] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441004] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441005] PKRU: 55555554
> [ 5.441005] Call Trace:
> [ 5.441006] <TASK>
> [ 5.441006] ? drm_managed_release+0xc2/0x160
> [ 5.441008] drm_mode_config_init_release+0xe/0x20
> [ 5.441009] drm_managed_release+0x8f/0x160
> [ 5.441010] drm_minor_release+0x5f/0x90
> [ 5.441011] drm_release+0xda/0x140
> [ 5.441012] __fput+0xed/0x2d0
> [ 5.441013] fput_close_sync+0x3d/0xa0
> [ 5.441014] __x64_sys_close+0x3e/0x90
> [ 5.441015] x64_sys_call+0x1b5e/0x26a0
> [ 5.441017] do_syscall_64+0x80/0x570
> [ 5.441018] ? x64_sys_call+0x1144/0x26a0
> [ 5.441019] ? do_syscall_64+0xb8/0x570
> [ 5.441021] ? __vm_munmap+0xdb/0x190
> [ 5.441023] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441024] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441025] ? do_syscall_64+0xb8/0x570
> [ 5.441026] ? irqentry_exit+0x43/0x50
> [ 5.441027] ? exc_page_fault+0x90/0x1b0
> [ 5.441029] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441029] RIP: 0033:0x713c256fa74c
> [ 5.441030] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441031] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441031] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441032] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441032] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441033] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441033] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441035] </TASK>
> [ 5.441035] ---[ end trace 0000000000000000 ]---
> [ 5.441036] ------------[ cut here ]------------
> [ 5.441036] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->vmap_use_count))
> [ 5.441041] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:170 drm_gem_shmem_free+0x111/0x1a0
> [ 5.441043] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.441066] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.441067] Tainted: [W]=WARN
> [ 5.441067] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.441068] RIP: 0010:drm_gem_shmem_free+0x111/0x1a0
> [ 5.441069] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 68 4f 02 00 48 c7 c1 e8 03 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 8f 09 46 ff <0f> 0b e9 4b ff ff ff 48 8b 7b 08 48 85 ff 74 04 48 8b 7f 08 4c 8b
> [ 5.441070] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
> [ 5.441070] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
> [ 5.441071] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.441071] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441072] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
> [ 5.441072] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
> [ 5.441073] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441073] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441074] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441075] PKRU: 55555554
> [ 5.441075] Call Trace:
> [ 5.441075] <TASK>
> [ 5.441076] drm_gem_shmem_object_free+0x9/0x20
> [ 5.441077] drm_gem_object_handle_put_unlocked+0x12c/0x140
> [ 5.441079] drm_framebuffer_cleanup+0x60/0xe0
> [ 5.441080] drm_gem_fb_destroy+0x79/0xc0
> [ 5.441081] drm_framebuffer_free+0x43/0xa0
> [ 5.441083] drm_mode_config_cleanup+0x29c/0x360
> [ 5.441084] ? drm_mode_config_cleanup+0x1f2/0x360
> [ 5.441085] ? drm_managed_release+0xc2/0x160
> [ 5.441086] drm_mode_config_init_release+0xe/0x20
> [ 5.441087] drm_managed_release+0x8f/0x160
> [ 5.441088] drm_minor_release+0x5f/0x90
> [ 5.441089] drm_release+0xda/0x140
> [ 5.441090] __fput+0xed/0x2d0
> [ 5.441091] fput_close_sync+0x3d/0xa0
> [ 5.441092] __x64_sys_close+0x3e/0x90
> [ 5.441094] x64_sys_call+0x1b5e/0x26a0
> [ 5.441095] do_syscall_64+0x80/0x570
> [ 5.441096] ? x64_sys_call+0x1144/0x26a0
> [ 5.441097] ? do_syscall_64+0xb8/0x570
> [ 5.441099] ? __vm_munmap+0xdb/0x190
> [ 5.441101] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441102] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441103] ? do_syscall_64+0xb8/0x570
> [ 5.441104] ? irqentry_exit+0x43/0x50
> [ 5.441105] ? exc_page_fault+0x90/0x1b0
> [ 5.441106] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441107] RIP: 0033:0x713c256fa74c
> [ 5.441108] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441109] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441109] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441110] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441111] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441111] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441112] </TASK>
> [ 5.441113] ---[ end trace 0000000000000000 ]---
> [ 5.441151] ------------[ cut here ]------------
> [ 5.441152] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->pages_pin_count))
> [ 5.441155] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:182 drm_gem_shmem_free+0x18d/0x1a0
> [ 5.441157] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.441179] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.441180] Tainted: [W]=WARN
> [ 5.441180] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.441181] RIP: 0010:drm_gem_shmem_free+0x18d/0x1a0
> [ 5.441182] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 ec 4e 02 00 48 c7 c1 58 04 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 13 09 46 ff <0f> 0b e9 35 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90
> [ 5.441182] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
> [ 5.441183] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
> [ 5.441184] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.441184] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441184] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
> [ 5.441185] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
> [ 5.441186] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441186] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441187] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441187] PKRU: 55555554
> [ 5.441188] Call Trace:
> [ 5.441188] <TASK>
> [ 5.441188] drm_gem_shmem_object_free+0x9/0x20
> [ 5.441189] drm_gem_object_handle_put_unlocked+0x12c/0x140
> [ 5.441191] drm_framebuffer_cleanup+0x60/0xe0
> [ 5.441192] drm_gem_fb_destroy+0x79/0xc0
> [ 5.441193] drm_framebuffer_free+0x43/0xa0
> [ 5.441194] drm_mode_config_cleanup+0x29c/0x360
> [ 5.441195] ? drm_mode_config_cleanup+0x1f2/0x360
> [ 5.441196] ? drm_managed_release+0xc2/0x160
> [ 5.441197] drm_mode_config_init_release+0xe/0x20
> [ 5.441198] drm_managed_release+0x8f/0x160
> [ 5.441199] drm_minor_release+0x5f/0x90
> [ 5.441200] drm_release+0xda/0x140
> [ 5.441201] __fput+0xed/0x2d0
> [ 5.441202] fput_close_sync+0x3d/0xa0
> [ 5.441204] __x64_sys_close+0x3e/0x90
> [ 5.441205] x64_sys_call+0x1b5e/0x26a0
> [ 5.441206] do_syscall_64+0x80/0x570
> [ 5.441208] ? x64_sys_call+0x1144/0x26a0
> [ 5.441209] ? do_syscall_64+0xb8/0x570
> [ 5.441210] ? __vm_munmap+0xdb/0x190
> [ 5.441212] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441213] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441214] ? do_syscall_64+0xb8/0x570
> [ 5.441216] ? irqentry_exit+0x43/0x50
> [ 5.441216] ? exc_page_fault+0x90/0x1b0
> [ 5.441218] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441219] RIP: 0033:0x713c256fa74c
> [ 5.441219] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441234] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441236] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441237] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441238] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441238] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441239] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441241] </TASK>
> [ 5.441241] ---[ end trace 0000000000000000 ]---
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-25 17:26 ` Guenter Roeck
2026-03-25 18:05 ` Maarten Lankhorst
@ 2026-03-25 18:17 ` Maarten Lankhorst
2026-03-25 18:28 ` Maarten Lankhorst
2026-03-25 21:11 ` Simona Vetter
3 siblings, 0 replies; 33+ messages in thread
From: Maarten Lankhorst @ 2026-03-25 18:17 UTC (permalink / raw)
To: Guenter Roeck; +Cc: dri-devel, intel-xe, Thomas Hellström
Hey,
Whatever the simple driver is used, is drm_atomic_helper_shutdown() called somewhere in it?
Kind regards,
~Maarten Lankhorst
Den 2026-03-25 kl. 18:26, skrev Guenter Roeck:
> Hi,
>
> On Fri, Mar 13, 2026 at 04:17:27PM +0100, Maarten Lankhorst wrote:
>> When trying to do a rather aggressive test of igt's "xe_module_load
>> --r reload" with a full desktop environment and game running I noticed
>> a few OOPSes when dereferencing freed pointers, related to
>> framebuffers and property blobs after the compositor exits.
>>
>> Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
>> and immediately put the references from struct drm_file objects during
>> drm_dev_unplug().
>>
>
> With this patch in v6.18.20, I get the warning backtraces below.
> The backtraces are gone with the patch reverted.
>
> Guenter
>
> ---
> [ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 08:22:19 PDT 2026
> [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.18.20-spi+ root=UUID=ce436484-f920-47a8-a8c4-c17ff3a877e8 ro quiet splash amdgpu.gpu_recovery=1 amdgpu.ppfeaturemask=0xfff73fff vt.handoff=7
> ...
> [ 4.254064] nouveau 0000:2b:00.0: NVIDIA GK208B (b060b0b1)
> ...
> [ 5.440862] ------------[ cut here ]------------
> [ 5.440864] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:537 drm_mode_config_cleanup+0x313/0x360
> [ 5.440868] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.440902] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Not tainted 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.440903] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.440904] RIP: 0010:drm_mode_config_cleanup+0x313/0x360
> [ 5.440906] Code: 8b 45 d0 65 48 2b 05 84 22 0b 02 75 64 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 48 8d 75 88 4c 89 e7 e8 1f 12 fe ff eb 10 48 8b 70 60 48 c7
> [ 5.440907] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010202
> [ 5.440908] RAX: ffff89bcc2268258 RBX: ffff89bcc2268290 RCX: 0000000000000000
> [ 5.440909] RDX: ffff89bcc2269308 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.440909] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
> [ 5.440910] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
> [ 5.440910] R13: ffff89bcc2268298 R14: ffff89bcc5c3f480 R15: dead000000000100
> [ 5.440911] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.440912] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.440912] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.440913] PKRU: 55555554
> [ 5.440914] Call Trace:
> [ 5.440914] <TASK>
> [ 5.440916] ? drm_managed_release+0xc2/0x160
> [ 5.440918] drm_mode_config_init_release+0xe/0x20
> [ 5.440919] drm_managed_release+0x8f/0x160
> [ 5.440920] drm_minor_release+0x5f/0x90
> [ 5.440921] drm_release+0xda/0x140
> [ 5.440923] __fput+0xed/0x2d0
> [ 5.440925] fput_close_sync+0x3d/0xa0
> [ 5.440927] __x64_sys_close+0x3e/0x90
> [ 5.440928] x64_sys_call+0x1b5e/0x26a0
> [ 5.440930] do_syscall_64+0x80/0x570
> [ 5.440934] ? x64_sys_call+0x1144/0x26a0
> [ 5.440935] ? do_syscall_64+0xb8/0x570
> [ 5.440937] ? __vm_munmap+0xdb/0x190
> [ 5.440939] ? __x64_sys_munmap+0x1b/0x30
> [ 5.440941] ? x64_sys_call+0x1be5/0x26a0
> [ 5.440942] ? do_syscall_64+0xb8/0x570
> [ 5.440943] ? irqentry_exit+0x43/0x50
> [ 5.440944] ? exc_page_fault+0x90/0x1b0
> [ 5.440946] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.440947] RIP: 0033:0x713c256fa74c
> [ 5.440948] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.440949] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.440950] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.440951] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.440951] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.440952] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.440952] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.440953] </TASK>
> [ 5.440954] ---[ end trace 0000000000000000 ]---
> [ 5.440955] [drm:drm_mode_config_cleanup] *ERROR* connector Unknown-1 leaked!
> [ 5.440971] ------------[ cut here ]------------
> [ 5.440971] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:571 drm_mode_config_cleanup+0x34f/0x360
> [ 5.440973] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.440995] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.440997] Tainted: [W]=WARN
> [ 5.440997] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.440998] RIP: 0010:drm_mode_config_cleanup+0x34f/0x360
> [ 5.440999] Code: 70 60 48 c7 c7 a7 90 93 ba e8 3d bb 00 00 48 8d 7d 88 e8 c4 32 fe ff 48 85 c0 75 e2 48 8d 7d 88 e8 d6 31 fe ff e9 7b fd ff ff <0f> 0b e9 79 fe ff ff 0f 0b eb 8e e8 01 a4 65 00 90 90 90 90 90 90
> [ 5.441000] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010293
> [ 5.441001] RAX: ffff89bcd7c61bc8 RBX: ffff89bcc2268368 RCX: 0000000000000000
> [ 5.441001] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89bcc2268368
> [ 5.441002] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441002] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
> [ 5.441002] R13: ffff89bcc2268390 R14: ffff89bcc2268230 R15: dead000000000100
> [ 5.441003] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441004] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441005] PKRU: 55555554
> [ 5.441005] Call Trace:
> [ 5.441006] <TASK>
> [ 5.441006] ? drm_managed_release+0xc2/0x160
> [ 5.441008] drm_mode_config_init_release+0xe/0x20
> [ 5.441009] drm_managed_release+0x8f/0x160
> [ 5.441010] drm_minor_release+0x5f/0x90
> [ 5.441011] drm_release+0xda/0x140
> [ 5.441012] __fput+0xed/0x2d0
> [ 5.441013] fput_close_sync+0x3d/0xa0
> [ 5.441014] __x64_sys_close+0x3e/0x90
> [ 5.441015] x64_sys_call+0x1b5e/0x26a0
> [ 5.441017] do_syscall_64+0x80/0x570
> [ 5.441018] ? x64_sys_call+0x1144/0x26a0
> [ 5.441019] ? do_syscall_64+0xb8/0x570
> [ 5.441021] ? __vm_munmap+0xdb/0x190
> [ 5.441023] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441024] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441025] ? do_syscall_64+0xb8/0x570
> [ 5.441026] ? irqentry_exit+0x43/0x50
> [ 5.441027] ? exc_page_fault+0x90/0x1b0
> [ 5.441029] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441029] RIP: 0033:0x713c256fa74c
> [ 5.441030] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441031] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441031] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441032] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441032] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441033] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441033] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441035] </TASK>
> [ 5.441035] ---[ end trace 0000000000000000 ]---
> [ 5.441036] ------------[ cut here ]------------
> [ 5.441036] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->vmap_use_count))
> [ 5.441041] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:170 drm_gem_shmem_free+0x111/0x1a0
> [ 5.441043] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.441066] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.441067] Tainted: [W]=WARN
> [ 5.441067] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.441068] RIP: 0010:drm_gem_shmem_free+0x111/0x1a0
> [ 5.441069] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 68 4f 02 00 48 c7 c1 e8 03 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 8f 09 46 ff <0f> 0b e9 4b ff ff ff 48 8b 7b 08 48 85 ff 74 04 48 8b 7f 08 4c 8b
> [ 5.441070] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
> [ 5.441070] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
> [ 5.441071] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.441071] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441072] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
> [ 5.441072] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
> [ 5.441073] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441073] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441074] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441075] PKRU: 55555554
> [ 5.441075] Call Trace:
> [ 5.441075] <TASK>
> [ 5.441076] drm_gem_shmem_object_free+0x9/0x20
> [ 5.441077] drm_gem_object_handle_put_unlocked+0x12c/0x140
> [ 5.441079] drm_framebuffer_cleanup+0x60/0xe0
> [ 5.441080] drm_gem_fb_destroy+0x79/0xc0
> [ 5.441081] drm_framebuffer_free+0x43/0xa0
> [ 5.441083] drm_mode_config_cleanup+0x29c/0x360
> [ 5.441084] ? drm_mode_config_cleanup+0x1f2/0x360
> [ 5.441085] ? drm_managed_release+0xc2/0x160
> [ 5.441086] drm_mode_config_init_release+0xe/0x20
> [ 5.441087] drm_managed_release+0x8f/0x160
> [ 5.441088] drm_minor_release+0x5f/0x90
> [ 5.441089] drm_release+0xda/0x140
> [ 5.441090] __fput+0xed/0x2d0
> [ 5.441091] fput_close_sync+0x3d/0xa0
> [ 5.441092] __x64_sys_close+0x3e/0x90
> [ 5.441094] x64_sys_call+0x1b5e/0x26a0
> [ 5.441095] do_syscall_64+0x80/0x570
> [ 5.441096] ? x64_sys_call+0x1144/0x26a0
> [ 5.441097] ? do_syscall_64+0xb8/0x570
> [ 5.441099] ? __vm_munmap+0xdb/0x190
> [ 5.441101] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441102] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441103] ? do_syscall_64+0xb8/0x570
> [ 5.441104] ? irqentry_exit+0x43/0x50
> [ 5.441105] ? exc_page_fault+0x90/0x1b0
> [ 5.441106] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441107] RIP: 0033:0x713c256fa74c
> [ 5.441108] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441109] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441109] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441110] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441111] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441111] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441112] </TASK>
> [ 5.441113] ---[ end trace 0000000000000000 ]---
> [ 5.441151] ------------[ cut here ]------------
> [ 5.441152] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->pages_pin_count))
> [ 5.441155] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:182 drm_gem_shmem_free+0x18d/0x1a0
> [ 5.441157] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.441179] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.441180] Tainted: [W]=WARN
> [ 5.441180] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.441181] RIP: 0010:drm_gem_shmem_free+0x18d/0x1a0
> [ 5.441182] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 ec 4e 02 00 48 c7 c1 58 04 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 13 09 46 ff <0f> 0b e9 35 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90
> [ 5.441182] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
> [ 5.441183] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
> [ 5.441184] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.441184] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441184] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
> [ 5.441185] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
> [ 5.441186] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441186] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441187] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441187] PKRU: 55555554
> [ 5.441188] Call Trace:
> [ 5.441188] <TASK>
> [ 5.441188] drm_gem_shmem_object_free+0x9/0x20
> [ 5.441189] drm_gem_object_handle_put_unlocked+0x12c/0x140
> [ 5.441191] drm_framebuffer_cleanup+0x60/0xe0
> [ 5.441192] drm_gem_fb_destroy+0x79/0xc0
> [ 5.441193] drm_framebuffer_free+0x43/0xa0
> [ 5.441194] drm_mode_config_cleanup+0x29c/0x360
> [ 5.441195] ? drm_mode_config_cleanup+0x1f2/0x360
> [ 5.441196] ? drm_managed_release+0xc2/0x160
> [ 5.441197] drm_mode_config_init_release+0xe/0x20
> [ 5.441198] drm_managed_release+0x8f/0x160
> [ 5.441199] drm_minor_release+0x5f/0x90
> [ 5.441200] drm_release+0xda/0x140
> [ 5.441201] __fput+0xed/0x2d0
> [ 5.441202] fput_close_sync+0x3d/0xa0
> [ 5.441204] __x64_sys_close+0x3e/0x90
> [ 5.441205] x64_sys_call+0x1b5e/0x26a0
> [ 5.441206] do_syscall_64+0x80/0x570
> [ 5.441208] ? x64_sys_call+0x1144/0x26a0
> [ 5.441209] ? do_syscall_64+0xb8/0x570
> [ 5.441210] ? __vm_munmap+0xdb/0x190
> [ 5.441212] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441213] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441214] ? do_syscall_64+0xb8/0x570
> [ 5.441216] ? irqentry_exit+0x43/0x50
> [ 5.441216] ? exc_page_fault+0x90/0x1b0
> [ 5.441218] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441219] RIP: 0033:0x713c256fa74c
> [ 5.441219] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441234] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441236] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441237] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441238] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441238] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441239] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441241] </TASK>
> [ 5.441241] ---[ end trace 0000000000000000 ]---
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-25 18:05 ` Maarten Lankhorst
@ 2026-03-25 18:26 ` Guenter Roeck
0 siblings, 0 replies; 33+ messages in thread
From: Guenter Roeck @ 2026-03-25 18:26 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: dri-devel, intel-xe, Thomas Hellström
Hi Maarten,
On 3/25/26 11:05, Maarten Lankhorst wrote:
> Hey,
>
> Den 2026-03-25 kl. 18:26, skrev Guenter Roeck:
>> Hi,
>>
>> On Fri, Mar 13, 2026 at 04:17:27PM +0100, Maarten Lankhorst wrote:
>>> When trying to do a rather aggressive test of igt's "xe_module_load
>>> --r reload" with a full desktop environment and game running I noticed
>>> a few OOPSes when dereferencing freed pointers, related to
>>> framebuffers and property blobs after the compositor exits.
>>>
>>> Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
>>> and immediately put the references from struct drm_file objects during
>>> drm_dev_unplug().
>>>
>>
>> With this patch in v6.18.20, I get the warning backtraces below.
>> The backtraces are gone with the patch reverted.
>>
>> Guenter
>
> That's a weird bug. What framebuffer driver is providing the simple fb?
>
I have no idea, sorry. I did not touch that code. It is pure upstream with no
downstream drivers. The configuration is derived from the standard Ubuntu
configuration file. The configuraton file includes
CONFIG_FB_NVIDIA=m
CONFIG_FB_NVIDIA_I2C=y
and
CONFIG_DRM_NOUVEAU=m
CONFIG_NOUVEAU_DEBUG=5
CONFIG_NOUVEAU_DEBUG_DEFAULT=3
# CONFIG_NOUVEAU_DEBUG_MMU is not set
# CONFIG_NOUVEAU_DEBUG_PUSH is not set
CONFIG_DRM_NOUVEAU_BACKLIGHT=y
# CONFIG_DRM_NOUVEAU_SVM is not set
CONFIG_DRM_NOUVEAU_CH7006=m
CONFIG_DRM_NOUVEAU_SIL164=m
fb related log messages are
[ 0.958266] fbcon: Deferring console take-over
[ 0.958267] simple-framebuffer simple-framebuffer.0: [drm] fb0: simpledrmdrmfb frame buffer device
[ 5.066632] nouveau 0000:2b:00.0: fb: 2048 MiB DDR3
[ 5.850727] fbcon: nouveaudrmfb (fb0) is primary device
[ 5.850729] fbcon: Deferring console take-over
[ 5.850730] nouveau 0000:2b:00.0: [drm] fb0: nouveaudrmfb frame buffer device
[ 17.035914] fbcon: Taking over console
I can send you the complete dmesg and configuration file if it helps.
Thanks,
Guenter
> Kind regards,
> ~Maarten Lankhorst
>
>> ---
>> [ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 08:22:19 PDT 2026
>> [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.18.20-spi+ root=UUID=ce436484-f920-47a8-a8c4-c17ff3a877e8 ro quiet splash amdgpu.gpu_recovery=1 amdgpu.ppfeaturemask=0xfff73fff vt.handoff=7
>> ...
>> [ 4.254064] nouveau 0000:2b:00.0: NVIDIA GK208B (b060b0b1)
>> ...
>> [ 5.440862] ------------[ cut here ]------------
>> [ 5.440864] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:537 drm_mode_config_cleanup+0x313/0x360
>> [ 5.440868] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
>> [ 5.440902] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Not tainted 6.18.20-spi+ #1 PREEMPT(full)
>> [ 5.440903] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
>> [ 5.440904] RIP: 0010:drm_mode_config_cleanup+0x313/0x360
>> [ 5.440906] Code: 8b 45 d0 65 48 2b 05 84 22 0b 02 75 64 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 48 8d 75 88 4c 89 e7 e8 1f 12 fe ff eb 10 48 8b 70 60 48 c7
>> [ 5.440907] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010202
>> [ 5.440908] RAX: ffff89bcc2268258 RBX: ffff89bcc2268290 RCX: 0000000000000000
>> [ 5.440909] RDX: ffff89bcc2269308 RSI: 0000000000000000 RDI: 0000000000000000
>> [ 5.440909] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
>> [ 5.440910] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
>> [ 5.440910] R13: ffff89bcc2268298 R14: ffff89bcc5c3f480 R15: dead000000000100
>> [ 5.440911] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
>> [ 5.440912] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 5.440912] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
>> [ 5.440913] PKRU: 55555554
>> [ 5.440914] Call Trace:
>> [ 5.440914] <TASK>
>> [ 5.440916] ? drm_managed_release+0xc2/0x160
>> [ 5.440918] drm_mode_config_init_release+0xe/0x20
>> [ 5.440919] drm_managed_release+0x8f/0x160
>> [ 5.440920] drm_minor_release+0x5f/0x90
>> [ 5.440921] drm_release+0xda/0x140
>> [ 5.440923] __fput+0xed/0x2d0
>> [ 5.440925] fput_close_sync+0x3d/0xa0
>> [ 5.440927] __x64_sys_close+0x3e/0x90
>> [ 5.440928] x64_sys_call+0x1b5e/0x26a0
>> [ 5.440930] do_syscall_64+0x80/0x570
>> [ 5.440934] ? x64_sys_call+0x1144/0x26a0
>> [ 5.440935] ? do_syscall_64+0xb8/0x570
>> [ 5.440937] ? __vm_munmap+0xdb/0x190
>> [ 5.440939] ? __x64_sys_munmap+0x1b/0x30
>> [ 5.440941] ? x64_sys_call+0x1be5/0x26a0
>> [ 5.440942] ? do_syscall_64+0xb8/0x570
>> [ 5.440943] ? irqentry_exit+0x43/0x50
>> [ 5.440944] ? exc_page_fault+0x90/0x1b0
>> [ 5.440946] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> [ 5.440947] RIP: 0033:0x713c256fa74c
>> [ 5.440948] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
>> [ 5.440949] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
>> [ 5.440950] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
>> [ 5.440951] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
>> [ 5.440951] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
>> [ 5.440952] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
>> [ 5.440952] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
>> [ 5.440953] </TASK>
>> [ 5.440954] ---[ end trace 0000000000000000 ]---
>> [ 5.440955] [drm:drm_mode_config_cleanup] *ERROR* connector Unknown-1 leaked!
>> [ 5.440971] ------------[ cut here ]------------
>> [ 5.440971] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:571 drm_mode_config_cleanup+0x34f/0x360
>> [ 5.440973] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
>> [ 5.440995] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
>> [ 5.440997] Tainted: [W]=WARN
>> [ 5.440997] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
>> [ 5.440998] RIP: 0010:drm_mode_config_cleanup+0x34f/0x360
>> [ 5.440999] Code: 70 60 48 c7 c7 a7 90 93 ba e8 3d bb 00 00 48 8d 7d 88 e8 c4 32 fe ff 48 85 c0 75 e2 48 8d 7d 88 e8 d6 31 fe ff e9 7b fd ff ff <0f> 0b e9 79 fe ff ff 0f 0b eb 8e e8 01 a4 65 00 90 90 90 90 90 90
>> [ 5.441000] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010293
>> [ 5.441001] RAX: ffff89bcd7c61bc8 RBX: ffff89bcc2268368 RCX: 0000000000000000
>> [ 5.441001] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89bcc2268368
>> [ 5.441002] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
>> [ 5.441002] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
>> [ 5.441002] R13: ffff89bcc2268390 R14: ffff89bcc2268230 R15: dead000000000100
>> [ 5.441003] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
>> [ 5.441004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 5.441004] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
>> [ 5.441005] PKRU: 55555554
>> [ 5.441005] Call Trace:
>> [ 5.441006] <TASK>
>> [ 5.441006] ? drm_managed_release+0xc2/0x160
>> [ 5.441008] drm_mode_config_init_release+0xe/0x20
>> [ 5.441009] drm_managed_release+0x8f/0x160
>> [ 5.441010] drm_minor_release+0x5f/0x90
>> [ 5.441011] drm_release+0xda/0x140
>> [ 5.441012] __fput+0xed/0x2d0
>> [ 5.441013] fput_close_sync+0x3d/0xa0
>> [ 5.441014] __x64_sys_close+0x3e/0x90
>> [ 5.441015] x64_sys_call+0x1b5e/0x26a0
>> [ 5.441017] do_syscall_64+0x80/0x570
>> [ 5.441018] ? x64_sys_call+0x1144/0x26a0
>> [ 5.441019] ? do_syscall_64+0xb8/0x570
>> [ 5.441021] ? __vm_munmap+0xdb/0x190
>> [ 5.441023] ? __x64_sys_munmap+0x1b/0x30
>> [ 5.441024] ? x64_sys_call+0x1be5/0x26a0
>> [ 5.441025] ? do_syscall_64+0xb8/0x570
>> [ 5.441026] ? irqentry_exit+0x43/0x50
>> [ 5.441027] ? exc_page_fault+0x90/0x1b0
>> [ 5.441029] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> [ 5.441029] RIP: 0033:0x713c256fa74c
>> [ 5.441030] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
>> [ 5.441031] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
>> [ 5.441031] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
>> [ 5.441032] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
>> [ 5.441032] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
>> [ 5.441033] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
>> [ 5.441033] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
>> [ 5.441035] </TASK>
>> [ 5.441035] ---[ end trace 0000000000000000 ]---
>> [ 5.441036] ------------[ cut here ]------------
>> [ 5.441036] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->vmap_use_count))
>> [ 5.441041] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:170 drm_gem_shmem_free+0x111/0x1a0
>> [ 5.441043] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
>> [ 5.441066] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
>> [ 5.441067] Tainted: [W]=WARN
>> [ 5.441067] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
>> [ 5.441068] RIP: 0010:drm_gem_shmem_free+0x111/0x1a0
>> [ 5.441069] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 68 4f 02 00 48 c7 c1 e8 03 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 8f 09 46 ff <0f> 0b e9 4b ff ff ff 48 8b 7b 08 48 85 ff 74 04 48 8b 7f 08 4c 8b
>> [ 5.441070] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
>> [ 5.441070] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
>> [ 5.441071] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
>> [ 5.441071] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
>> [ 5.441072] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
>> [ 5.441072] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
>> [ 5.441073] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
>> [ 5.441073] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 5.441074] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
>> [ 5.441075] PKRU: 55555554
>> [ 5.441075] Call Trace:
>> [ 5.441075] <TASK>
>> [ 5.441076] drm_gem_shmem_object_free+0x9/0x20
>> [ 5.441077] drm_gem_object_handle_put_unlocked+0x12c/0x140
>> [ 5.441079] drm_framebuffer_cleanup+0x60/0xe0
>> [ 5.441080] drm_gem_fb_destroy+0x79/0xc0
>> [ 5.441081] drm_framebuffer_free+0x43/0xa0
>> [ 5.441083] drm_mode_config_cleanup+0x29c/0x360
>> [ 5.441084] ? drm_mode_config_cleanup+0x1f2/0x360
>> [ 5.441085] ? drm_managed_release+0xc2/0x160
>> [ 5.441086] drm_mode_config_init_release+0xe/0x20
>> [ 5.441087] drm_managed_release+0x8f/0x160
>> [ 5.441088] drm_minor_release+0x5f/0x90
>> [ 5.441089] drm_release+0xda/0x140
>> [ 5.441090] __fput+0xed/0x2d0
>> [ 5.441091] fput_close_sync+0x3d/0xa0
>> [ 5.441092] __x64_sys_close+0x3e/0x90
>> [ 5.441094] x64_sys_call+0x1b5e/0x26a0
>> [ 5.441095] do_syscall_64+0x80/0x570
>> [ 5.441096] ? x64_sys_call+0x1144/0x26a0
>> [ 5.441097] ? do_syscall_64+0xb8/0x570
>> [ 5.441099] ? __vm_munmap+0xdb/0x190
>> [ 5.441101] ? __x64_sys_munmap+0x1b/0x30
>> [ 5.441102] ? x64_sys_call+0x1be5/0x26a0
>> [ 5.441103] ? do_syscall_64+0xb8/0x570
>> [ 5.441104] ? irqentry_exit+0x43/0x50
>> [ 5.441105] ? exc_page_fault+0x90/0x1b0
>> [ 5.441106] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> [ 5.441107] RIP: 0033:0x713c256fa74c
>> [ 5.441108] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
>> [ 5.441109] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
>> [ 5.441109] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
>> [ 5.441110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
>> [ 5.441110] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
>> [ 5.441111] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
>> [ 5.441111] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
>> [ 5.441112] </TASK>
>> [ 5.441113] ---[ end trace 0000000000000000 ]---
>> [ 5.441151] ------------[ cut here ]------------
>> [ 5.441152] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->pages_pin_count))
>> [ 5.441155] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:182 drm_gem_shmem_free+0x18d/0x1a0
>> [ 5.441157] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
>> [ 5.441179] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
>> [ 5.441180] Tainted: [W]=WARN
>> [ 5.441180] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
>> [ 5.441181] RIP: 0010:drm_gem_shmem_free+0x18d/0x1a0
>> [ 5.441182] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 ec 4e 02 00 48 c7 c1 58 04 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 13 09 46 ff <0f> 0b e9 35 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90
>> [ 5.441182] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
>> [ 5.441183] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
>> [ 5.441184] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
>> [ 5.441184] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
>> [ 5.441184] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
>> [ 5.441185] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
>> [ 5.441186] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
>> [ 5.441186] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 5.441187] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
>> [ 5.441187] PKRU: 55555554
>> [ 5.441188] Call Trace:
>> [ 5.441188] <TASK>
>> [ 5.441188] drm_gem_shmem_object_free+0x9/0x20
>> [ 5.441189] drm_gem_object_handle_put_unlocked+0x12c/0x140
>> [ 5.441191] drm_framebuffer_cleanup+0x60/0xe0
>> [ 5.441192] drm_gem_fb_destroy+0x79/0xc0
>> [ 5.441193] drm_framebuffer_free+0x43/0xa0
>> [ 5.441194] drm_mode_config_cleanup+0x29c/0x360
>> [ 5.441195] ? drm_mode_config_cleanup+0x1f2/0x360
>> [ 5.441196] ? drm_managed_release+0xc2/0x160
>> [ 5.441197] drm_mode_config_init_release+0xe/0x20
>> [ 5.441198] drm_managed_release+0x8f/0x160
>> [ 5.441199] drm_minor_release+0x5f/0x90
>> [ 5.441200] drm_release+0xda/0x140
>> [ 5.441201] __fput+0xed/0x2d0
>> [ 5.441202] fput_close_sync+0x3d/0xa0
>> [ 5.441204] __x64_sys_close+0x3e/0x90
>> [ 5.441205] x64_sys_call+0x1b5e/0x26a0
>> [ 5.441206] do_syscall_64+0x80/0x570
>> [ 5.441208] ? x64_sys_call+0x1144/0x26a0
>> [ 5.441209] ? do_syscall_64+0xb8/0x570
>> [ 5.441210] ? __vm_munmap+0xdb/0x190
>> [ 5.441212] ? __x64_sys_munmap+0x1b/0x30
>> [ 5.441213] ? x64_sys_call+0x1be5/0x26a0
>> [ 5.441214] ? do_syscall_64+0xb8/0x570
>> [ 5.441216] ? irqentry_exit+0x43/0x50
>> [ 5.441216] ? exc_page_fault+0x90/0x1b0
>> [ 5.441218] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> [ 5.441219] RIP: 0033:0x713c256fa74c
>> [ 5.441219] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
>> [ 5.441234] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
>> [ 5.441236] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
>> [ 5.441237] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
>> [ 5.441238] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
>> [ 5.441238] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
>> [ 5.441239] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
>> [ 5.441241] </TASK>
>> [ 5.441241] ---[ end trace 0000000000000000 ]---
>
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-25 17:26 ` Guenter Roeck
2026-03-25 18:05 ` Maarten Lankhorst
2026-03-25 18:17 ` Maarten Lankhorst
@ 2026-03-25 18:28 ` Maarten Lankhorst
2026-03-25 18:59 ` Guenter Roeck
2026-03-25 20:12 ` Guenter Roeck
2026-03-25 21:11 ` Simona Vetter
3 siblings, 2 replies; 33+ messages in thread
From: Maarten Lankhorst @ 2026-03-25 18:28 UTC (permalink / raw)
To: Guenter Roeck; +Cc: dri-devel, intel-xe, Thomas Hellström
Hello,
What about this patch?
Kind regards,
~Maarten Lankhorst
------8<---------
diff --git a/drivers/gpu/drm/sysfb/simpledrm.c b/drivers/gpu/drm/sysfb/simpledrm.c
index 0358164a623c9..ae49aaf99fb2c 100644
--- a/drivers/gpu/drm/sysfb/simpledrm.c
+++ b/drivers/gpu/drm/sysfb/simpledrm.c
@@ -588,6 +588,11 @@ static const struct drm_mode_config_funcs simpledrm_mode_config_funcs = {
* Init / Cleanup
*/
+static void simpledrm_shutdown(struct drm_device *dev, void *arg)
+{
+ drm_atomic_helper_shutdown(dev);
+}
+
static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
struct platform_device *pdev)
{
@@ -808,6 +813,10 @@ static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
drm_mode_config_reset(dev);
+ ret = drmm_add_action_or_reset(dev, simpledrm_shutdown, NULL);
+ if (ret)
+ return ERR_PTR(ret);
+
return sdev;
}
---------
Den 2026-03-25 kl. 18:26, skrev Guenter Roeck:
> Hi,
>
> On Fri, Mar 13, 2026 at 04:17:27PM +0100, Maarten Lankhorst wrote:
>> When trying to do a rather aggressive test of igt's "xe_module_load
>> --r reload" with a full desktop environment and game running I noticed
>> a few OOPSes when dereferencing freed pointers, related to
>> framebuffers and property blobs after the compositor exits.
>>
>> Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
>> and immediately put the references from struct drm_file objects during
>> drm_dev_unplug().
>>
>
> With this patch in v6.18.20, I get the warning backtraces below.
> The backtraces are gone with the patch reverted.
>
> Guenter
>
> ---
> [ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 08:22:19 PDT 2026
> [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.18.20-spi+ root=UUID=ce436484-f920-47a8-a8c4-c17ff3a877e8 ro quiet splash amdgpu.gpu_recovery=1 amdgpu.ppfeaturemask=0xfff73fff vt.handoff=7
> ...
> [ 4.254064] nouveau 0000:2b:00.0: NVIDIA GK208B (b060b0b1)
> ...
> [ 5.440862] ------------[ cut here ]------------
> [ 5.440864] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:537 drm_mode_config_cleanup+0x313/0x360
> [ 5.440868] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.440902] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Not tainted 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.440903] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.440904] RIP: 0010:drm_mode_config_cleanup+0x313/0x360
> [ 5.440906] Code: 8b 45 d0 65 48 2b 05 84 22 0b 02 75 64 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 48 8d 75 88 4c 89 e7 e8 1f 12 fe ff eb 10 48 8b 70 60 48 c7
> [ 5.440907] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010202
> [ 5.440908] RAX: ffff89bcc2268258 RBX: ffff89bcc2268290 RCX: 0000000000000000
> [ 5.440909] RDX: ffff89bcc2269308 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.440909] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
> [ 5.440910] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
> [ 5.440910] R13: ffff89bcc2268298 R14: ffff89bcc5c3f480 R15: dead000000000100
> [ 5.440911] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.440912] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.440912] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.440913] PKRU: 55555554
> [ 5.440914] Call Trace:
> [ 5.440914] <TASK>
> [ 5.440916] ? drm_managed_release+0xc2/0x160
> [ 5.440918] drm_mode_config_init_release+0xe/0x20
> [ 5.440919] drm_managed_release+0x8f/0x160
> [ 5.440920] drm_minor_release+0x5f/0x90
> [ 5.440921] drm_release+0xda/0x140
> [ 5.440923] __fput+0xed/0x2d0
> [ 5.440925] fput_close_sync+0x3d/0xa0
> [ 5.440927] __x64_sys_close+0x3e/0x90
> [ 5.440928] x64_sys_call+0x1b5e/0x26a0
> [ 5.440930] do_syscall_64+0x80/0x570
> [ 5.440934] ? x64_sys_call+0x1144/0x26a0
> [ 5.440935] ? do_syscall_64+0xb8/0x570
> [ 5.440937] ? __vm_munmap+0xdb/0x190
> [ 5.440939] ? __x64_sys_munmap+0x1b/0x30
> [ 5.440941] ? x64_sys_call+0x1be5/0x26a0
> [ 5.440942] ? do_syscall_64+0xb8/0x570
> [ 5.440943] ? irqentry_exit+0x43/0x50
> [ 5.440944] ? exc_page_fault+0x90/0x1b0
> [ 5.440946] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.440947] RIP: 0033:0x713c256fa74c
> [ 5.440948] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.440949] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.440950] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.440951] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.440951] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.440952] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.440952] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.440953] </TASK>
> [ 5.440954] ---[ end trace 0000000000000000 ]---
> [ 5.440955] [drm:drm_mode_config_cleanup] *ERROR* connector Unknown-1 leaked!
> [ 5.440971] ------------[ cut here ]------------
> [ 5.440971] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:571 drm_mode_config_cleanup+0x34f/0x360
> [ 5.440973] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.440995] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.440997] Tainted: [W]=WARN
> [ 5.440997] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.440998] RIP: 0010:drm_mode_config_cleanup+0x34f/0x360
> [ 5.440999] Code: 70 60 48 c7 c7 a7 90 93 ba e8 3d bb 00 00 48 8d 7d 88 e8 c4 32 fe ff 48 85 c0 75 e2 48 8d 7d 88 e8 d6 31 fe ff e9 7b fd ff ff <0f> 0b e9 79 fe ff ff 0f 0b eb 8e e8 01 a4 65 00 90 90 90 90 90 90
> [ 5.441000] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010293
> [ 5.441001] RAX: ffff89bcd7c61bc8 RBX: ffff89bcc2268368 RCX: 0000000000000000
> [ 5.441001] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89bcc2268368
> [ 5.441002] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441002] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
> [ 5.441002] R13: ffff89bcc2268390 R14: ffff89bcc2268230 R15: dead000000000100
> [ 5.441003] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441004] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441005] PKRU: 55555554
> [ 5.441005] Call Trace:
> [ 5.441006] <TASK>
> [ 5.441006] ? drm_managed_release+0xc2/0x160
> [ 5.441008] drm_mode_config_init_release+0xe/0x20
> [ 5.441009] drm_managed_release+0x8f/0x160
> [ 5.441010] drm_minor_release+0x5f/0x90
> [ 5.441011] drm_release+0xda/0x140
> [ 5.441012] __fput+0xed/0x2d0
> [ 5.441013] fput_close_sync+0x3d/0xa0
> [ 5.441014] __x64_sys_close+0x3e/0x90
> [ 5.441015] x64_sys_call+0x1b5e/0x26a0
> [ 5.441017] do_syscall_64+0x80/0x570
> [ 5.441018] ? x64_sys_call+0x1144/0x26a0
> [ 5.441019] ? do_syscall_64+0xb8/0x570
> [ 5.441021] ? __vm_munmap+0xdb/0x190
> [ 5.441023] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441024] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441025] ? do_syscall_64+0xb8/0x570
> [ 5.441026] ? irqentry_exit+0x43/0x50
> [ 5.441027] ? exc_page_fault+0x90/0x1b0
> [ 5.441029] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441029] RIP: 0033:0x713c256fa74c
> [ 5.441030] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441031] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441031] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441032] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441032] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441033] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441033] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441035] </TASK>
> [ 5.441035] ---[ end trace 0000000000000000 ]---
> [ 5.441036] ------------[ cut here ]------------
> [ 5.441036] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->vmap_use_count))
> [ 5.441041] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:170 drm_gem_shmem_free+0x111/0x1a0
> [ 5.441043] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.441066] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.441067] Tainted: [W]=WARN
> [ 5.441067] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.441068] RIP: 0010:drm_gem_shmem_free+0x111/0x1a0
> [ 5.441069] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 68 4f 02 00 48 c7 c1 e8 03 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 8f 09 46 ff <0f> 0b e9 4b ff ff ff 48 8b 7b 08 48 85 ff 74 04 48 8b 7f 08 4c 8b
> [ 5.441070] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
> [ 5.441070] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
> [ 5.441071] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.441071] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441072] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
> [ 5.441072] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
> [ 5.441073] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441073] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441074] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441075] PKRU: 55555554
> [ 5.441075] Call Trace:
> [ 5.441075] <TASK>
> [ 5.441076] drm_gem_shmem_object_free+0x9/0x20
> [ 5.441077] drm_gem_object_handle_put_unlocked+0x12c/0x140
> [ 5.441079] drm_framebuffer_cleanup+0x60/0xe0
> [ 5.441080] drm_gem_fb_destroy+0x79/0xc0
> [ 5.441081] drm_framebuffer_free+0x43/0xa0
> [ 5.441083] drm_mode_config_cleanup+0x29c/0x360
> [ 5.441084] ? drm_mode_config_cleanup+0x1f2/0x360
> [ 5.441085] ? drm_managed_release+0xc2/0x160
> [ 5.441086] drm_mode_config_init_release+0xe/0x20
> [ 5.441087] drm_managed_release+0x8f/0x160
> [ 5.441088] drm_minor_release+0x5f/0x90
> [ 5.441089] drm_release+0xda/0x140
> [ 5.441090] __fput+0xed/0x2d0
> [ 5.441091] fput_close_sync+0x3d/0xa0
> [ 5.441092] __x64_sys_close+0x3e/0x90
> [ 5.441094] x64_sys_call+0x1b5e/0x26a0
> [ 5.441095] do_syscall_64+0x80/0x570
> [ 5.441096] ? x64_sys_call+0x1144/0x26a0
> [ 5.441097] ? do_syscall_64+0xb8/0x570
> [ 5.441099] ? __vm_munmap+0xdb/0x190
> [ 5.441101] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441102] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441103] ? do_syscall_64+0xb8/0x570
> [ 5.441104] ? irqentry_exit+0x43/0x50
> [ 5.441105] ? exc_page_fault+0x90/0x1b0
> [ 5.441106] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441107] RIP: 0033:0x713c256fa74c
> [ 5.441108] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441109] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441109] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441110] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441111] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441111] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441112] </TASK>
> [ 5.441113] ---[ end trace 0000000000000000 ]---
> [ 5.441151] ------------[ cut here ]------------
> [ 5.441152] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->pages_pin_count))
> [ 5.441155] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:182 drm_gem_shmem_free+0x18d/0x1a0
> [ 5.441157] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.441179] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.441180] Tainted: [W]=WARN
> [ 5.441180] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.441181] RIP: 0010:drm_gem_shmem_free+0x18d/0x1a0
> [ 5.441182] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 ec 4e 02 00 48 c7 c1 58 04 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 13 09 46 ff <0f> 0b e9 35 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90
> [ 5.441182] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
> [ 5.441183] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
> [ 5.441184] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.441184] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441184] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
> [ 5.441185] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
> [ 5.441186] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441186] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441187] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441187] PKRU: 55555554
> [ 5.441188] Call Trace:
> [ 5.441188] <TASK>
> [ 5.441188] drm_gem_shmem_object_free+0x9/0x20
> [ 5.441189] drm_gem_object_handle_put_unlocked+0x12c/0x140
> [ 5.441191] drm_framebuffer_cleanup+0x60/0xe0
> [ 5.441192] drm_gem_fb_destroy+0x79/0xc0
> [ 5.441193] drm_framebuffer_free+0x43/0xa0
> [ 5.441194] drm_mode_config_cleanup+0x29c/0x360
> [ 5.441195] ? drm_mode_config_cleanup+0x1f2/0x360
> [ 5.441196] ? drm_managed_release+0xc2/0x160
> [ 5.441197] drm_mode_config_init_release+0xe/0x20
> [ 5.441198] drm_managed_release+0x8f/0x160
> [ 5.441199] drm_minor_release+0x5f/0x90
> [ 5.441200] drm_release+0xda/0x140
> [ 5.441201] __fput+0xed/0x2d0
> [ 5.441202] fput_close_sync+0x3d/0xa0
> [ 5.441204] __x64_sys_close+0x3e/0x90
> [ 5.441205] x64_sys_call+0x1b5e/0x26a0
> [ 5.441206] do_syscall_64+0x80/0x570
> [ 5.441208] ? x64_sys_call+0x1144/0x26a0
> [ 5.441209] ? do_syscall_64+0xb8/0x570
> [ 5.441210] ? __vm_munmap+0xdb/0x190
> [ 5.441212] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441213] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441214] ? do_syscall_64+0xb8/0x570
> [ 5.441216] ? irqentry_exit+0x43/0x50
> [ 5.441216] ? exc_page_fault+0x90/0x1b0
> [ 5.441218] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441219] RIP: 0033:0x713c256fa74c
> [ 5.441219] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441234] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441236] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441237] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441238] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441238] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441239] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441241] </TASK>
> [ 5.441241] ---[ end trace 0000000000000000 ]---
^ permalink raw reply related [flat|nested] 33+ messages in thread
* ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev3)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (4 preceding siblings ...)
2026-03-14 19:51 ` ✓ Xe.CI.FULL: " Patchwork
@ 2026-03-25 18:33 ` Patchwork
2026-03-25 18:34 ` ✓ CI.KUnit: success " Patchwork
` (9 subsequent siblings)
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-25 18:33 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev3)
URL : https://patchwork.freedesktop.org/series/162134/
State : warning
== Summary ==
+ KERNEL=/kernel
+ git clone https://gitlab.freedesktop.org/drm/maintainer-tools mt
Cloning into 'mt'...
warning: redirecting to https://gitlab.freedesktop.org/drm/maintainer-tools.git/
+ git -C mt rev-list -n1 origin/master
1f57ba1afceae32108bd24770069f764d940a0e4
+ cd /kernel
+ git config --global --add safe.directory /kernel
+ git log -n1
commit 2844d779265aa02b4c448c1113b1d01e80c4e8aa
Author: Maarten Lankhorst <dev@lankhorst.se>
Date: Wed Mar 25 19:28:06 2026 +0100
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
Hello,
What about this patch?
Kind regards,
~Maarten Lankhorst
------8<---------
---------
Den 2026-03-25 kl. 18:26, skrev Guenter Roeck:
> Hi,
>
> On Fri, Mar 13, 2026 at 04:17:27PM +0100, Maarten Lankhorst wrote:
>> When trying to do a rather aggressive test of igt's "xe_module_load
>> --r reload" with a full desktop environment and game running I noticed
>> a few OOPSes when dereferencing freed pointers, related to
>> framebuffers and property blobs after the compositor exits.
>>
>> Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
>> and immediately put the references from struct drm_file objects during
>> drm_dev_unplug().
>>
>
> With this patch in v6.18.20, I get the warning backtraces below.
> The backtraces are gone with the patch reverted.
>
> Guenter
>
> ---
> [ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 08:22:19 PDT 2026
> [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.18.20-spi+ root=UUID=ce436484-f920-47a8-a8c4-c17ff3a877e8 ro quiet splash amdgpu.gpu_recovery=1 amdgpu.ppfeaturemask=0xfff73fff vt.handoff=7
> ...
> [ 4.254064] nouveau 0000:2b:00.0: NVIDIA GK208B (b060b0b1)
> ...
> [ 5.440862] ------------[ cut here ]------------
> [ 5.440864] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:537 drm_mode_config_cleanup+0x313/0x360
> [ 5.440868] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.440902] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Not tainted 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.440903] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.440904] RIP: 0010:drm_mode_config_cleanup+0x313/0x360
> [ 5.440906] Code: 8b 45 d0 65 48 2b 05 84 22 0b 02 75 64 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 48 8d 75 88 4c 89 e7 e8 1f 12 fe ff eb 10 48 8b 70 60 48 c7
> [ 5.440907] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010202
> [ 5.440908] RAX: ffff89bcc2268258 RBX: ffff89bcc2268290 RCX: 0000000000000000
> [ 5.440909] RDX: ffff89bcc2269308 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.440909] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
> [ 5.440910] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
> [ 5.440910] R13: ffff89bcc2268298 R14: ffff89bcc5c3f480 R15: dead000000000100
> [ 5.440911] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.440912] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.440912] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.440913] PKRU: 55555554
> [ 5.440914] Call Trace:
> [ 5.440914] <TASK>
> [ 5.440916] ? drm_managed_release+0xc2/0x160
> [ 5.440918] drm_mode_config_init_release+0xe/0x20
> [ 5.440919] drm_managed_release+0x8f/0x160
> [ 5.440920] drm_minor_release+0x5f/0x90
> [ 5.440921] drm_release+0xda/0x140
> [ 5.440923] __fput+0xed/0x2d0
> [ 5.440925] fput_close_sync+0x3d/0xa0
> [ 5.440927] __x64_sys_close+0x3e/0x90
> [ 5.440928] x64_sys_call+0x1b5e/0x26a0
> [ 5.440930] do_syscall_64+0x80/0x570
> [ 5.440934] ? x64_sys_call+0x1144/0x26a0
> [ 5.440935] ? do_syscall_64+0xb8/0x570
> [ 5.440937] ? __vm_munmap+0xdb/0x190
> [ 5.440939] ? __x64_sys_munmap+0x1b/0x30
> [ 5.440941] ? x64_sys_call+0x1be5/0x26a0
> [ 5.440942] ? do_syscall_64+0xb8/0x570
> [ 5.440943] ? irqentry_exit+0x43/0x50
> [ 5.440944] ? exc_page_fault+0x90/0x1b0
> [ 5.440946] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.440947] RIP: 0033:0x713c256fa74c
> [ 5.440948] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.440949] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.440950] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.440951] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.440951] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.440952] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.440952] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.440953] </TASK>
> [ 5.440954] ---[ end trace 0000000000000000 ]---
> [ 5.440955] [drm:drm_mode_config_cleanup] *ERROR* connector Unknown-1 leaked!
> [ 5.440971] ------------[ cut here ]------------
> [ 5.440971] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:571 drm_mode_config_cleanup+0x34f/0x360
> [ 5.440973] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.440995] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.440997] Tainted: [W]=WARN
> [ 5.440997] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.440998] RIP: 0010:drm_mode_config_cleanup+0x34f/0x360
> [ 5.440999] Code: 70 60 48 c7 c7 a7 90 93 ba e8 3d bb 00 00 48 8d 7d 88 e8 c4 32 fe ff 48 85 c0 75 e2 48 8d 7d 88 e8 d6 31 fe ff e9 7b fd ff ff <0f> 0b e9 79 fe ff ff 0f 0b eb 8e e8 01 a4 65 00 90 90 90 90 90 90
> [ 5.441000] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010293
> [ 5.441001] RAX: ffff89bcd7c61bc8 RBX: ffff89bcc2268368 RCX: 0000000000000000
> [ 5.441001] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89bcc2268368
> [ 5.441002] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441002] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
> [ 5.441002] R13: ffff89bcc2268390 R14: ffff89bcc2268230 R15: dead000000000100
> [ 5.441003] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441004] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441005] PKRU: 55555554
> [ 5.441005] Call Trace:
> [ 5.441006] <TASK>
> [ 5.441006] ? drm_managed_release+0xc2/0x160
> [ 5.441008] drm_mode_config_init_release+0xe/0x20
> [ 5.441009] drm_managed_release+0x8f/0x160
> [ 5.441010] drm_minor_release+0x5f/0x90
> [ 5.441011] drm_release+0xda/0x140
> [ 5.441012] __fput+0xed/0x2d0
> [ 5.441013] fput_close_sync+0x3d/0xa0
> [ 5.441014] __x64_sys_close+0x3e/0x90
> [ 5.441015] x64_sys_call+0x1b5e/0x26a0
> [ 5.441017] do_syscall_64+0x80/0x570
> [ 5.441018] ? x64_sys_call+0x1144/0x26a0
> [ 5.441019] ? do_syscall_64+0xb8/0x570
> [ 5.441021] ? __vm_munmap+0xdb/0x190
> [ 5.441023] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441024] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441025] ? do_syscall_64+0xb8/0x570
> [ 5.441026] ? irqentry_exit+0x43/0x50
> [ 5.441027] ? exc_page_fault+0x90/0x1b0
> [ 5.441029] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441029] RIP: 0033:0x713c256fa74c
> [ 5.441030] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441031] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441031] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441032] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441032] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441033] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441033] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441035] </TASK>
> [ 5.441035] ---[ end trace 0000000000000000 ]---
> [ 5.441036] ------------[ cut here ]------------
> [ 5.441036] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->vmap_use_count))
> [ 5.441041] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:170 drm_gem_shmem_free+0x111/0x1a0
> [ 5.441043] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.441066] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.441067] Tainted: [W]=WARN
> [ 5.441067] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.441068] RIP: 0010:drm_gem_shmem_free+0x111/0x1a0
> [ 5.441069] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 68 4f 02 00 48 c7 c1 e8 03 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 8f 09 46 ff <0f> 0b e9 4b ff ff ff 48 8b 7b 08 48 85 ff 74 04 48 8b 7f 08 4c 8b
> [ 5.441070] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
> [ 5.441070] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
> [ 5.441071] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.441071] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441072] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
> [ 5.441072] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
> [ 5.441073] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441073] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441074] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441075] PKRU: 55555554
> [ 5.441075] Call Trace:
> [ 5.441075] <TASK>
> [ 5.441076] drm_gem_shmem_object_free+0x9/0x20
> [ 5.441077] drm_gem_object_handle_put_unlocked+0x12c/0x140
> [ 5.441079] drm_framebuffer_cleanup+0x60/0xe0
> [ 5.441080] drm_gem_fb_destroy+0x79/0xc0
> [ 5.441081] drm_framebuffer_free+0x43/0xa0
> [ 5.441083] drm_mode_config_cleanup+0x29c/0x360
> [ 5.441084] ? drm_mode_config_cleanup+0x1f2/0x360
> [ 5.441085] ? drm_managed_release+0xc2/0x160
> [ 5.441086] drm_mode_config_init_release+0xe/0x20
> [ 5.441087] drm_managed_release+0x8f/0x160
> [ 5.441088] drm_minor_release+0x5f/0x90
> [ 5.441089] drm_release+0xda/0x140
> [ 5.441090] __fput+0xed/0x2d0
> [ 5.441091] fput_close_sync+0x3d/0xa0
> [ 5.441092] __x64_sys_close+0x3e/0x90
> [ 5.441094] x64_sys_call+0x1b5e/0x26a0
> [ 5.441095] do_syscall_64+0x80/0x570
> [ 5.441096] ? x64_sys_call+0x1144/0x26a0
> [ 5.441097] ? do_syscall_64+0xb8/0x570
> [ 5.441099] ? __vm_munmap+0xdb/0x190
> [ 5.441101] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441102] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441103] ? do_syscall_64+0xb8/0x570
> [ 5.441104] ? irqentry_exit+0x43/0x50
> [ 5.441105] ? exc_page_fault+0x90/0x1b0
> [ 5.441106] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441107] RIP: 0033:0x713c256fa74c
> [ 5.441108] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441109] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441109] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441110] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441111] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441111] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441112] </TASK>
> [ 5.441113] ---[ end trace 0000000000000000 ]---
> [ 5.441151] ------------[ cut here ]------------
> [ 5.441152] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->pages_pin_count))
> [ 5.441155] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:182 drm_gem_shmem_free+0x18d/0x1a0
> [ 5.441157] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.441179] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.441180] Tainted: [W]=WARN
> [ 5.441180] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.441181] RIP: 0010:drm_gem_shmem_free+0x18d/0x1a0
> [ 5.441182] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 ec 4e 02 00 48 c7 c1 58 04 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 13 09 46 ff <0f> 0b e9 35 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90
> [ 5.441182] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
> [ 5.441183] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
> [ 5.441184] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.441184] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441184] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
> [ 5.441185] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
> [ 5.441186] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441186] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441187] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441187] PKRU: 55555554
> [ 5.441188] Call Trace:
> [ 5.441188] <TASK>
> [ 5.441188] drm_gem_shmem_object_free+0x9/0x20
> [ 5.441189] drm_gem_object_handle_put_unlocked+0x12c/0x140
> [ 5.441191] drm_framebuffer_cleanup+0x60/0xe0
> [ 5.441192] drm_gem_fb_destroy+0x79/0xc0
> [ 5.441193] drm_framebuffer_free+0x43/0xa0
> [ 5.441194] drm_mode_config_cleanup+0x29c/0x360
> [ 5.441195] ? drm_mode_config_cleanup+0x1f2/0x360
> [ 5.441196] ? drm_managed_release+0xc2/0x160
> [ 5.441197] drm_mode_config_init_release+0xe/0x20
> [ 5.441198] drm_managed_release+0x8f/0x160
> [ 5.441199] drm_minor_release+0x5f/0x90
> [ 5.441200] drm_release+0xda/0x140
> [ 5.441201] __fput+0xed/0x2d0
> [ 5.441202] fput_close_sync+0x3d/0xa0
> [ 5.441204] __x64_sys_close+0x3e/0x90
> [ 5.441205] x64_sys_call+0x1b5e/0x26a0
> [ 5.441206] do_syscall_64+0x80/0x570
> [ 5.441208] ? x64_sys_call+0x1144/0x26a0
> [ 5.441209] ? do_syscall_64+0xb8/0x570
> [ 5.441210] ? __vm_munmap+0xdb/0x190
> [ 5.441212] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441213] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441214] ? do_syscall_64+0xb8/0x570
> [ 5.441216] ? irqentry_exit+0x43/0x50
> [ 5.441216] ? exc_page_fault+0x90/0x1b0
> [ 5.441218] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441219] RIP: 0033:0x713c256fa74c
> [ 5.441219] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441234] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441236] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441237] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441238] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441238] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441239] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441241] </TASK>
> [ 5.441241] ---[ end trace 0000000000000000 ]---
+ /mt/dim checkpatch cfe3d5f3eb5cf3b8aff1710c1c5c1d666f932aa8 drm-intel
2844d779265a drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
-:14: ERROR:BAD_COMMIT_SEPARATOR: Invalid commit separator - some tools may have problems applying this
#14:
------8<---------
-:15: ERROR:BAD_COMMIT_SEPARATOR: Invalid commit separator - some tools may have problems applying this
#15:
---------
-:37: WARNING:COMMIT_LOG_LONG_LINE: Prefer a maximum 75 chars per line (possible unwrapped commit description?)
#37:
> [ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 08:22:19 PDT 2026
-:281: WARNING:MISSING_FIXES_TAG: The commit message has 'Call Trace:', perhaps it also needs a 'Fixes:' tag?
-:281: ERROR:MISSING_SIGN_OFF: Missing Signed-off-by: line(s)
total: 3 errors, 2 warnings, 0 checks, 21 lines checked
^ permalink raw reply [flat|nested] 33+ messages in thread
* ✓ CI.KUnit: success for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev3)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (5 preceding siblings ...)
2026-03-25 18:33 ` ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev3) Patchwork
@ 2026-03-25 18:34 ` Patchwork
2026-03-25 19:29 ` ✓ Xe.CI.BAT: " Patchwork
` (8 subsequent siblings)
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-25 18:34 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev3)
URL : https://patchwork.freedesktop.org/series/162134/
State : success
== Summary ==
+ trap cleanup EXIT
+ /kernel/tools/testing/kunit/kunit.py run --kunitconfig /kernel/drivers/gpu/drm/xe/.kunitconfig
[18:33:27] Configuring KUnit Kernel ...
Generating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[18:33:31] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=48
[18:34:01] Starting KUnit Kernel (1/1)...
[18:34:01] ============================================================
Running tests with:
$ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[18:34:02] ================== guc_buf (11 subtests) ===================
[18:34:02] [PASSED] test_smallest
[18:34:02] [PASSED] test_largest
[18:34:02] [PASSED] test_granular
[18:34:02] [PASSED] test_unique
[18:34:02] [PASSED] test_overlap
[18:34:02] [PASSED] test_reusable
[18:34:02] [PASSED] test_too_big
[18:34:02] [PASSED] test_flush
[18:34:02] [PASSED] test_lookup
[18:34:02] [PASSED] test_data
[18:34:02] [PASSED] test_class
[18:34:02] ===================== [PASSED] guc_buf =====================
[18:34:02] =================== guc_dbm (7 subtests) ===================
[18:34:02] [PASSED] test_empty
[18:34:02] [PASSED] test_default
[18:34:02] ======================== test_size ========================
[18:34:02] [PASSED] 4
[18:34:02] [PASSED] 8
[18:34:02] [PASSED] 32
[18:34:02] [PASSED] 256
[18:34:02] ==================== [PASSED] test_size ====================
[18:34:02] ======================= test_reuse ========================
[18:34:02] [PASSED] 4
[18:34:02] [PASSED] 8
[18:34:02] [PASSED] 32
[18:34:02] [PASSED] 256
[18:34:02] =================== [PASSED] test_reuse ====================
[18:34:02] =================== test_range_overlap ====================
[18:34:02] [PASSED] 4
[18:34:02] [PASSED] 8
[18:34:02] [PASSED] 32
[18:34:02] [PASSED] 256
[18:34:02] =============== [PASSED] test_range_overlap ================
[18:34:02] =================== test_range_compact ====================
[18:34:02] [PASSED] 4
[18:34:02] [PASSED] 8
[18:34:02] [PASSED] 32
[18:34:02] [PASSED] 256
[18:34:02] =============== [PASSED] test_range_compact ================
[18:34:02] ==================== test_range_spare =====================
[18:34:02] [PASSED] 4
[18:34:02] [PASSED] 8
[18:34:02] [PASSED] 32
[18:34:02] [PASSED] 256
[18:34:02] ================ [PASSED] test_range_spare =================
[18:34:02] ===================== [PASSED] guc_dbm =====================
[18:34:02] =================== guc_idm (6 subtests) ===================
[18:34:02] [PASSED] bad_init
[18:34:02] [PASSED] no_init
[18:34:02] [PASSED] init_fini
[18:34:02] [PASSED] check_used
[18:34:02] [PASSED] check_quota
[18:34:02] [PASSED] check_all
[18:34:02] ===================== [PASSED] guc_idm =====================
[18:34:02] ================== no_relay (3 subtests) ===================
[18:34:02] [PASSED] xe_drops_guc2pf_if_not_ready
[18:34:02] [PASSED] xe_drops_guc2vf_if_not_ready
[18:34:02] [PASSED] xe_rejects_send_if_not_ready
[18:34:02] ==================== [PASSED] no_relay =====================
[18:34:02] ================== pf_relay (14 subtests) ==================
[18:34:02] [PASSED] pf_rejects_guc2pf_too_short
[18:34:02] [PASSED] pf_rejects_guc2pf_too_long
[18:34:02] [PASSED] pf_rejects_guc2pf_no_payload
[18:34:02] [PASSED] pf_fails_no_payload
[18:34:02] [PASSED] pf_fails_bad_origin
[18:34:02] [PASSED] pf_fails_bad_type
[18:34:02] [PASSED] pf_txn_reports_error
[18:34:02] [PASSED] pf_txn_sends_pf2guc
[18:34:02] [PASSED] pf_sends_pf2guc
[18:34:02] [SKIPPED] pf_loopback_nop
[18:34:02] [SKIPPED] pf_loopback_echo
[18:34:02] [SKIPPED] pf_loopback_fail
[18:34:02] [SKIPPED] pf_loopback_busy
[18:34:02] [SKIPPED] pf_loopback_retry
[18:34:02] ==================== [PASSED] pf_relay =====================
[18:34:02] ================== vf_relay (3 subtests) ===================
[18:34:02] [PASSED] vf_rejects_guc2vf_too_short
[18:34:02] [PASSED] vf_rejects_guc2vf_too_long
[18:34:02] [PASSED] vf_rejects_guc2vf_no_payload
[18:34:02] ==================== [PASSED] vf_relay =====================
[18:34:02] ================ pf_gt_config (9 subtests) =================
[18:34:02] [PASSED] fair_contexts_1vf
[18:34:02] [PASSED] fair_doorbells_1vf
[18:34:02] [PASSED] fair_ggtt_1vf
[18:34:02] ====================== fair_vram_1vf ======================
[18:34:02] [PASSED] 3.50 GiB
[18:34:02] [PASSED] 11.5 GiB
[18:34:02] [PASSED] 15.5 GiB
[18:34:02] [PASSED] 31.5 GiB
[18:34:02] [PASSED] 63.5 GiB
[18:34:02] [PASSED] 1.91 GiB
[18:34:02] ================== [PASSED] fair_vram_1vf ==================
[18:34:02] ================ fair_vram_1vf_admin_only =================
[18:34:02] [PASSED] 3.50 GiB
[18:34:02] [PASSED] 11.5 GiB
[18:34:02] [PASSED] 15.5 GiB
[18:34:02] [PASSED] 31.5 GiB
[18:34:02] [PASSED] 63.5 GiB
[18:34:02] [PASSED] 1.91 GiB
[18:34:02] ============ [PASSED] fair_vram_1vf_admin_only =============
[18:34:02] ====================== fair_contexts ======================
[18:34:02] [PASSED] 1 VF
[18:34:02] [PASSED] 2 VFs
[18:34:02] [PASSED] 3 VFs
[18:34:02] [PASSED] 4 VFs
[18:34:02] [PASSED] 5 VFs
[18:34:02] [PASSED] 6 VFs
[18:34:02] [PASSED] 7 VFs
[18:34:02] [PASSED] 8 VFs
[18:34:02] [PASSED] 9 VFs
[18:34:02] [PASSED] 10 VFs
[18:34:02] [PASSED] 11 VFs
[18:34:02] [PASSED] 12 VFs
[18:34:02] [PASSED] 13 VFs
[18:34:02] [PASSED] 14 VFs
[18:34:02] [PASSED] 15 VFs
[18:34:02] [PASSED] 16 VFs
[18:34:02] [PASSED] 17 VFs
[18:34:02] [PASSED] 18 VFs
[18:34:02] [PASSED] 19 VFs
[18:34:02] [PASSED] 20 VFs
[18:34:02] [PASSED] 21 VFs
[18:34:02] [PASSED] 22 VFs
[18:34:02] [PASSED] 23 VFs
[18:34:02] [PASSED] 24 VFs
[18:34:02] [PASSED] 25 VFs
[18:34:02] [PASSED] 26 VFs
[18:34:02] [PASSED] 27 VFs
[18:34:02] [PASSED] 28 VFs
[18:34:02] [PASSED] 29 VFs
[18:34:02] [PASSED] 30 VFs
[18:34:02] [PASSED] 31 VFs
[18:34:02] [PASSED] 32 VFs
[18:34:02] [PASSED] 33 VFs
[18:34:02] [PASSED] 34 VFs
[18:34:02] [PASSED] 35 VFs
[18:34:02] [PASSED] 36 VFs
[18:34:02] [PASSED] 37 VFs
[18:34:02] [PASSED] 38 VFs
[18:34:02] [PASSED] 39 VFs
[18:34:02] [PASSED] 40 VFs
[18:34:02] [PASSED] 41 VFs
[18:34:02] [PASSED] 42 VFs
[18:34:02] [PASSED] 43 VFs
[18:34:02] [PASSED] 44 VFs
[18:34:02] [PASSED] 45 VFs
[18:34:02] [PASSED] 46 VFs
[18:34:02] [PASSED] 47 VFs
[18:34:02] [PASSED] 48 VFs
[18:34:02] [PASSED] 49 VFs
[18:34:02] [PASSED] 50 VFs
[18:34:02] [PASSED] 51 VFs
[18:34:02] [PASSED] 52 VFs
[18:34:02] [PASSED] 53 VFs
[18:34:02] [PASSED] 54 VFs
[18:34:02] [PASSED] 55 VFs
[18:34:02] [PASSED] 56 VFs
[18:34:02] [PASSED] 57 VFs
[18:34:02] [PASSED] 58 VFs
[18:34:02] [PASSED] 59 VFs
[18:34:02] [PASSED] 60 VFs
[18:34:02] [PASSED] 61 VFs
[18:34:02] [PASSED] 62 VFs
[18:34:02] [PASSED] 63 VFs
[18:34:02] ================== [PASSED] fair_contexts ==================
[18:34:02] ===================== fair_doorbells ======================
[18:34:02] [PASSED] 1 VF
[18:34:02] [PASSED] 2 VFs
[18:34:02] [PASSED] 3 VFs
[18:34:02] [PASSED] 4 VFs
[18:34:02] [PASSED] 5 VFs
[18:34:02] [PASSED] 6 VFs
[18:34:02] [PASSED] 7 VFs
[18:34:02] [PASSED] 8 VFs
[18:34:02] [PASSED] 9 VFs
[18:34:02] [PASSED] 10 VFs
[18:34:02] [PASSED] 11 VFs
[18:34:02] [PASSED] 12 VFs
[18:34:02] [PASSED] 13 VFs
[18:34:02] [PASSED] 14 VFs
[18:34:02] [PASSED] 15 VFs
[18:34:02] [PASSED] 16 VFs
[18:34:02] [PASSED] 17 VFs
[18:34:02] [PASSED] 18 VFs
[18:34:02] [PASSED] 19 VFs
[18:34:02] [PASSED] 20 VFs
[18:34:02] [PASSED] 21 VFs
[18:34:02] [PASSED] 22 VFs
[18:34:02] [PASSED] 23 VFs
[18:34:02] [PASSED] 24 VFs
[18:34:02] [PASSED] 25 VFs
[18:34:02] [PASSED] 26 VFs
[18:34:02] [PASSED] 27 VFs
[18:34:02] [PASSED] 28 VFs
[18:34:02] [PASSED] 29 VFs
[18:34:02] [PASSED] 30 VFs
[18:34:02] [PASSED] 31 VFs
[18:34:02] [PASSED] 32 VFs
[18:34:02] [PASSED] 33 VFs
[18:34:02] [PASSED] 34 VFs
[18:34:02] [PASSED] 35 VFs
[18:34:02] [PASSED] 36 VFs
[18:34:02] [PASSED] 37 VFs
[18:34:02] [PASSED] 38 VFs
[18:34:02] [PASSED] 39 VFs
[18:34:02] [PASSED] 40 VFs
[18:34:02] [PASSED] 41 VFs
[18:34:02] [PASSED] 42 VFs
[18:34:02] [PASSED] 43 VFs
[18:34:02] [PASSED] 44 VFs
[18:34:02] [PASSED] 45 VFs
[18:34:02] [PASSED] 46 VFs
[18:34:02] [PASSED] 47 VFs
[18:34:02] [PASSED] 48 VFs
[18:34:02] [PASSED] 49 VFs
[18:34:02] [PASSED] 50 VFs
[18:34:02] [PASSED] 51 VFs
[18:34:02] [PASSED] 52 VFs
[18:34:02] [PASSED] 53 VFs
[18:34:02] [PASSED] 54 VFs
[18:34:02] [PASSED] 55 VFs
[18:34:02] [PASSED] 56 VFs
[18:34:02] [PASSED] 57 VFs
[18:34:02] [PASSED] 58 VFs
[18:34:02] [PASSED] 59 VFs
[18:34:02] [PASSED] 60 VFs
[18:34:02] [PASSED] 61 VFs
[18:34:02] [PASSED] 62 VFs
[18:34:02] [PASSED] 63 VFs
[18:34:02] ================= [PASSED] fair_doorbells ==================
[18:34:02] ======================== fair_ggtt ========================
[18:34:02] [PASSED] 1 VF
[18:34:02] [PASSED] 2 VFs
[18:34:02] [PASSED] 3 VFs
[18:34:02] [PASSED] 4 VFs
[18:34:02] [PASSED] 5 VFs
[18:34:02] [PASSED] 6 VFs
[18:34:02] [PASSED] 7 VFs
[18:34:02] [PASSED] 8 VFs
[18:34:02] [PASSED] 9 VFs
[18:34:02] [PASSED] 10 VFs
[18:34:02] [PASSED] 11 VFs
[18:34:02] [PASSED] 12 VFs
[18:34:02] [PASSED] 13 VFs
[18:34:02] [PASSED] 14 VFs
[18:34:02] [PASSED] 15 VFs
[18:34:02] [PASSED] 16 VFs
[18:34:02] [PASSED] 17 VFs
[18:34:02] [PASSED] 18 VFs
[18:34:02] [PASSED] 19 VFs
[18:34:02] [PASSED] 20 VFs
[18:34:02] [PASSED] 21 VFs
[18:34:02] [PASSED] 22 VFs
[18:34:02] [PASSED] 23 VFs
[18:34:02] [PASSED] 24 VFs
[18:34:02] [PASSED] 25 VFs
[18:34:02] [PASSED] 26 VFs
[18:34:02] [PASSED] 27 VFs
[18:34:02] [PASSED] 28 VFs
[18:34:02] [PASSED] 29 VFs
[18:34:02] [PASSED] 30 VFs
[18:34:02] [PASSED] 31 VFs
[18:34:02] [PASSED] 32 VFs
[18:34:02] [PASSED] 33 VFs
[18:34:02] [PASSED] 34 VFs
[18:34:02] [PASSED] 35 VFs
[18:34:02] [PASSED] 36 VFs
[18:34:02] [PASSED] 37 VFs
[18:34:02] [PASSED] 38 VFs
[18:34:02] [PASSED] 39 VFs
[18:34:02] [PASSED] 40 VFs
[18:34:02] [PASSED] 41 VFs
[18:34:02] [PASSED] 42 VFs
[18:34:02] [PASSED] 43 VFs
[18:34:02] [PASSED] 44 VFs
[18:34:02] [PASSED] 45 VFs
[18:34:02] [PASSED] 46 VFs
[18:34:02] [PASSED] 47 VFs
[18:34:02] [PASSED] 48 VFs
[18:34:02] [PASSED] 49 VFs
[18:34:02] [PASSED] 50 VFs
[18:34:02] [PASSED] 51 VFs
[18:34:02] [PASSED] 52 VFs
[18:34:02] [PASSED] 53 VFs
[18:34:02] [PASSED] 54 VFs
[18:34:02] [PASSED] 55 VFs
[18:34:02] [PASSED] 56 VFs
[18:34:02] [PASSED] 57 VFs
[18:34:02] [PASSED] 58 VFs
[18:34:02] [PASSED] 59 VFs
[18:34:02] [PASSED] 60 VFs
[18:34:02] [PASSED] 61 VFs
[18:34:02] [PASSED] 62 VFs
[18:34:02] [PASSED] 63 VFs
[18:34:02] ==================== [PASSED] fair_ggtt ====================
[18:34:02] ======================== fair_vram ========================
[18:34:02] [PASSED] 1 VF
[18:34:02] [PASSED] 2 VFs
[18:34:02] [PASSED] 3 VFs
[18:34:02] [PASSED] 4 VFs
[18:34:02] [PASSED] 5 VFs
[18:34:02] [PASSED] 6 VFs
[18:34:02] [PASSED] 7 VFs
[18:34:02] [PASSED] 8 VFs
[18:34:02] [PASSED] 9 VFs
[18:34:02] [PASSED] 10 VFs
[18:34:02] [PASSED] 11 VFs
[18:34:02] [PASSED] 12 VFs
[18:34:02] [PASSED] 13 VFs
[18:34:02] [PASSED] 14 VFs
[18:34:02] [PASSED] 15 VFs
[18:34:02] [PASSED] 16 VFs
[18:34:02] [PASSED] 17 VFs
[18:34:02] [PASSED] 18 VFs
[18:34:02] [PASSED] 19 VFs
[18:34:02] [PASSED] 20 VFs
[18:34:02] [PASSED] 21 VFs
[18:34:02] [PASSED] 22 VFs
[18:34:02] [PASSED] 23 VFs
[18:34:02] [PASSED] 24 VFs
[18:34:02] [PASSED] 25 VFs
[18:34:02] [PASSED] 26 VFs
[18:34:02] [PASSED] 27 VFs
[18:34:02] [PASSED] 28 VFs
[18:34:02] [PASSED] 29 VFs
[18:34:02] [PASSED] 30 VFs
[18:34:02] [PASSED] 31 VFs
[18:34:02] [PASSED] 32 VFs
[18:34:02] [PASSED] 33 VFs
[18:34:02] [PASSED] 34 VFs
[18:34:02] [PASSED] 35 VFs
[18:34:02] [PASSED] 36 VFs
[18:34:02] [PASSED] 37 VFs
[18:34:02] [PASSED] 38 VFs
[18:34:02] [PASSED] 39 VFs
[18:34:02] [PASSED] 40 VFs
[18:34:02] [PASSED] 41 VFs
[18:34:02] [PASSED] 42 VFs
[18:34:02] [PASSED] 43 VFs
[18:34:02] [PASSED] 44 VFs
[18:34:02] [PASSED] 45 VFs
[18:34:02] [PASSED] 46 VFs
[18:34:02] [PASSED] 47 VFs
[18:34:02] [PASSED] 48 VFs
[18:34:02] [PASSED] 49 VFs
[18:34:02] [PASSED] 50 VFs
[18:34:02] [PASSED] 51 VFs
[18:34:02] [PASSED] 52 VFs
[18:34:02] [PASSED] 53 VFs
[18:34:02] [PASSED] 54 VFs
[18:34:02] [PASSED] 55 VFs
[18:34:02] [PASSED] 56 VFs
[18:34:02] [PASSED] 57 VFs
[18:34:02] [PASSED] 58 VFs
[18:34:02] [PASSED] 59 VFs
[18:34:02] [PASSED] 60 VFs
[18:34:02] [PASSED] 61 VFs
[18:34:02] [PASSED] 62 VFs
[18:34:02] [PASSED] 63 VFs
[18:34:02] ==================== [PASSED] fair_vram ====================
[18:34:02] ================== [PASSED] pf_gt_config ===================
[18:34:02] ===================== lmtt (1 subtest) =====================
[18:34:02] ======================== test_ops =========================
[18:34:02] [PASSED] 2-level
[18:34:02] [PASSED] multi-level
[18:34:02] ==================== [PASSED] test_ops =====================
[18:34:02] ====================== [PASSED] lmtt =======================
[18:34:02] ================= pf_service (11 subtests) =================
[18:34:02] [PASSED] pf_negotiate_any
[18:34:02] [PASSED] pf_negotiate_base_match
[18:34:02] [PASSED] pf_negotiate_base_newer
[18:34:02] [PASSED] pf_negotiate_base_next
[18:34:02] [SKIPPED] pf_negotiate_base_older
[18:34:02] [PASSED] pf_negotiate_base_prev
[18:34:02] [PASSED] pf_negotiate_latest_match
[18:34:02] [PASSED] pf_negotiate_latest_newer
[18:34:02] [PASSED] pf_negotiate_latest_next
[18:34:02] [SKIPPED] pf_negotiate_latest_older
[18:34:02] [SKIPPED] pf_negotiate_latest_prev
[18:34:02] =================== [PASSED] pf_service ====================
[18:34:02] ================= xe_guc_g2g (2 subtests) ==================
[18:34:02] ============== xe_live_guc_g2g_kunit_default ==============
[18:34:02] ========= [SKIPPED] xe_live_guc_g2g_kunit_default ==========
[18:34:02] ============== xe_live_guc_g2g_kunit_allmem ===============
[18:34:02] ========== [SKIPPED] xe_live_guc_g2g_kunit_allmem ==========
[18:34:02] =================== [SKIPPED] xe_guc_g2g ===================
[18:34:02] =================== xe_mocs (2 subtests) ===================
[18:34:02] ================ xe_live_mocs_kernel_kunit ================
[18:34:02] =========== [SKIPPED] xe_live_mocs_kernel_kunit ============
[18:34:02] ================ xe_live_mocs_reset_kunit =================
[18:34:02] ============ [SKIPPED] xe_live_mocs_reset_kunit ============
[18:34:02] ==================== [SKIPPED] xe_mocs =====================
[18:34:02] ================= xe_migrate (2 subtests) ==================
[18:34:02] ================= xe_migrate_sanity_kunit =================
[18:34:02] ============ [SKIPPED] xe_migrate_sanity_kunit =============
[18:34:02] ================== xe_validate_ccs_kunit ==================
[18:34:02] ============= [SKIPPED] xe_validate_ccs_kunit ==============
[18:34:02] =================== [SKIPPED] xe_migrate ===================
[18:34:02] ================== xe_dma_buf (1 subtest) ==================
[18:34:02] ==================== xe_dma_buf_kunit =====================
[18:34:02] ================ [SKIPPED] xe_dma_buf_kunit ================
[18:34:02] =================== [SKIPPED] xe_dma_buf ===================
[18:34:02] ================= xe_bo_shrink (1 subtest) =================
[18:34:02] =================== xe_bo_shrink_kunit ====================
[18:34:02] =============== [SKIPPED] xe_bo_shrink_kunit ===============
[18:34:02] ================== [SKIPPED] xe_bo_shrink ==================
[18:34:02] ==================== xe_bo (2 subtests) ====================
[18:34:02] ================== xe_ccs_migrate_kunit ===================
[18:34:02] ============== [SKIPPED] xe_ccs_migrate_kunit ==============
[18:34:02] ==================== xe_bo_evict_kunit ====================
[18:34:02] =============== [SKIPPED] xe_bo_evict_kunit ================
[18:34:02] ===================== [SKIPPED] xe_bo ======================
[18:34:02] ==================== args (13 subtests) ====================
[18:34:02] [PASSED] count_args_test
[18:34:02] [PASSED] call_args_example
[18:34:02] [PASSED] call_args_test
[18:34:02] [PASSED] drop_first_arg_example
[18:34:02] [PASSED] drop_first_arg_test
[18:34:02] [PASSED] first_arg_example
[18:34:02] [PASSED] first_arg_test
[18:34:02] [PASSED] last_arg_example
[18:34:02] [PASSED] last_arg_test
[18:34:02] [PASSED] pick_arg_example
[18:34:02] [PASSED] if_args_example
[18:34:02] [PASSED] if_args_test
[18:34:02] [PASSED] sep_comma_example
[18:34:02] ====================== [PASSED] args =======================
[18:34:02] =================== xe_pci (3 subtests) ====================
[18:34:02] ==================== check_graphics_ip ====================
[18:34:02] [PASSED] 12.00 Xe_LP
[18:34:02] [PASSED] 12.10 Xe_LP+
[18:34:02] [PASSED] 12.55 Xe_HPG
[18:34:02] [PASSED] 12.60 Xe_HPC
[18:34:02] [PASSED] 12.70 Xe_LPG
[18:34:02] [PASSED] 12.71 Xe_LPG
[18:34:02] [PASSED] 12.74 Xe_LPG+
[18:34:02] [PASSED] 20.01 Xe2_HPG
[18:34:02] [PASSED] 20.02 Xe2_HPG
[18:34:02] [PASSED] 20.04 Xe2_LPG
[18:34:02] [PASSED] 30.00 Xe3_LPG
[18:34:02] [PASSED] 30.01 Xe3_LPG
[18:34:02] [PASSED] 30.03 Xe3_LPG
[18:34:02] [PASSED] 30.04 Xe3_LPG
[18:34:02] [PASSED] 30.05 Xe3_LPG
[18:34:02] [PASSED] 35.10 Xe3p_LPG
[18:34:02] [PASSED] 35.11 Xe3p_XPC
[18:34:02] ================ [PASSED] check_graphics_ip ================
[18:34:02] ===================== check_media_ip ======================
[18:34:02] [PASSED] 12.00 Xe_M
[18:34:02] [PASSED] 12.55 Xe_HPM
[18:34:02] [PASSED] 13.00 Xe_LPM+
[18:34:02] [PASSED] 13.01 Xe2_HPM
[18:34:02] [PASSED] 20.00 Xe2_LPM
[18:34:02] [PASSED] 30.00 Xe3_LPM
[18:34:02] [PASSED] 30.02 Xe3_LPM
[18:34:02] [PASSED] 35.00 Xe3p_LPM
[18:34:02] [PASSED] 35.03 Xe3p_HPM
[18:34:02] ================= [PASSED] check_media_ip ==================
[18:34:02] =================== check_platform_desc ===================
[18:34:02] [PASSED] 0x9A60 (TIGERLAKE)
[18:34:02] [PASSED] 0x9A68 (TIGERLAKE)
[18:34:02] [PASSED] 0x9A70 (TIGERLAKE)
[18:34:02] [PASSED] 0x9A40 (TIGERLAKE)
[18:34:02] [PASSED] 0x9A49 (TIGERLAKE)
[18:34:02] [PASSED] 0x9A59 (TIGERLAKE)
[18:34:02] [PASSED] 0x9A78 (TIGERLAKE)
[18:34:02] [PASSED] 0x9AC0 (TIGERLAKE)
[18:34:02] [PASSED] 0x9AC9 (TIGERLAKE)
[18:34:02] [PASSED] 0x9AD9 (TIGERLAKE)
[18:34:02] [PASSED] 0x9AF8 (TIGERLAKE)
[18:34:02] [PASSED] 0x4C80 (ROCKETLAKE)
[18:34:02] [PASSED] 0x4C8A (ROCKETLAKE)
[18:34:02] [PASSED] 0x4C8B (ROCKETLAKE)
[18:34:02] [PASSED] 0x4C8C (ROCKETLAKE)
[18:34:02] [PASSED] 0x4C90 (ROCKETLAKE)
[18:34:02] [PASSED] 0x4C9A (ROCKETLAKE)
[18:34:02] [PASSED] 0x4680 (ALDERLAKE_S)
[18:34:02] [PASSED] 0x4682 (ALDERLAKE_S)
[18:34:02] [PASSED] 0x4688 (ALDERLAKE_S)
[18:34:02] [PASSED] 0x468A (ALDERLAKE_S)
[18:34:02] [PASSED] 0x468B (ALDERLAKE_S)
[18:34:02] [PASSED] 0x4690 (ALDERLAKE_S)
[18:34:02] [PASSED] 0x4692 (ALDERLAKE_S)
[18:34:02] [PASSED] 0x4693 (ALDERLAKE_S)
[18:34:02] [PASSED] 0x46A0 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46A1 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46A2 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46A3 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46A6 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46A8 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46AA (ALDERLAKE_P)
[18:34:02] [PASSED] 0x462A (ALDERLAKE_P)
[18:34:02] [PASSED] 0x4626 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x4628 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46B0 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46B1 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46B2 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46B3 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46C0 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46C1 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46C2 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46C3 (ALDERLAKE_P)
[18:34:02] [PASSED] 0x46D0 (ALDERLAKE_N)
[18:34:02] [PASSED] 0x46D1 (ALDERLAKE_N)
[18:34:02] [PASSED] 0x46D2 (ALDERLAKE_N)
[18:34:02] [PASSED] 0x46D3 (ALDERLAKE_N)
[18:34:02] [PASSED] 0x46D4 (ALDERLAKE_N)
[18:34:02] [PASSED] 0xA721 (ALDERLAKE_P)
[18:34:02] [PASSED] 0xA7A1 (ALDERLAKE_P)
[18:34:02] [PASSED] 0xA7A9 (ALDERLAKE_P)
[18:34:02] [PASSED] 0xA7AC (ALDERLAKE_P)
[18:34:02] [PASSED] 0xA7AD (ALDERLAKE_P)
[18:34:02] [PASSED] 0xA720 (ALDERLAKE_P)
[18:34:02] [PASSED] 0xA7A0 (ALDERLAKE_P)
[18:34:02] [PASSED] 0xA7A8 (ALDERLAKE_P)
[18:34:02] [PASSED] 0xA7AA (ALDERLAKE_P)
[18:34:02] [PASSED] 0xA7AB (ALDERLAKE_P)
[18:34:02] [PASSED] 0xA780 (ALDERLAKE_S)
[18:34:02] [PASSED] 0xA781 (ALDERLAKE_S)
[18:34:02] [PASSED] 0xA782 (ALDERLAKE_S)
[18:34:02] [PASSED] 0xA783 (ALDERLAKE_S)
[18:34:02] [PASSED] 0xA788 (ALDERLAKE_S)
[18:34:02] [PASSED] 0xA789 (ALDERLAKE_S)
[18:34:02] [PASSED] 0xA78A (ALDERLAKE_S)
[18:34:02] [PASSED] 0xA78B (ALDERLAKE_S)
[18:34:02] [PASSED] 0x4905 (DG1)
[18:34:02] [PASSED] 0x4906 (DG1)
[18:34:02] [PASSED] 0x4907 (DG1)
[18:34:02] [PASSED] 0x4908 (DG1)
[18:34:02] [PASSED] 0x4909 (DG1)
[18:34:02] [PASSED] 0x56C0 (DG2)
[18:34:02] [PASSED] 0x56C2 (DG2)
[18:34:02] [PASSED] 0x56C1 (DG2)
[18:34:02] [PASSED] 0x7D51 (METEORLAKE)
[18:34:02] [PASSED] 0x7DD1 (METEORLAKE)
[18:34:02] [PASSED] 0x7D41 (METEORLAKE)
[18:34:02] [PASSED] 0x7D67 (METEORLAKE)
[18:34:02] [PASSED] 0xB640 (METEORLAKE)
[18:34:02] [PASSED] 0x56A0 (DG2)
[18:34:02] [PASSED] 0x56A1 (DG2)
[18:34:02] [PASSED] 0x56A2 (DG2)
[18:34:02] [PASSED] 0x56BE (DG2)
[18:34:02] [PASSED] 0x56BF (DG2)
[18:34:02] [PASSED] 0x5690 (DG2)
[18:34:02] [PASSED] 0x5691 (DG2)
[18:34:02] [PASSED] 0x5692 (DG2)
[18:34:02] [PASSED] 0x56A5 (DG2)
[18:34:02] [PASSED] 0x56A6 (DG2)
[18:34:02] [PASSED] 0x56B0 (DG2)
[18:34:02] [PASSED] 0x56B1 (DG2)
[18:34:02] [PASSED] 0x56BA (DG2)
[18:34:02] [PASSED] 0x56BB (DG2)
[18:34:02] [PASSED] 0x56BC (DG2)
[18:34:02] [PASSED] 0x56BD (DG2)
[18:34:02] [PASSED] 0x5693 (DG2)
[18:34:02] [PASSED] 0x5694 (DG2)
[18:34:02] [PASSED] 0x5695 (DG2)
[18:34:02] [PASSED] 0x56A3 (DG2)
[18:34:02] [PASSED] 0x56A4 (DG2)
[18:34:02] [PASSED] 0x56B2 (DG2)
[18:34:02] [PASSED] 0x56B3 (DG2)
[18:34:02] [PASSED] 0x5696 (DG2)
[18:34:02] [PASSED] 0x5697 (DG2)
[18:34:02] [PASSED] 0xB69 (PVC)
[18:34:02] [PASSED] 0xB6E (PVC)
[18:34:02] [PASSED] 0xBD4 (PVC)
[18:34:02] [PASSED] 0xBD5 (PVC)
[18:34:02] [PASSED] 0xBD6 (PVC)
[18:34:02] [PASSED] 0xBD7 (PVC)
[18:34:02] [PASSED] 0xBD8 (PVC)
[18:34:02] [PASSED] 0xBD9 (PVC)
[18:34:02] [PASSED] 0xBDA (PVC)
[18:34:02] [PASSED] 0xBDB (PVC)
[18:34:02] [PASSED] 0xBE0 (PVC)
[18:34:02] [PASSED] 0xBE1 (PVC)
[18:34:02] [PASSED] 0xBE5 (PVC)
[18:34:02] [PASSED] 0x7D40 (METEORLAKE)
[18:34:02] [PASSED] 0x7D45 (METEORLAKE)
[18:34:02] [PASSED] 0x7D55 (METEORLAKE)
[18:34:02] [PASSED] 0x7D60 (METEORLAKE)
[18:34:02] [PASSED] 0x7DD5 (METEORLAKE)
[18:34:02] [PASSED] 0x6420 (LUNARLAKE)
[18:34:02] [PASSED] 0x64A0 (LUNARLAKE)
[18:34:02] [PASSED] 0x64B0 (LUNARLAKE)
[18:34:02] [PASSED] 0xE202 (BATTLEMAGE)
[18:34:02] [PASSED] 0xE209 (BATTLEMAGE)
[18:34:02] [PASSED] 0xE20B (BATTLEMAGE)
[18:34:02] [PASSED] 0xE20C (BATTLEMAGE)
[18:34:02] [PASSED] 0xE20D (BATTLEMAGE)
[18:34:02] [PASSED] 0xE210 (BATTLEMAGE)
[18:34:02] [PASSED] 0xE211 (BATTLEMAGE)
[18:34:02] [PASSED] 0xE212 (BATTLEMAGE)
[18:34:02] [PASSED] 0xE216 (BATTLEMAGE)
[18:34:02] [PASSED] 0xE220 (BATTLEMAGE)
[18:34:02] [PASSED] 0xE221 (BATTLEMAGE)
[18:34:02] [PASSED] 0xE222 (BATTLEMAGE)
[18:34:02] [PASSED] 0xE223 (BATTLEMAGE)
[18:34:02] [PASSED] 0xB080 (PANTHERLAKE)
[18:34:02] [PASSED] 0xB081 (PANTHERLAKE)
[18:34:02] [PASSED] 0xB082 (PANTHERLAKE)
[18:34:02] [PASSED] 0xB083 (PANTHERLAKE)
[18:34:02] [PASSED] 0xB084 (PANTHERLAKE)
[18:34:02] [PASSED] 0xB085 (PANTHERLAKE)
[18:34:02] [PASSED] 0xB086 (PANTHERLAKE)
[18:34:02] [PASSED] 0xB087 (PANTHERLAKE)
[18:34:02] [PASSED] 0xB08F (PANTHERLAKE)
[18:34:02] [PASSED] 0xB090 (PANTHERLAKE)
[18:34:02] [PASSED] 0xB0A0 (PANTHERLAKE)
[18:34:02] [PASSED] 0xB0B0 (PANTHERLAKE)
[18:34:02] [PASSED] 0xFD80 (PANTHERLAKE)
[18:34:02] [PASSED] 0xFD81 (PANTHERLAKE)
[18:34:02] [PASSED] 0xD740 (NOVALAKE_S)
[18:34:02] [PASSED] 0xD741 (NOVALAKE_S)
[18:34:02] [PASSED] 0xD742 (NOVALAKE_S)
[18:34:02] [PASSED] 0xD743 (NOVALAKE_S)
[18:34:02] [PASSED] 0xD744 (NOVALAKE_S)
[18:34:02] [PASSED] 0xD745 (NOVALAKE_S)
[18:34:02] [PASSED] 0x674C (CRESCENTISLAND)
[18:34:02] [PASSED] 0xD750 (NOVALAKE_P)
[18:34:02] [PASSED] 0xD751 (NOVALAKE_P)
[18:34:02] [PASSED] 0xD752 (NOVALAKE_P)
[18:34:02] [PASSED] 0xD753 (NOVALAKE_P)
[18:34:02] [PASSED] 0xD754 (NOVALAKE_P)
[18:34:02] [PASSED] 0xD755 (NOVALAKE_P)
[18:34:02] [PASSED] 0xD756 (NOVALAKE_P)
[18:34:02] [PASSED] 0xD757 (NOVALAKE_P)
[18:34:02] [PASSED] 0xD75F (NOVALAKE_P)
[18:34:02] =============== [PASSED] check_platform_desc ===============
[18:34:02] ===================== [PASSED] xe_pci ======================
[18:34:02] =================== xe_rtp (2 subtests) ====================
[18:34:02] =============== xe_rtp_process_to_sr_tests ================
[18:34:02] [PASSED] coalesce-same-reg
[18:34:02] [PASSED] no-match-no-add
[18:34:02] [PASSED] match-or
[18:34:02] [PASSED] match-or-xfail
[18:34:02] [PASSED] no-match-no-add-multiple-rules
[18:34:02] [PASSED] two-regs-two-entries
[18:34:02] [PASSED] clr-one-set-other
[18:34:02] [PASSED] set-field
[18:34:02] [PASSED] conflict-duplicate
stty: 'standard input': Inappropriate ioctl for device
[18:34:02] [PASSED] conflict-not-disjoint
[18:34:02] [PASSED] conflict-reg-type
[18:34:02] =========== [PASSED] xe_rtp_process_to_sr_tests ============
[18:34:02] ================== xe_rtp_process_tests ===================
[18:34:02] [PASSED] active1
[18:34:02] [PASSED] active2
[18:34:02] [PASSED] active-inactive
[18:34:02] [PASSED] inactive-active
[18:34:02] [PASSED] inactive-1st_or_active-inactive
[18:34:02] [PASSED] inactive-2nd_or_active-inactive
[18:34:02] [PASSED] inactive-last_or_active-inactive
[18:34:02] [PASSED] inactive-no_or_active-inactive
[18:34:02] ============== [PASSED] xe_rtp_process_tests ===============
[18:34:02] ===================== [PASSED] xe_rtp ======================
[18:34:02] ==================== xe_wa (1 subtest) =====================
[18:34:02] ======================== xe_wa_gt =========================
[18:34:02] [PASSED] TIGERLAKE B0
[18:34:02] [PASSED] DG1 A0
[18:34:02] [PASSED] DG1 B0
[18:34:02] [PASSED] ALDERLAKE_S A0
[18:34:02] [PASSED] ALDERLAKE_S B0
[18:34:02] [PASSED] ALDERLAKE_S C0
[18:34:02] [PASSED] ALDERLAKE_S D0
[18:34:02] [PASSED] ALDERLAKE_P A0
[18:34:02] [PASSED] ALDERLAKE_P B0
[18:34:02] [PASSED] ALDERLAKE_P C0
[18:34:02] [PASSED] ALDERLAKE_S RPLS D0
[18:34:02] [PASSED] ALDERLAKE_P RPLU E0
[18:34:02] [PASSED] DG2 G10 C0
[18:34:02] [PASSED] DG2 G11 B1
[18:34:02] [PASSED] DG2 G12 A1
[18:34:02] [PASSED] METEORLAKE 12.70(Xe_LPG) A0 13.00(Xe_LPM+) A0
[18:34:02] [PASSED] METEORLAKE 12.71(Xe_LPG) A0 13.00(Xe_LPM+) A0
[18:34:02] [PASSED] METEORLAKE 12.74(Xe_LPG+) A0 13.00(Xe_LPM+) A0
[18:34:02] [PASSED] LUNARLAKE 20.04(Xe2_LPG) A0 20.00(Xe2_LPM) A0
[18:34:02] [PASSED] LUNARLAKE 20.04(Xe2_LPG) B0 20.00(Xe2_LPM) A0
[18:34:02] [PASSED] BATTLEMAGE 20.01(Xe2_HPG) A0 13.01(Xe2_HPM) A1
[18:34:02] [PASSED] PANTHERLAKE 30.00(Xe3_LPG) A0 30.00(Xe3_LPM) A0
[18:34:02] ==================== [PASSED] xe_wa_gt =====================
[18:34:02] ====================== [PASSED] xe_wa ======================
[18:34:02] ============================================================
[18:34:02] Testing complete. Ran 597 tests: passed: 579, skipped: 18
[18:34:02] Elapsed time: 35.249s total, 4.312s configuring, 30.319s building, 0.609s running
+ /kernel/tools/testing/kunit/kunit.py run --kunitconfig /kernel/drivers/gpu/drm/tests/.kunitconfig
[18:34:02] Configuring KUnit Kernel ...
Regenerating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[18:34:04] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=48
[18:34:28] Starting KUnit Kernel (1/1)...
[18:34:28] ============================================================
Running tests with:
$ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[18:34:28] ============ drm_test_pick_cmdline (2 subtests) ============
[18:34:28] [PASSED] drm_test_pick_cmdline_res_1920_1080_60
[18:34:28] =============== drm_test_pick_cmdline_named ===============
[18:34:28] [PASSED] NTSC
[18:34:28] [PASSED] NTSC-J
[18:34:28] [PASSED] PAL
[18:34:28] [PASSED] PAL-M
[18:34:28] =========== [PASSED] drm_test_pick_cmdline_named ===========
[18:34:28] ============== [PASSED] drm_test_pick_cmdline ==============
[18:34:28] == drm_test_atomic_get_connector_for_encoder (1 subtest) ===
[18:34:28] [PASSED] drm_test_drm_atomic_get_connector_for_encoder
[18:34:28] ==== [PASSED] drm_test_atomic_get_connector_for_encoder ====
[18:34:28] =========== drm_validate_clone_mode (2 subtests) ===========
[18:34:28] ============== drm_test_check_in_clone_mode ===============
[18:34:28] [PASSED] in_clone_mode
[18:34:28] [PASSED] not_in_clone_mode
[18:34:28] ========== [PASSED] drm_test_check_in_clone_mode ===========
[18:34:28] =============== drm_test_check_valid_clones ===============
[18:34:28] [PASSED] not_in_clone_mode
[18:34:28] [PASSED] valid_clone
[18:34:28] [PASSED] invalid_clone
[18:34:28] =========== [PASSED] drm_test_check_valid_clones ===========
[18:34:28] ============= [PASSED] drm_validate_clone_mode =============
[18:34:28] ============= drm_validate_modeset (1 subtest) =============
[18:34:28] [PASSED] drm_test_check_connector_changed_modeset
[18:34:28] ============== [PASSED] drm_validate_modeset ===============
[18:34:28] ====== drm_test_bridge_get_current_state (2 subtests) ======
[18:34:28] [PASSED] drm_test_drm_bridge_get_current_state_atomic
[18:34:28] [PASSED] drm_test_drm_bridge_get_current_state_legacy
[18:34:28] ======== [PASSED] drm_test_bridge_get_current_state ========
[18:34:28] ====== drm_test_bridge_helper_reset_crtc (3 subtests) ======
[18:34:28] [PASSED] drm_test_drm_bridge_helper_reset_crtc_atomic
[18:34:28] [PASSED] drm_test_drm_bridge_helper_reset_crtc_atomic_disabled
[18:34:28] [PASSED] drm_test_drm_bridge_helper_reset_crtc_legacy
[18:34:28] ======== [PASSED] drm_test_bridge_helper_reset_crtc ========
[18:34:28] ============== drm_bridge_alloc (2 subtests) ===============
[18:34:28] [PASSED] drm_test_drm_bridge_alloc_basic
[18:34:28] [PASSED] drm_test_drm_bridge_alloc_get_put
[18:34:28] ================ [PASSED] drm_bridge_alloc =================
[18:34:28] ============= drm_cmdline_parser (40 subtests) =============
[18:34:28] [PASSED] drm_test_cmdline_force_d_only
[18:34:28] [PASSED] drm_test_cmdline_force_D_only_dvi
[18:34:28] [PASSED] drm_test_cmdline_force_D_only_hdmi
[18:34:28] [PASSED] drm_test_cmdline_force_D_only_not_digital
[18:34:28] [PASSED] drm_test_cmdline_force_e_only
[18:34:28] [PASSED] drm_test_cmdline_res
[18:34:28] [PASSED] drm_test_cmdline_res_vesa
[18:34:28] [PASSED] drm_test_cmdline_res_vesa_rblank
[18:34:28] [PASSED] drm_test_cmdline_res_rblank
[18:34:28] [PASSED] drm_test_cmdline_res_bpp
[18:34:28] [PASSED] drm_test_cmdline_res_refresh
[18:34:28] [PASSED] drm_test_cmdline_res_bpp_refresh
[18:34:28] [PASSED] drm_test_cmdline_res_bpp_refresh_interlaced
[18:34:28] [PASSED] drm_test_cmdline_res_bpp_refresh_margins
[18:34:28] [PASSED] drm_test_cmdline_res_bpp_refresh_force_off
[18:34:28] [PASSED] drm_test_cmdline_res_bpp_refresh_force_on
[18:34:28] [PASSED] drm_test_cmdline_res_bpp_refresh_force_on_analog
[18:34:28] [PASSED] drm_test_cmdline_res_bpp_refresh_force_on_digital
[18:34:28] [PASSED] drm_test_cmdline_res_bpp_refresh_interlaced_margins_force_on
[18:34:28] [PASSED] drm_test_cmdline_res_margins_force_on
[18:34:28] [PASSED] drm_test_cmdline_res_vesa_margins
[18:34:28] [PASSED] drm_test_cmdline_name
[18:34:28] [PASSED] drm_test_cmdline_name_bpp
[18:34:28] [PASSED] drm_test_cmdline_name_option
[18:34:28] [PASSED] drm_test_cmdline_name_bpp_option
[18:34:28] [PASSED] drm_test_cmdline_rotate_0
[18:34:28] [PASSED] drm_test_cmdline_rotate_90
[18:34:28] [PASSED] drm_test_cmdline_rotate_180
[18:34:28] [PASSED] drm_test_cmdline_rotate_270
[18:34:28] [PASSED] drm_test_cmdline_hmirror
[18:34:28] [PASSED] drm_test_cmdline_vmirror
[18:34:28] [PASSED] drm_test_cmdline_margin_options
[18:34:28] [PASSED] drm_test_cmdline_multiple_options
[18:34:28] [PASSED] drm_test_cmdline_bpp_extra_and_option
[18:34:28] [PASSED] drm_test_cmdline_extra_and_option
[18:34:28] [PASSED] drm_test_cmdline_freestanding_options
[18:34:28] [PASSED] drm_test_cmdline_freestanding_force_e_and_options
[18:34:28] [PASSED] drm_test_cmdline_panel_orientation
[18:34:28] ================ drm_test_cmdline_invalid =================
[18:34:28] [PASSED] margin_only
[18:34:28] [PASSED] interlace_only
[18:34:28] [PASSED] res_missing_x
[18:34:28] [PASSED] res_missing_y
[18:34:28] [PASSED] res_bad_y
[18:34:28] [PASSED] res_missing_y_bpp
[18:34:28] [PASSED] res_bad_bpp
[18:34:28] [PASSED] res_bad_refresh
[18:34:28] [PASSED] res_bpp_refresh_force_on_off
[18:34:28] [PASSED] res_invalid_mode
[18:34:28] [PASSED] res_bpp_wrong_place_mode
[18:34:28] [PASSED] name_bpp_refresh
[18:34:28] [PASSED] name_refresh
[18:34:28] [PASSED] name_refresh_wrong_mode
[18:34:28] [PASSED] name_refresh_invalid_mode
[18:34:28] [PASSED] rotate_multiple
[18:34:28] [PASSED] rotate_invalid_val
[18:34:28] [PASSED] rotate_truncated
[18:34:28] [PASSED] invalid_option
[18:34:28] [PASSED] invalid_tv_option
[18:34:28] [PASSED] truncated_tv_option
[18:34:28] ============ [PASSED] drm_test_cmdline_invalid =============
[18:34:28] =============== drm_test_cmdline_tv_options ===============
[18:34:28] [PASSED] NTSC
[18:34:28] [PASSED] NTSC_443
[18:34:28] [PASSED] NTSC_J
[18:34:28] [PASSED] PAL
[18:34:28] [PASSED] PAL_M
[18:34:28] [PASSED] PAL_N
[18:34:28] [PASSED] SECAM
[18:34:28] [PASSED] MONO_525
[18:34:28] [PASSED] MONO_625
[18:34:28] =========== [PASSED] drm_test_cmdline_tv_options ===========
[18:34:28] =============== [PASSED] drm_cmdline_parser ================
[18:34:28] ========== drmm_connector_hdmi_init (20 subtests) ==========
[18:34:28] [PASSED] drm_test_connector_hdmi_init_valid
[18:34:28] [PASSED] drm_test_connector_hdmi_init_bpc_8
[18:34:28] [PASSED] drm_test_connector_hdmi_init_bpc_10
[18:34:28] [PASSED] drm_test_connector_hdmi_init_bpc_12
[18:34:28] [PASSED] drm_test_connector_hdmi_init_bpc_invalid
[18:34:28] [PASSED] drm_test_connector_hdmi_init_bpc_null
[18:34:28] [PASSED] drm_test_connector_hdmi_init_formats_empty
[18:34:28] [PASSED] drm_test_connector_hdmi_init_formats_no_rgb
[18:34:28] === drm_test_connector_hdmi_init_formats_yuv420_allowed ===
[18:34:28] [PASSED] supported_formats=0x9 yuv420_allowed=1
[18:34:28] [PASSED] supported_formats=0x9 yuv420_allowed=0
[18:34:28] [PASSED] supported_formats=0x5 yuv420_allowed=1
[18:34:28] [PASSED] supported_formats=0x5 yuv420_allowed=0
[18:34:28] === [PASSED] drm_test_connector_hdmi_init_formats_yuv420_allowed ===
[18:34:28] [PASSED] drm_test_connector_hdmi_init_null_ddc
[18:34:28] [PASSED] drm_test_connector_hdmi_init_null_product
[18:34:28] [PASSED] drm_test_connector_hdmi_init_null_vendor
[18:34:28] [PASSED] drm_test_connector_hdmi_init_product_length_exact
[18:34:28] [PASSED] drm_test_connector_hdmi_init_product_length_too_long
[18:34:28] [PASSED] drm_test_connector_hdmi_init_product_valid
[18:34:28] [PASSED] drm_test_connector_hdmi_init_vendor_length_exact
[18:34:28] [PASSED] drm_test_connector_hdmi_init_vendor_length_too_long
[18:34:28] [PASSED] drm_test_connector_hdmi_init_vendor_valid
[18:34:28] ========= drm_test_connector_hdmi_init_type_valid =========
[18:34:28] [PASSED] HDMI-A
[18:34:28] [PASSED] HDMI-B
[18:34:28] ===== [PASSED] drm_test_connector_hdmi_init_type_valid =====
[18:34:28] ======== drm_test_connector_hdmi_init_type_invalid ========
[18:34:28] [PASSED] Unknown
[18:34:28] [PASSED] VGA
[18:34:28] [PASSED] DVI-I
[18:34:28] [PASSED] DVI-D
[18:34:28] [PASSED] DVI-A
[18:34:28] [PASSED] Composite
[18:34:28] [PASSED] SVIDEO
[18:34:28] [PASSED] LVDS
[18:34:28] [PASSED] Component
[18:34:28] [PASSED] DIN
[18:34:28] [PASSED] DP
[18:34:28] [PASSED] TV
[18:34:28] [PASSED] eDP
[18:34:28] [PASSED] Virtual
[18:34:28] [PASSED] DSI
[18:34:28] [PASSED] DPI
[18:34:28] [PASSED] Writeback
[18:34:28] [PASSED] SPI
[18:34:28] [PASSED] USB
[18:34:28] ==== [PASSED] drm_test_connector_hdmi_init_type_invalid ====
[18:34:28] ============ [PASSED] drmm_connector_hdmi_init =============
[18:34:28] ============= drmm_connector_init (3 subtests) =============
[18:34:28] [PASSED] drm_test_drmm_connector_init
[18:34:28] [PASSED] drm_test_drmm_connector_init_null_ddc
[18:34:28] ========= drm_test_drmm_connector_init_type_valid =========
[18:34:28] [PASSED] Unknown
[18:34:28] [PASSED] VGA
[18:34:28] [PASSED] DVI-I
[18:34:28] [PASSED] DVI-D
[18:34:28] [PASSED] DVI-A
[18:34:28] [PASSED] Composite
[18:34:28] [PASSED] SVIDEO
[18:34:28] [PASSED] LVDS
[18:34:28] [PASSED] Component
[18:34:28] [PASSED] DIN
[18:34:28] [PASSED] DP
[18:34:28] [PASSED] HDMI-A
[18:34:28] [PASSED] HDMI-B
[18:34:28] [PASSED] TV
[18:34:28] [PASSED] eDP
[18:34:28] [PASSED] Virtual
[18:34:28] [PASSED] DSI
[18:34:28] [PASSED] DPI
[18:34:28] [PASSED] Writeback
[18:34:28] [PASSED] SPI
[18:34:28] [PASSED] USB
[18:34:28] ===== [PASSED] drm_test_drmm_connector_init_type_valid =====
[18:34:28] =============== [PASSED] drmm_connector_init ===============
[18:34:28] ========= drm_connector_dynamic_init (6 subtests) ==========
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_init
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_init_null_ddc
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_init_not_added
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_init_properties
[18:34:28] ===== drm_test_drm_connector_dynamic_init_type_valid ======
[18:34:28] [PASSED] Unknown
[18:34:28] [PASSED] VGA
[18:34:28] [PASSED] DVI-I
[18:34:28] [PASSED] DVI-D
[18:34:28] [PASSED] DVI-A
[18:34:28] [PASSED] Composite
[18:34:28] [PASSED] SVIDEO
[18:34:28] [PASSED] LVDS
[18:34:28] [PASSED] Component
[18:34:28] [PASSED] DIN
[18:34:28] [PASSED] DP
[18:34:28] [PASSED] HDMI-A
[18:34:28] [PASSED] HDMI-B
[18:34:28] [PASSED] TV
[18:34:28] [PASSED] eDP
[18:34:28] [PASSED] Virtual
[18:34:28] [PASSED] DSI
[18:34:28] [PASSED] DPI
[18:34:28] [PASSED] Writeback
[18:34:28] [PASSED] SPI
[18:34:28] [PASSED] USB
[18:34:28] = [PASSED] drm_test_drm_connector_dynamic_init_type_valid ==
[18:34:28] ======== drm_test_drm_connector_dynamic_init_name =========
[18:34:28] [PASSED] Unknown
[18:34:28] [PASSED] VGA
[18:34:28] [PASSED] DVI-I
[18:34:28] [PASSED] DVI-D
[18:34:28] [PASSED] DVI-A
[18:34:28] [PASSED] Composite
[18:34:28] [PASSED] SVIDEO
[18:34:28] [PASSED] LVDS
[18:34:28] [PASSED] Component
[18:34:28] [PASSED] DIN
[18:34:28] [PASSED] DP
[18:34:28] [PASSED] HDMI-A
[18:34:28] [PASSED] HDMI-B
[18:34:28] [PASSED] TV
[18:34:28] [PASSED] eDP
[18:34:28] [PASSED] Virtual
[18:34:28] [PASSED] DSI
[18:34:28] [PASSED] DPI
[18:34:28] [PASSED] Writeback
[18:34:28] [PASSED] SPI
[18:34:28] [PASSED] USB
[18:34:28] ==== [PASSED] drm_test_drm_connector_dynamic_init_name =====
[18:34:28] =========== [PASSED] drm_connector_dynamic_init ============
[18:34:28] ==== drm_connector_dynamic_register_early (4 subtests) =====
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_register_early_on_list
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_register_early_defer
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_register_early_no_init
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_register_early_no_mode_object
[18:34:28] ====== [PASSED] drm_connector_dynamic_register_early =======
[18:34:28] ======= drm_connector_dynamic_register (7 subtests) ========
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_register_on_list
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_register_no_defer
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_register_no_init
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_register_mode_object
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_register_sysfs
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_register_sysfs_name
[18:34:28] [PASSED] drm_test_drm_connector_dynamic_register_debugfs
[18:34:28] ========= [PASSED] drm_connector_dynamic_register ==========
[18:34:28] = drm_connector_attach_broadcast_rgb_property (2 subtests) =
[18:34:28] [PASSED] drm_test_drm_connector_attach_broadcast_rgb_property
[18:34:28] [PASSED] drm_test_drm_connector_attach_broadcast_rgb_property_hdmi_connector
[18:34:28] === [PASSED] drm_connector_attach_broadcast_rgb_property ===
[18:34:28] ========== drm_get_tv_mode_from_name (2 subtests) ==========
[18:34:28] ========== drm_test_get_tv_mode_from_name_valid ===========
[18:34:28] [PASSED] NTSC
[18:34:28] [PASSED] NTSC-443
[18:34:28] [PASSED] NTSC-J
[18:34:28] [PASSED] PAL
[18:34:28] [PASSED] PAL-M
[18:34:28] [PASSED] PAL-N
[18:34:28] [PASSED] SECAM
[18:34:28] [PASSED] Mono
[18:34:28] ====== [PASSED] drm_test_get_tv_mode_from_name_valid =======
[18:34:28] [PASSED] drm_test_get_tv_mode_from_name_truncated
[18:34:28] ============ [PASSED] drm_get_tv_mode_from_name ============
[18:34:28] = drm_test_connector_hdmi_compute_mode_clock (12 subtests) =
[18:34:28] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb
[18:34:28] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_10bpc
[18:34:28] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_10bpc_vic_1
[18:34:28] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_12bpc
[18:34:28] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_12bpc_vic_1
[18:34:28] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_double
[18:34:28] = drm_test_connector_hdmi_compute_mode_clock_yuv420_valid =
[18:34:28] [PASSED] VIC 96
[18:34:28] [PASSED] VIC 97
[18:34:28] [PASSED] VIC 101
[18:34:28] [PASSED] VIC 102
[18:34:28] [PASSED] VIC 106
[18:34:28] [PASSED] VIC 107
[18:34:28] === [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv420_valid ===
[18:34:28] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv420_10_bpc
[18:34:28] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv420_12_bpc
[18:34:28] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv422_8_bpc
[18:34:28] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv422_10_bpc
[18:34:28] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv422_12_bpc
[18:34:28] === [PASSED] drm_test_connector_hdmi_compute_mode_clock ====
[18:34:28] == drm_hdmi_connector_get_broadcast_rgb_name (2 subtests) ==
[18:34:28] === drm_test_drm_hdmi_connector_get_broadcast_rgb_name ====
[18:34:28] [PASSED] Automatic
[18:34:28] [PASSED] Full
[18:34:28] [PASSED] Limited 16:235
[18:34:28] === [PASSED] drm_test_drm_hdmi_connector_get_broadcast_rgb_name ===
[18:34:28] [PASSED] drm_test_drm_hdmi_connector_get_broadcast_rgb_name_invalid
[18:34:28] ==== [PASSED] drm_hdmi_connector_get_broadcast_rgb_name ====
[18:34:28] == drm_hdmi_connector_get_output_format_name (2 subtests) ==
[18:34:28] === drm_test_drm_hdmi_connector_get_output_format_name ====
[18:34:28] [PASSED] RGB
[18:34:28] [PASSED] YUV 4:2:0
[18:34:28] [PASSED] YUV 4:2:2
[18:34:28] [PASSED] YUV 4:4:4
[18:34:28] === [PASSED] drm_test_drm_hdmi_connector_get_output_format_name ===
[18:34:28] [PASSED] drm_test_drm_hdmi_connector_get_output_format_name_invalid
[18:34:28] ==== [PASSED] drm_hdmi_connector_get_output_format_name ====
[18:34:28] ============= drm_damage_helper (21 subtests) ==============
[18:34:28] [PASSED] drm_test_damage_iter_no_damage
[18:34:28] [PASSED] drm_test_damage_iter_no_damage_fractional_src
[18:34:28] [PASSED] drm_test_damage_iter_no_damage_src_moved
[18:34:28] [PASSED] drm_test_damage_iter_no_damage_fractional_src_moved
[18:34:28] [PASSED] drm_test_damage_iter_no_damage_not_visible
[18:34:28] [PASSED] drm_test_damage_iter_no_damage_no_crtc
[18:34:28] [PASSED] drm_test_damage_iter_no_damage_no_fb
[18:34:28] [PASSED] drm_test_damage_iter_simple_damage
[18:34:28] [PASSED] drm_test_damage_iter_single_damage
[18:34:28] [PASSED] drm_test_damage_iter_single_damage_intersect_src
[18:34:28] [PASSED] drm_test_damage_iter_single_damage_outside_src
[18:34:28] [PASSED] drm_test_damage_iter_single_damage_fractional_src
[18:34:28] [PASSED] drm_test_damage_iter_single_damage_intersect_fractional_src
[18:34:28] [PASSED] drm_test_damage_iter_single_damage_outside_fractional_src
[18:34:28] [PASSED] drm_test_damage_iter_single_damage_src_moved
[18:34:28] [PASSED] drm_test_damage_iter_single_damage_fractional_src_moved
[18:34:28] [PASSED] drm_test_damage_iter_damage
[18:34:28] [PASSED] drm_test_damage_iter_damage_one_intersect
[18:34:28] [PASSED] drm_test_damage_iter_damage_one_outside
[18:34:28] [PASSED] drm_test_damage_iter_damage_src_moved
[18:34:28] [PASSED] drm_test_damage_iter_damage_not_visible
[18:34:28] ================ [PASSED] drm_damage_helper ================
[18:34:28] ============== drm_dp_mst_helper (3 subtests) ==============
[18:34:28] ============== drm_test_dp_mst_calc_pbn_mode ==============
[18:34:28] [PASSED] Clock 154000 BPP 30 DSC disabled
[18:34:28] [PASSED] Clock 234000 BPP 30 DSC disabled
[18:34:28] [PASSED] Clock 297000 BPP 24 DSC disabled
[18:34:28] [PASSED] Clock 332880 BPP 24 DSC enabled
[18:34:28] [PASSED] Clock 324540 BPP 24 DSC enabled
[18:34:28] ========== [PASSED] drm_test_dp_mst_calc_pbn_mode ==========
[18:34:28] ============== drm_test_dp_mst_calc_pbn_div ===============
[18:34:28] [PASSED] Link rate 2000000 lane count 4
[18:34:28] [PASSED] Link rate 2000000 lane count 2
[18:34:28] [PASSED] Link rate 2000000 lane count 1
[18:34:28] [PASSED] Link rate 1350000 lane count 4
[18:34:28] [PASSED] Link rate 1350000 lane count 2
[18:34:28] [PASSED] Link rate 1350000 lane count 1
[18:34:28] [PASSED] Link rate 1000000 lane count 4
[18:34:28] [PASSED] Link rate 1000000 lane count 2
[18:34:28] [PASSED] Link rate 1000000 lane count 1
[18:34:28] [PASSED] Link rate 810000 lane count 4
[18:34:28] [PASSED] Link rate 810000 lane count 2
[18:34:28] [PASSED] Link rate 810000 lane count 1
[18:34:28] [PASSED] Link rate 540000 lane count 4
[18:34:28] [PASSED] Link rate 540000 lane count 2
[18:34:28] [PASSED] Link rate 540000 lane count 1
[18:34:28] [PASSED] Link rate 270000 lane count 4
[18:34:28] [PASSED] Link rate 270000 lane count 2
[18:34:28] [PASSED] Link rate 270000 lane count 1
[18:34:28] [PASSED] Link rate 162000 lane count 4
[18:34:28] [PASSED] Link rate 162000 lane count 2
[18:34:28] [PASSED] Link rate 162000 lane count 1
[18:34:28] ========== [PASSED] drm_test_dp_mst_calc_pbn_div ===========
[18:34:28] ========= drm_test_dp_mst_sideband_msg_req_decode =========
[18:34:28] [PASSED] DP_ENUM_PATH_RESOURCES with port number
[18:34:28] [PASSED] DP_POWER_UP_PHY with port number
[18:34:28] [PASSED] DP_POWER_DOWN_PHY with port number
[18:34:28] [PASSED] DP_ALLOCATE_PAYLOAD with SDP stream sinks
[18:34:28] [PASSED] DP_ALLOCATE_PAYLOAD with port number
[18:34:28] [PASSED] DP_ALLOCATE_PAYLOAD with VCPI
[18:34:28] [PASSED] DP_ALLOCATE_PAYLOAD with PBN
[18:34:28] [PASSED] DP_QUERY_PAYLOAD with port number
[18:34:28] [PASSED] DP_QUERY_PAYLOAD with VCPI
[18:34:28] [PASSED] DP_REMOTE_DPCD_READ with port number
[18:34:28] [PASSED] DP_REMOTE_DPCD_READ with DPCD address
[18:34:28] [PASSED] DP_REMOTE_DPCD_READ with max number of bytes
[18:34:28] [PASSED] DP_REMOTE_DPCD_WRITE with port number
[18:34:28] [PASSED] DP_REMOTE_DPCD_WRITE with DPCD address
[18:34:28] [PASSED] DP_REMOTE_DPCD_WRITE with data array
[18:34:28] [PASSED] DP_REMOTE_I2C_READ with port number
[18:34:28] [PASSED] DP_REMOTE_I2C_READ with I2C device ID
[18:34:28] [PASSED] DP_REMOTE_I2C_READ with transactions array
[18:34:28] [PASSED] DP_REMOTE_I2C_WRITE with port number
[18:34:28] [PASSED] DP_REMOTE_I2C_WRITE with I2C device ID
[18:34:28] [PASSED] DP_REMOTE_I2C_WRITE with data array
[18:34:28] [PASSED] DP_QUERY_STREAM_ENC_STATUS with stream ID
[18:34:28] [PASSED] DP_QUERY_STREAM_ENC_STATUS with client ID
[18:34:28] [PASSED] DP_QUERY_STREAM_ENC_STATUS with stream event
[18:34:28] [PASSED] DP_QUERY_STREAM_ENC_STATUS with valid stream event
[18:34:28] [PASSED] DP_QUERY_STREAM_ENC_STATUS with stream behavior
[18:34:28] [PASSED] DP_QUERY_STREAM_ENC_STATUS with a valid stream behavior
[18:34:28] ===== [PASSED] drm_test_dp_mst_sideband_msg_req_decode =====
[18:34:28] ================ [PASSED] drm_dp_mst_helper ================
[18:34:28] ================== drm_exec (7 subtests) ===================
[18:34:28] [PASSED] sanitycheck
[18:34:28] [PASSED] test_lock
[18:34:28] [PASSED] test_lock_unlock
[18:34:28] [PASSED] test_duplicates
[18:34:28] [PASSED] test_prepare
[18:34:28] [PASSED] test_prepare_array
[18:34:28] [PASSED] test_multiple_loops
[18:34:28] ==================== [PASSED] drm_exec =====================
[18:34:28] =========== drm_format_helper_test (17 subtests) ===========
[18:34:28] ============== drm_test_fb_xrgb8888_to_gray8 ==============
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ========== [PASSED] drm_test_fb_xrgb8888_to_gray8 ==========
[18:34:28] ============= drm_test_fb_xrgb8888_to_rgb332 ==============
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ========= [PASSED] drm_test_fb_xrgb8888_to_rgb332 ==========
[18:34:28] ============= drm_test_fb_xrgb8888_to_rgb565 ==============
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ========= [PASSED] drm_test_fb_xrgb8888_to_rgb565 ==========
[18:34:28] ============ drm_test_fb_xrgb8888_to_xrgb1555 =============
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ======== [PASSED] drm_test_fb_xrgb8888_to_xrgb1555 =========
[18:34:28] ============ drm_test_fb_xrgb8888_to_argb1555 =============
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ======== [PASSED] drm_test_fb_xrgb8888_to_argb1555 =========
[18:34:28] ============ drm_test_fb_xrgb8888_to_rgba5551 =============
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ======== [PASSED] drm_test_fb_xrgb8888_to_rgba5551 =========
[18:34:28] ============= drm_test_fb_xrgb8888_to_rgb888 ==============
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ========= [PASSED] drm_test_fb_xrgb8888_to_rgb888 ==========
[18:34:28] ============= drm_test_fb_xrgb8888_to_bgr888 ==============
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ========= [PASSED] drm_test_fb_xrgb8888_to_bgr888 ==========
[18:34:28] ============ drm_test_fb_xrgb8888_to_argb8888 =============
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ======== [PASSED] drm_test_fb_xrgb8888_to_argb8888 =========
[18:34:28] =========== drm_test_fb_xrgb8888_to_xrgb2101010 ===========
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ======= [PASSED] drm_test_fb_xrgb8888_to_xrgb2101010 =======
[18:34:28] =========== drm_test_fb_xrgb8888_to_argb2101010 ===========
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ======= [PASSED] drm_test_fb_xrgb8888_to_argb2101010 =======
[18:34:28] ============== drm_test_fb_xrgb8888_to_mono ===============
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ========== [PASSED] drm_test_fb_xrgb8888_to_mono ===========
[18:34:28] ==================== drm_test_fb_swab =====================
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ================ [PASSED] drm_test_fb_swab =================
[18:34:28] ============ drm_test_fb_xrgb8888_to_xbgr8888 =============
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ======== [PASSED] drm_test_fb_xrgb8888_to_xbgr8888 =========
[18:34:28] ============ drm_test_fb_xrgb8888_to_abgr8888 =============
[18:34:28] [PASSED] single_pixel_source_buffer
[18:34:28] [PASSED] single_pixel_clip_rectangle
[18:34:28] [PASSED] well_known_colors
[18:34:28] [PASSED] destination_pitch
[18:34:28] ======== [PASSED] drm_test_fb_xrgb8888_to_abgr8888 =========
[18:34:28] ================= drm_test_fb_clip_offset =================
[18:34:28] [PASSED] pass through
[18:34:28] [PASSED] horizontal offset
[18:34:28] [PASSED] vertical offset
[18:34:28] [PASSED] horizontal and vertical offset
[18:34:28] [PASSED] horizontal offset (custom pitch)
[18:34:28] [PASSED] vertical offset (custom pitch)
[18:34:28] [PASSED] horizontal and vertical offset (custom pitch)
[18:34:28] ============= [PASSED] drm_test_fb_clip_offset =============
[18:34:28] =================== drm_test_fb_memcpy ====================
[18:34:28] [PASSED] single_pixel_source_buffer: XR24 little-endian (0x34325258)
[18:34:28] [PASSED] single_pixel_source_buffer: XRA8 little-endian (0x38415258)
[18:34:28] [PASSED] single_pixel_source_buffer: YU24 little-endian (0x34325559)
[18:34:28] [PASSED] single_pixel_clip_rectangle: XB24 little-endian (0x34324258)
[18:34:28] [PASSED] single_pixel_clip_rectangle: XRA8 little-endian (0x38415258)
[18:34:28] [PASSED] single_pixel_clip_rectangle: YU24 little-endian (0x34325559)
[18:34:28] [PASSED] well_known_colors: XB24 little-endian (0x34324258)
[18:34:28] [PASSED] well_known_colors: XRA8 little-endian (0x38415258)
[18:34:28] [PASSED] well_known_colors: YU24 little-endian (0x34325559)
[18:34:28] [PASSED] destination_pitch: XB24 little-endian (0x34324258)
[18:34:28] [PASSED] destination_pitch: XRA8 little-endian (0x38415258)
[18:34:28] [PASSED] destination_pitch: YU24 little-endian (0x34325559)
[18:34:28] =============== [PASSED] drm_test_fb_memcpy ================
[18:34:28] ============= [PASSED] drm_format_helper_test ==============
[18:34:28] ================= drm_format (18 subtests) =================
[18:34:28] [PASSED] drm_test_format_block_width_invalid
[18:34:28] [PASSED] drm_test_format_block_width_one_plane
[18:34:28] [PASSED] drm_test_format_block_width_two_plane
[18:34:28] [PASSED] drm_test_format_block_width_three_plane
[18:34:28] [PASSED] drm_test_format_block_width_tiled
[18:34:28] [PASSED] drm_test_format_block_height_invalid
[18:34:28] [PASSED] drm_test_format_block_height_one_plane
[18:34:28] [PASSED] drm_test_format_block_height_two_plane
[18:34:28] [PASSED] drm_test_format_block_height_three_plane
[18:34:28] [PASSED] drm_test_format_block_height_tiled
[18:34:28] [PASSED] drm_test_format_min_pitch_invalid
[18:34:28] [PASSED] drm_test_format_min_pitch_one_plane_8bpp
[18:34:28] [PASSED] drm_test_format_min_pitch_one_plane_16bpp
[18:34:28] [PASSED] drm_test_format_min_pitch_one_plane_24bpp
[18:34:28] [PASSED] drm_test_format_min_pitch_one_plane_32bpp
[18:34:28] [PASSED] drm_test_format_min_pitch_two_plane
[18:34:28] [PASSED] drm_test_format_min_pitch_three_plane_8bpp
[18:34:28] [PASSED] drm_test_format_min_pitch_tiled
[18:34:28] =================== [PASSED] drm_format ====================
[18:34:28] ============== drm_framebuffer (10 subtests) ===============
[18:34:28] ========== drm_test_framebuffer_check_src_coords ==========
[18:34:28] [PASSED] Success: source fits into fb
[18:34:28] [PASSED] Fail: overflowing fb with x-axis coordinate
[18:34:28] [PASSED] Fail: overflowing fb with y-axis coordinate
[18:34:28] [PASSED] Fail: overflowing fb with source width
[18:34:28] [PASSED] Fail: overflowing fb with source height
[18:34:28] ====== [PASSED] drm_test_framebuffer_check_src_coords ======
[18:34:28] [PASSED] drm_test_framebuffer_cleanup
[18:34:28] =============== drm_test_framebuffer_create ===============
[18:34:28] [PASSED] ABGR8888 normal sizes
[18:34:28] [PASSED] ABGR8888 max sizes
[18:34:28] [PASSED] ABGR8888 pitch greater than min required
[18:34:28] [PASSED] ABGR8888 pitch less than min required
[18:34:28] [PASSED] ABGR8888 Invalid width
[18:34:28] [PASSED] ABGR8888 Invalid buffer handle
[18:34:28] [PASSED] No pixel format
[18:34:28] [PASSED] ABGR8888 Width 0
[18:34:28] [PASSED] ABGR8888 Height 0
[18:34:28] [PASSED] ABGR8888 Out of bound height * pitch combination
[18:34:28] [PASSED] ABGR8888 Large buffer offset
[18:34:28] [PASSED] ABGR8888 Buffer offset for inexistent plane
[18:34:28] [PASSED] ABGR8888 Invalid flag
[18:34:28] [PASSED] ABGR8888 Set DRM_MODE_FB_MODIFIERS without modifiers
[18:34:28] [PASSED] ABGR8888 Valid buffer modifier
[18:34:28] [PASSED] ABGR8888 Invalid buffer modifier(DRM_FORMAT_MOD_SAMSUNG_64_32_TILE)
[18:34:28] [PASSED] ABGR8888 Extra pitches without DRM_MODE_FB_MODIFIERS
[18:34:28] [PASSED] ABGR8888 Extra pitches with DRM_MODE_FB_MODIFIERS
[18:34:28] [PASSED] NV12 Normal sizes
[18:34:28] [PASSED] NV12 Max sizes
[18:34:28] [PASSED] NV12 Invalid pitch
[18:34:28] [PASSED] NV12 Invalid modifier/missing DRM_MODE_FB_MODIFIERS flag
[18:34:28] [PASSED] NV12 different modifier per-plane
[18:34:28] [PASSED] NV12 with DRM_FORMAT_MOD_SAMSUNG_64_32_TILE
[18:34:28] [PASSED] NV12 Valid modifiers without DRM_MODE_FB_MODIFIERS
[18:34:28] [PASSED] NV12 Modifier for inexistent plane
[18:34:28] [PASSED] NV12 Handle for inexistent plane
[18:34:28] [PASSED] NV12 Handle for inexistent plane without DRM_MODE_FB_MODIFIERS
[18:34:28] [PASSED] YVU420 DRM_MODE_FB_MODIFIERS set without modifier
[18:34:28] [PASSED] YVU420 Normal sizes
[18:34:28] [PASSED] YVU420 Max sizes
[18:34:28] [PASSED] YVU420 Invalid pitch
[18:34:28] [PASSED] YVU420 Different pitches
[18:34:28] [PASSED] YVU420 Different buffer offsets/pitches
[18:34:28] [PASSED] YVU420 Modifier set just for plane 0, without DRM_MODE_FB_MODIFIERS
[18:34:28] [PASSED] YVU420 Modifier set just for planes 0, 1, without DRM_MODE_FB_MODIFIERS
[18:34:28] [PASSED] YVU420 Modifier set just for plane 0, 1, with DRM_MODE_FB_MODIFIERS
[18:34:28] [PASSED] YVU420 Valid modifier
[18:34:28] [PASSED] YVU420 Different modifiers per plane
[18:34:28] [PASSED] YVU420 Modifier for inexistent plane
[18:34:28] [PASSED] YUV420_10BIT Invalid modifier(DRM_FORMAT_MOD_LINEAR)
[18:34:28] [PASSED] X0L2 Normal sizes
[18:34:28] [PASSED] X0L2 Max sizes
[18:34:28] [PASSED] X0L2 Invalid pitch
[18:34:28] [PASSED] X0L2 Pitch greater than minimum required
[18:34:28] [PASSED] X0L2 Handle for inexistent plane
[18:34:28] [PASSED] X0L2 Offset for inexistent plane, without DRM_MODE_FB_MODIFIERS set
[18:34:28] [PASSED] X0L2 Modifier without DRM_MODE_FB_MODIFIERS set
[18:34:28] [PASSED] X0L2 Valid modifier
[18:34:28] [PASSED] X0L2 Modifier for inexistent plane
[18:34:28] =========== [PASSED] drm_test_framebuffer_create ===========
[18:34:28] [PASSED] drm_test_framebuffer_free
[18:34:28] [PASSED] drm_test_framebuffer_init
[18:34:28] [PASSED] drm_test_framebuffer_init_bad_format
[18:34:28] [PASSED] drm_test_framebuffer_init_dev_mismatch
[18:34:28] [PASSED] drm_test_framebuffer_lookup
[18:34:28] [PASSED] drm_test_framebuffer_lookup_inexistent
[18:34:28] [PASSED] drm_test_framebuffer_modifiers_not_supported
[18:34:28] ================= [PASSED] drm_framebuffer =================
[18:34:28] ================ drm_gem_shmem (8 subtests) ================
[18:34:28] [PASSED] drm_gem_shmem_test_obj_create
[18:34:28] [PASSED] drm_gem_shmem_test_obj_create_private
[18:34:28] [PASSED] drm_gem_shmem_test_pin_pages
[18:34:28] [PASSED] drm_gem_shmem_test_vmap
[18:34:28] [PASSED] drm_gem_shmem_test_get_sg_table
[18:34:28] [PASSED] drm_gem_shmem_test_get_pages_sgt
[18:34:28] [PASSED] drm_gem_shmem_test_madvise
[18:34:28] [PASSED] drm_gem_shmem_test_purge
[18:34:28] ================== [PASSED] drm_gem_shmem ==================
[18:34:28] === drm_atomic_helper_connector_hdmi_check (27 subtests) ===
[18:34:28] [PASSED] drm_test_check_broadcast_rgb_auto_cea_mode
[18:34:28] [PASSED] drm_test_check_broadcast_rgb_auto_cea_mode_vic_1
[18:34:28] [PASSED] drm_test_check_broadcast_rgb_full_cea_mode
[18:34:28] [PASSED] drm_test_check_broadcast_rgb_full_cea_mode_vic_1
[18:34:28] [PASSED] drm_test_check_broadcast_rgb_limited_cea_mode
[18:34:28] [PASSED] drm_test_check_broadcast_rgb_limited_cea_mode_vic_1
[18:34:28] ====== drm_test_check_broadcast_rgb_cea_mode_yuv420 =======
[18:34:28] [PASSED] Automatic
[18:34:28] [PASSED] Full
[18:34:28] [PASSED] Limited 16:235
[18:34:28] == [PASSED] drm_test_check_broadcast_rgb_cea_mode_yuv420 ===
[18:34:28] [PASSED] drm_test_check_broadcast_rgb_crtc_mode_changed
[18:34:28] [PASSED] drm_test_check_broadcast_rgb_crtc_mode_not_changed
[18:34:28] [PASSED] drm_test_check_disable_connector
[18:34:28] [PASSED] drm_test_check_hdmi_funcs_reject_rate
[18:34:28] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_rgb
[18:34:28] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_yuv420
[18:34:28] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_ignore_yuv422
[18:34:28] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_ignore_yuv420
[18:34:28] [PASSED] drm_test_check_driver_unsupported_fallback_yuv420
[18:34:28] [PASSED] drm_test_check_output_bpc_crtc_mode_changed
[18:34:28] [PASSED] drm_test_check_output_bpc_crtc_mode_not_changed
[18:34:28] [PASSED] drm_test_check_output_bpc_dvi
[18:34:28] [PASSED] drm_test_check_output_bpc_format_vic_1
[18:34:28] [PASSED] drm_test_check_output_bpc_format_display_8bpc_only
[18:34:28] [PASSED] drm_test_check_output_bpc_format_display_rgb_only
[18:34:28] [PASSED] drm_test_check_output_bpc_format_driver_8bpc_only
[18:34:28] [PASSED] drm_test_check_output_bpc_format_driver_rgb_only
[18:34:28] [PASSED] drm_test_check_tmds_char_rate_rgb_8bpc
[18:34:28] [PASSED] drm_test_check_tmds_char_rate_rgb_10bpc
[18:34:28] [PASSED] drm_test_check_tmds_char_rate_rgb_12bpc
[18:34:28] ===== [PASSED] drm_atomic_helper_connector_hdmi_check ======
[18:34:28] === drm_atomic_helper_connector_hdmi_reset (6 subtests) ====
[18:34:28] [PASSED] drm_test_check_broadcast_rgb_value
[18:34:28] [PASSED] drm_test_check_bpc_8_value
[18:34:28] [PASSED] drm_test_check_bpc_10_value
[18:34:28] [PASSED] drm_test_check_bpc_12_value
[18:34:28] [PASSED] drm_test_check_format_value
[18:34:28] [PASSED] drm_test_check_tmds_char_value
[18:34:28] ===== [PASSED] drm_atomic_helper_connector_hdmi_reset ======
[18:34:28] = drm_atomic_helper_connector_hdmi_mode_valid (4 subtests) =
[18:34:28] [PASSED] drm_test_check_mode_valid
[18:34:28] [PASSED] drm_test_check_mode_valid_reject
[18:34:28] [PASSED] drm_test_check_mode_valid_reject_rate
[18:34:28] [PASSED] drm_test_check_mode_valid_reject_max_clock
[18:34:28] === [PASSED] drm_atomic_helper_connector_hdmi_mode_valid ===
[18:34:28] = drm_atomic_helper_connector_hdmi_infoframes (5 subtests) =
[18:34:28] [PASSED] drm_test_check_infoframes
[18:34:28] [PASSED] drm_test_check_reject_avi_infoframe
[18:34:28] [PASSED] drm_test_check_reject_hdr_infoframe_bpc_8
[18:34:28] [PASSED] drm_test_check_reject_hdr_infoframe_bpc_10
[18:34:28] [PASSED] drm_test_check_reject_audio_infoframe
[18:34:28] === [PASSED] drm_atomic_helper_connector_hdmi_infoframes ===
[18:34:28] ================= drm_managed (2 subtests) =================
[18:34:28] [PASSED] drm_test_managed_release_action
[18:34:28] [PASSED] drm_test_managed_run_action
[18:34:28] =================== [PASSED] drm_managed ===================
[18:34:28] =================== drm_mm (6 subtests) ====================
[18:34:28] [PASSED] drm_test_mm_init
[18:34:28] [PASSED] drm_test_mm_debug
[18:34:28] [PASSED] drm_test_mm_align32
[18:34:28] [PASSED] drm_test_mm_align64
[18:34:28] [PASSED] drm_test_mm_lowest
[18:34:28] [PASSED] drm_test_mm_highest
[18:34:28] ===================== [PASSED] drm_mm ======================
[18:34:28] ============= drm_modes_analog_tv (5 subtests) =============
[18:34:28] [PASSED] drm_test_modes_analog_tv_mono_576i
[18:34:28] [PASSED] drm_test_modes_analog_tv_ntsc_480i
[18:34:28] [PASSED] drm_test_modes_analog_tv_ntsc_480i_inlined
[18:34:28] [PASSED] drm_test_modes_analog_tv_pal_576i
[18:34:28] [PASSED] drm_test_modes_analog_tv_pal_576i_inlined
[18:34:28] =============== [PASSED] drm_modes_analog_tv ===============
[18:34:28] ============== drm_plane_helper (2 subtests) ===============
[18:34:28] =============== drm_test_check_plane_state ================
[18:34:28] [PASSED] clipping_simple
[18:34:28] [PASSED] clipping_rotate_reflect
[18:34:28] [PASSED] positioning_simple
[18:34:28] [PASSED] upscaling
[18:34:28] [PASSED] downscaling
[18:34:28] [PASSED] rounding1
[18:34:28] [PASSED] rounding2
[18:34:28] [PASSED] rounding3
[18:34:28] [PASSED] rounding4
[18:34:28] =========== [PASSED] drm_test_check_plane_state ============
[18:34:28] =========== drm_test_check_invalid_plane_state ============
[18:34:28] [PASSED] positioning_invalid
[18:34:28] [PASSED] upscaling_invalid
[18:34:28] [PASSED] downscaling_invalid
[18:34:28] ======= [PASSED] drm_test_check_invalid_plane_state ========
[18:34:28] ================ [PASSED] drm_plane_helper =================
[18:34:28] ====== drm_connector_helper_tv_get_modes (1 subtest) =======
[18:34:28] ====== drm_test_connector_helper_tv_get_modes_check =======
[18:34:28] [PASSED] None
[18:34:28] [PASSED] PAL
[18:34:28] [PASSED] NTSC
[18:34:28] [PASSED] Both, NTSC Default
[18:34:28] [PASSED] Both, PAL Default
[18:34:28] [PASSED] Both, NTSC Default, with PAL on command-line
[18:34:28] [PASSED] Both, PAL Default, with NTSC on command-line
[18:34:28] == [PASSED] drm_test_connector_helper_tv_get_modes_check ===
[18:34:28] ======== [PASSED] drm_connector_helper_tv_get_modes ========
[18:34:28] ================== drm_rect (9 subtests) ===================
[18:34:28] [PASSED] drm_test_rect_clip_scaled_div_by_zero
[18:34:28] [PASSED] drm_test_rect_clip_scaled_not_clipped
[18:34:28] [PASSED] drm_test_rect_clip_scaled_clipped
[18:34:28] [PASSED] drm_test_rect_clip_scaled_signed_vs_unsigned
[18:34:28] ================= drm_test_rect_intersect =================
[18:34:28] [PASSED] top-left x bottom-right: 2x2+1+1 x 2x2+0+0
[18:34:28] [PASSED] top-right x bottom-left: 2x2+0+0 x 2x2+1-1
[18:34:28] [PASSED] bottom-left x top-right: 2x2+1-1 x 2x2+0+0
[18:34:28] [PASSED] bottom-right x top-left: 2x2+0+0 x 2x2+1+1
[18:34:28] [PASSED] right x left: 2x1+0+0 x 3x1+1+0
[18:34:28] [PASSED] left x right: 3x1+1+0 x 2x1+0+0
[18:34:28] [PASSED] up x bottom: 1x2+0+0 x 1x3+0-1
[18:34:28] [PASSED] bottom x up: 1x3+0-1 x 1x2+0+0
[18:34:28] [PASSED] touching corner: 1x1+0+0 x 2x2+1+1
[18:34:28] [PASSED] touching side: 1x1+0+0 x 1x1+1+0
[18:34:28] [PASSED] equal rects: 2x2+0+0 x 2x2+0+0
[18:34:28] [PASSED] inside another: 2x2+0+0 x 1x1+1+1
[18:34:28] [PASSED] far away: 1x1+0+0 x 1x1+3+6
[18:34:28] [PASSED] points intersecting: 0x0+5+10 x 0x0+5+10
[18:34:28] [PASSED] points not intersecting: 0x0+0+0 x 0x0+5+10
[18:34:28] ============= [PASSED] drm_test_rect_intersect =============
[18:34:28] ================ drm_test_rect_calc_hscale ================
[18:34:28] [PASSED] normal use
[18:34:28] [PASSED] out of max range
[18:34:28] [PASSED] out of min range
[18:34:28] [PASSED] zero dst
[18:34:28] [PASSED] negative src
[18:34:28] [PASSED] negative dst
[18:34:28] ============ [PASSED] drm_test_rect_calc_hscale ============
[18:34:28] ================ drm_test_rect_calc_vscale ================
[18:34:28] [PASSED] normal use
[18:34:28] [PASSED] out of max range
[18:34:28] [PASSED] out of min range
[18:34:28] [PASSED] zero dst
[18:34:28] [PASSED] negative src
[18:34:28] [PASSED] negative dst
stty: 'standard input': Inappropriate ioctl for device
[18:34:28] ============ [PASSED] drm_test_rect_calc_vscale ============
[18:34:28] ================== drm_test_rect_rotate ===================
[18:34:28] [PASSED] reflect-x
[18:34:28] [PASSED] reflect-y
[18:34:28] [PASSED] rotate-0
[18:34:28] [PASSED] rotate-90
[18:34:28] [PASSED] rotate-180
[18:34:28] [PASSED] rotate-270
[18:34:28] ============== [PASSED] drm_test_rect_rotate ===============
[18:34:28] ================ drm_test_rect_rotate_inv =================
[18:34:28] [PASSED] reflect-x
[18:34:28] [PASSED] reflect-y
[18:34:28] [PASSED] rotate-0
[18:34:28] [PASSED] rotate-90
[18:34:28] [PASSED] rotate-180
[18:34:28] [PASSED] rotate-270
[18:34:28] ============ [PASSED] drm_test_rect_rotate_inv =============
[18:34:28] ==================== [PASSED] drm_rect =====================
[18:34:28] ============ drm_sysfb_modeset_test (1 subtest) ============
[18:34:28] ============ drm_test_sysfb_build_fourcc_list =============
[18:34:28] [PASSED] no native formats
[18:34:28] [PASSED] XRGB8888 as native format
[18:34:28] [PASSED] remove duplicates
[18:34:28] [PASSED] convert alpha formats
[18:34:28] [PASSED] random formats
[18:34:28] ======== [PASSED] drm_test_sysfb_build_fourcc_list =========
[18:34:28] ============= [PASSED] drm_sysfb_modeset_test ==============
[18:34:28] ================== drm_fixp (2 subtests) ===================
[18:34:28] [PASSED] drm_test_int2fixp
[18:34:28] [PASSED] drm_test_sm2fixp
[18:34:28] ==================== [PASSED] drm_fixp =====================
[18:34:28] ============================================================
[18:34:28] Testing complete. Ran 621 tests: passed: 621
[18:34:28] Elapsed time: 26.015s total, 1.764s configuring, 24.121s building, 0.128s running
+ /kernel/tools/testing/kunit/kunit.py run --kunitconfig /kernel/drivers/gpu/drm/ttm/tests/.kunitconfig
[18:34:28] Configuring KUnit Kernel ...
Regenerating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[18:34:30] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=48
[18:34:40] Starting KUnit Kernel (1/1)...
[18:34:40] ============================================================
Running tests with:
$ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[18:34:40] ================= ttm_device (5 subtests) ==================
[18:34:40] [PASSED] ttm_device_init_basic
[18:34:40] [PASSED] ttm_device_init_multiple
[18:34:40] [PASSED] ttm_device_fini_basic
[18:34:40] [PASSED] ttm_device_init_no_vma_man
[18:34:40] ================== ttm_device_init_pools ==================
[18:34:40] [PASSED] No DMA allocations, no DMA32 required
[18:34:40] [PASSED] DMA allocations, DMA32 required
[18:34:40] [PASSED] No DMA allocations, DMA32 required
[18:34:40] [PASSED] DMA allocations, no DMA32 required
[18:34:40] ============== [PASSED] ttm_device_init_pools ==============
[18:34:40] =================== [PASSED] ttm_device ====================
[18:34:40] ================== ttm_pool (8 subtests) ===================
[18:34:40] ================== ttm_pool_alloc_basic ===================
[18:34:40] [PASSED] One page
[18:34:40] [PASSED] More than one page
[18:34:40] [PASSED] Above the allocation limit
[18:34:40] [PASSED] One page, with coherent DMA mappings enabled
[18:34:40] [PASSED] Above the allocation limit, with coherent DMA mappings enabled
[18:34:40] ============== [PASSED] ttm_pool_alloc_basic ===============
[18:34:40] ============== ttm_pool_alloc_basic_dma_addr ==============
[18:34:40] [PASSED] One page
[18:34:40] [PASSED] More than one page
[18:34:40] [PASSED] Above the allocation limit
[18:34:40] [PASSED] One page, with coherent DMA mappings enabled
[18:34:40] [PASSED] Above the allocation limit, with coherent DMA mappings enabled
[18:34:40] ========== [PASSED] ttm_pool_alloc_basic_dma_addr ==========
[18:34:40] [PASSED] ttm_pool_alloc_order_caching_match
[18:34:40] [PASSED] ttm_pool_alloc_caching_mismatch
[18:34:40] [PASSED] ttm_pool_alloc_order_mismatch
[18:34:40] [PASSED] ttm_pool_free_dma_alloc
[18:34:40] [PASSED] ttm_pool_free_no_dma_alloc
[18:34:40] [PASSED] ttm_pool_fini_basic
[18:34:40] ==================== [PASSED] ttm_pool =====================
[18:34:40] ================ ttm_resource (8 subtests) =================
[18:34:40] ================= ttm_resource_init_basic =================
[18:34:40] [PASSED] Init resource in TTM_PL_SYSTEM
[18:34:40] [PASSED] Init resource in TTM_PL_VRAM
[18:34:40] [PASSED] Init resource in a private placement
[18:34:40] [PASSED] Init resource in TTM_PL_SYSTEM, set placement flags
[18:34:40] ============= [PASSED] ttm_resource_init_basic =============
[18:34:40] [PASSED] ttm_resource_init_pinned
[18:34:40] [PASSED] ttm_resource_fini_basic
[18:34:40] [PASSED] ttm_resource_manager_init_basic
[18:34:40] [PASSED] ttm_resource_manager_usage_basic
[18:34:40] [PASSED] ttm_resource_manager_set_used_basic
[18:34:40] [PASSED] ttm_sys_man_alloc_basic
[18:34:40] [PASSED] ttm_sys_man_free_basic
[18:34:40] ================== [PASSED] ttm_resource ===================
[18:34:40] =================== ttm_tt (15 subtests) ===================
[18:34:40] ==================== ttm_tt_init_basic ====================
[18:34:40] [PASSED] Page-aligned size
[18:34:40] [PASSED] Extra pages requested
[18:34:40] ================ [PASSED] ttm_tt_init_basic ================
[18:34:40] [PASSED] ttm_tt_init_misaligned
[18:34:40] [PASSED] ttm_tt_fini_basic
[18:34:40] [PASSED] ttm_tt_fini_sg
[18:34:40] [PASSED] ttm_tt_fini_shmem
[18:34:40] [PASSED] ttm_tt_create_basic
[18:34:40] [PASSED] ttm_tt_create_invalid_bo_type
[18:34:40] [PASSED] ttm_tt_create_ttm_exists
[18:34:40] [PASSED] ttm_tt_create_failed
[18:34:40] [PASSED] ttm_tt_destroy_basic
[18:34:40] [PASSED] ttm_tt_populate_null_ttm
[18:34:40] [PASSED] ttm_tt_populate_populated_ttm
[18:34:40] [PASSED] ttm_tt_unpopulate_basic
[18:34:40] [PASSED] ttm_tt_unpopulate_empty_ttm
[18:34:40] [PASSED] ttm_tt_swapin_basic
[18:34:40] ===================== [PASSED] ttm_tt ======================
[18:34:40] =================== ttm_bo (14 subtests) ===================
[18:34:40] =========== ttm_bo_reserve_optimistic_no_ticket ===========
[18:34:40] [PASSED] Cannot be interrupted and sleeps
[18:34:40] [PASSED] Cannot be interrupted, locks straight away
[18:34:40] [PASSED] Can be interrupted, sleeps
[18:34:40] ======= [PASSED] ttm_bo_reserve_optimistic_no_ticket =======
[18:34:40] [PASSED] ttm_bo_reserve_locked_no_sleep
[18:34:40] [PASSED] ttm_bo_reserve_no_wait_ticket
[18:34:40] [PASSED] ttm_bo_reserve_double_resv
[18:34:40] [PASSED] ttm_bo_reserve_interrupted
[18:34:40] [PASSED] ttm_bo_reserve_deadlock
[18:34:40] [PASSED] ttm_bo_unreserve_basic
[18:34:40] [PASSED] ttm_bo_unreserve_pinned
[18:34:40] [PASSED] ttm_bo_unreserve_bulk
[18:34:40] [PASSED] ttm_bo_fini_basic
[18:34:40] [PASSED] ttm_bo_fini_shared_resv
[18:34:40] [PASSED] ttm_bo_pin_basic
[18:34:40] [PASSED] ttm_bo_pin_unpin_resource
[18:34:40] [PASSED] ttm_bo_multiple_pin_one_unpin
[18:34:40] ===================== [PASSED] ttm_bo ======================
[18:34:40] ============== ttm_bo_validate (22 subtests) ===============
[18:34:40] ============== ttm_bo_init_reserved_sys_man ===============
[18:34:40] [PASSED] Buffer object for userspace
[18:34:40] [PASSED] Kernel buffer object
[18:34:40] [PASSED] Shared buffer object
[18:34:40] ========== [PASSED] ttm_bo_init_reserved_sys_man ===========
[18:34:40] ============== ttm_bo_init_reserved_mock_man ==============
[18:34:40] [PASSED] Buffer object for userspace
[18:34:40] [PASSED] Kernel buffer object
[18:34:40] [PASSED] Shared buffer object
[18:34:40] ========== [PASSED] ttm_bo_init_reserved_mock_man ==========
[18:34:40] [PASSED] ttm_bo_init_reserved_resv
[18:34:40] ================== ttm_bo_validate_basic ==================
[18:34:40] [PASSED] Buffer object for userspace
[18:34:40] [PASSED] Kernel buffer object
[18:34:40] [PASSED] Shared buffer object
[18:34:40] ============== [PASSED] ttm_bo_validate_basic ==============
[18:34:40] [PASSED] ttm_bo_validate_invalid_placement
[18:34:40] ============= ttm_bo_validate_same_placement ==============
[18:34:40] [PASSED] System manager
[18:34:40] [PASSED] VRAM manager
[18:34:40] ========= [PASSED] ttm_bo_validate_same_placement ==========
[18:34:40] [PASSED] ttm_bo_validate_failed_alloc
[18:34:40] [PASSED] ttm_bo_validate_pinned
[18:34:40] [PASSED] ttm_bo_validate_busy_placement
[18:34:40] ================ ttm_bo_validate_multihop =================
[18:34:40] [PASSED] Buffer object for userspace
[18:34:40] [PASSED] Kernel buffer object
[18:34:40] [PASSED] Shared buffer object
[18:34:40] ============ [PASSED] ttm_bo_validate_multihop =============
[18:34:40] ========== ttm_bo_validate_no_placement_signaled ==========
[18:34:40] [PASSED] Buffer object in system domain, no page vector
[18:34:40] [PASSED] Buffer object in system domain with an existing page vector
[18:34:40] ====== [PASSED] ttm_bo_validate_no_placement_signaled ======
[18:34:40] ======== ttm_bo_validate_no_placement_not_signaled ========
[18:34:40] [PASSED] Buffer object for userspace
[18:34:40] [PASSED] Kernel buffer object
[18:34:40] [PASSED] Shared buffer object
[18:34:40] ==== [PASSED] ttm_bo_validate_no_placement_not_signaled ====
[18:34:40] [PASSED] ttm_bo_validate_move_fence_signaled
[18:34:40] ========= ttm_bo_validate_move_fence_not_signaled =========
[18:34:40] [PASSED] Waits for GPU
[18:34:40] [PASSED] Tries to lock straight away
[18:34:40] ===== [PASSED] ttm_bo_validate_move_fence_not_signaled =====
[18:34:40] [PASSED] ttm_bo_validate_swapout
[18:34:40] [PASSED] ttm_bo_validate_happy_evict
[18:34:40] [PASSED] ttm_bo_validate_all_pinned_evict
[18:34:40] [PASSED] ttm_bo_validate_allowed_only_evict
[18:34:40] [PASSED] ttm_bo_validate_deleted_evict
[18:34:40] [PASSED] ttm_bo_validate_busy_domain_evict
[18:34:40] [PASSED] ttm_bo_validate_evict_gutting
[18:34:40] [PASSED] ttm_bo_validate_recrusive_evict
stty: 'standard input': Inappropriate ioctl for device
[18:34:40] ================= [PASSED] ttm_bo_validate =================
[18:34:40] ============================================================
[18:34:40] Testing complete. Ran 102 tests: passed: 102
[18:34:40] Elapsed time: 11.482s total, 1.712s configuring, 9.504s building, 0.225s running
+ cleanup
++ stat -c %u:%g /kernel
+ chown -R 1003:1003 /kernel
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-25 18:28 ` Maarten Lankhorst
@ 2026-03-25 18:59 ` Guenter Roeck
2026-03-25 20:12 ` Guenter Roeck
1 sibling, 0 replies; 33+ messages in thread
From: Guenter Roeck @ 2026-03-25 18:59 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: dri-devel, intel-xe, Thomas Hellström
On 3/25/26 11:28, Maarten Lankhorst wrote:
> Hello,
>
> What about this patch?
>
I'll give it a try.
Thanks,
Guenter
> Kind regards,
> ~Maarten Lankhorst
>
> ------8<---------
> diff --git a/drivers/gpu/drm/sysfb/simpledrm.c b/drivers/gpu/drm/sysfb/simpledrm.c
> index 0358164a623c9..ae49aaf99fb2c 100644
> --- a/drivers/gpu/drm/sysfb/simpledrm.c
> +++ b/drivers/gpu/drm/sysfb/simpledrm.c
> @@ -588,6 +588,11 @@ static const struct drm_mode_config_funcs simpledrm_mode_config_funcs = {
> * Init / Cleanup
> */
>
> +static void simpledrm_shutdown(struct drm_device *dev, void *arg)
> +{
> + drm_atomic_helper_shutdown(dev);
> +}
> +
> static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
> struct platform_device *pdev)
> {
> @@ -808,6 +813,10 @@ static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
>
> drm_mode_config_reset(dev);
>
> + ret = drmm_add_action_or_reset(dev, simpledrm_shutdown, NULL);
> + if (ret)
> + return ERR_PTR(ret);
> +
> return sdev;
> }
>
> ---------
>
> Den 2026-03-25 kl. 18:26, skrev Guenter Roeck:
>> Hi,
>>
>> On Fri, Mar 13, 2026 at 04:17:27PM +0100, Maarten Lankhorst wrote:
>>> When trying to do a rather aggressive test of igt's "xe_module_load
>>> --r reload" with a full desktop environment and game running I noticed
>>> a few OOPSes when dereferencing freed pointers, related to
>>> framebuffers and property blobs after the compositor exits.
>>>
>>> Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
>>> and immediately put the references from struct drm_file objects during
>>> drm_dev_unplug().
>>>
>>
>> With this patch in v6.18.20, I get the warning backtraces below.
>> The backtraces are gone with the patch reverted.
>>
>> Guenter
>>
>> ---
>> [ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 08:22:19 PDT 2026
>> [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.18.20-spi+ root=UUID=ce436484-f920-47a8-a8c4-c17ff3a877e8 ro quiet splash amdgpu.gpu_recovery=1 amdgpu.ppfeaturemask=0xfff73fff vt.handoff=7
>> ...
>> [ 4.254064] nouveau 0000:2b:00.0: NVIDIA GK208B (b060b0b1)
>> ...
>> [ 5.440862] ------------[ cut here ]------------
>> [ 5.440864] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:537 drm_mode_config_cleanup+0x313/0x360
>> [ 5.440868] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
>> [ 5.440902] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Not tainted 6.18.20-spi+ #1 PREEMPT(full)
>> [ 5.440903] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
>> [ 5.440904] RIP: 0010:drm_mode_config_cleanup+0x313/0x360
>> [ 5.440906] Code: 8b 45 d0 65 48 2b 05 84 22 0b 02 75 64 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 48 8d 75 88 4c 89 e7 e8 1f 12 fe ff eb 10 48 8b 70 60 48 c7
>> [ 5.440907] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010202
>> [ 5.440908] RAX: ffff89bcc2268258 RBX: ffff89bcc2268290 RCX: 0000000000000000
>> [ 5.440909] RDX: ffff89bcc2269308 RSI: 0000000000000000 RDI: 0000000000000000
>> [ 5.440909] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
>> [ 5.440910] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
>> [ 5.440910] R13: ffff89bcc2268298 R14: ffff89bcc5c3f480 R15: dead000000000100
>> [ 5.440911] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
>> [ 5.440912] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 5.440912] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
>> [ 5.440913] PKRU: 55555554
>> [ 5.440914] Call Trace:
>> [ 5.440914] <TASK>
>> [ 5.440916] ? drm_managed_release+0xc2/0x160
>> [ 5.440918] drm_mode_config_init_release+0xe/0x20
>> [ 5.440919] drm_managed_release+0x8f/0x160
>> [ 5.440920] drm_minor_release+0x5f/0x90
>> [ 5.440921] drm_release+0xda/0x140
>> [ 5.440923] __fput+0xed/0x2d0
>> [ 5.440925] fput_close_sync+0x3d/0xa0
>> [ 5.440927] __x64_sys_close+0x3e/0x90
>> [ 5.440928] x64_sys_call+0x1b5e/0x26a0
>> [ 5.440930] do_syscall_64+0x80/0x570
>> [ 5.440934] ? x64_sys_call+0x1144/0x26a0
>> [ 5.440935] ? do_syscall_64+0xb8/0x570
>> [ 5.440937] ? __vm_munmap+0xdb/0x190
>> [ 5.440939] ? __x64_sys_munmap+0x1b/0x30
>> [ 5.440941] ? x64_sys_call+0x1be5/0x26a0
>> [ 5.440942] ? do_syscall_64+0xb8/0x570
>> [ 5.440943] ? irqentry_exit+0x43/0x50
>> [ 5.440944] ? exc_page_fault+0x90/0x1b0
>> [ 5.440946] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> [ 5.440947] RIP: 0033:0x713c256fa74c
>> [ 5.440948] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
>> [ 5.440949] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
>> [ 5.440950] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
>> [ 5.440951] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
>> [ 5.440951] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
>> [ 5.440952] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
>> [ 5.440952] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
>> [ 5.440953] </TASK>
>> [ 5.440954] ---[ end trace 0000000000000000 ]---
>> [ 5.440955] [drm:drm_mode_config_cleanup] *ERROR* connector Unknown-1 leaked!
>> [ 5.440971] ------------[ cut here ]------------
>> [ 5.440971] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:571 drm_mode_config_cleanup+0x34f/0x360
>> [ 5.440973] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
>> [ 5.440995] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
>> [ 5.440997] Tainted: [W]=WARN
>> [ 5.440997] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
>> [ 5.440998] RIP: 0010:drm_mode_config_cleanup+0x34f/0x360
>> [ 5.440999] Code: 70 60 48 c7 c7 a7 90 93 ba e8 3d bb 00 00 48 8d 7d 88 e8 c4 32 fe ff 48 85 c0 75 e2 48 8d 7d 88 e8 d6 31 fe ff e9 7b fd ff ff <0f> 0b e9 79 fe ff ff 0f 0b eb 8e e8 01 a4 65 00 90 90 90 90 90 90
>> [ 5.441000] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010293
>> [ 5.441001] RAX: ffff89bcd7c61bc8 RBX: ffff89bcc2268368 RCX: 0000000000000000
>> [ 5.441001] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89bcc2268368
>> [ 5.441002] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
>> [ 5.441002] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
>> [ 5.441002] R13: ffff89bcc2268390 R14: ffff89bcc2268230 R15: dead000000000100
>> [ 5.441003] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
>> [ 5.441004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 5.441004] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
>> [ 5.441005] PKRU: 55555554
>> [ 5.441005] Call Trace:
>> [ 5.441006] <TASK>
>> [ 5.441006] ? drm_managed_release+0xc2/0x160
>> [ 5.441008] drm_mode_config_init_release+0xe/0x20
>> [ 5.441009] drm_managed_release+0x8f/0x160
>> [ 5.441010] drm_minor_release+0x5f/0x90
>> [ 5.441011] drm_release+0xda/0x140
>> [ 5.441012] __fput+0xed/0x2d0
>> [ 5.441013] fput_close_sync+0x3d/0xa0
>> [ 5.441014] __x64_sys_close+0x3e/0x90
>> [ 5.441015] x64_sys_call+0x1b5e/0x26a0
>> [ 5.441017] do_syscall_64+0x80/0x570
>> [ 5.441018] ? x64_sys_call+0x1144/0x26a0
>> [ 5.441019] ? do_syscall_64+0xb8/0x570
>> [ 5.441021] ? __vm_munmap+0xdb/0x190
>> [ 5.441023] ? __x64_sys_munmap+0x1b/0x30
>> [ 5.441024] ? x64_sys_call+0x1be5/0x26a0
>> [ 5.441025] ? do_syscall_64+0xb8/0x570
>> [ 5.441026] ? irqentry_exit+0x43/0x50
>> [ 5.441027] ? exc_page_fault+0x90/0x1b0
>> [ 5.441029] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> [ 5.441029] RIP: 0033:0x713c256fa74c
>> [ 5.441030] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
>> [ 5.441031] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
>> [ 5.441031] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
>> [ 5.441032] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
>> [ 5.441032] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
>> [ 5.441033] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
>> [ 5.441033] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
>> [ 5.441035] </TASK>
>> [ 5.441035] ---[ end trace 0000000000000000 ]---
>> [ 5.441036] ------------[ cut here ]------------
>> [ 5.441036] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->vmap_use_count))
>> [ 5.441041] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:170 drm_gem_shmem_free+0x111/0x1a0
>> [ 5.441043] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
>> [ 5.441066] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
>> [ 5.441067] Tainted: [W]=WARN
>> [ 5.441067] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
>> [ 5.441068] RIP: 0010:drm_gem_shmem_free+0x111/0x1a0
>> [ 5.441069] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 68 4f 02 00 48 c7 c1 e8 03 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 8f 09 46 ff <0f> 0b e9 4b ff ff ff 48 8b 7b 08 48 85 ff 74 04 48 8b 7f 08 4c 8b
>> [ 5.441070] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
>> [ 5.441070] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
>> [ 5.441071] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
>> [ 5.441071] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
>> [ 5.441072] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
>> [ 5.441072] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
>> [ 5.441073] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
>> [ 5.441073] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 5.441074] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
>> [ 5.441075] PKRU: 55555554
>> [ 5.441075] Call Trace:
>> [ 5.441075] <TASK>
>> [ 5.441076] drm_gem_shmem_object_free+0x9/0x20
>> [ 5.441077] drm_gem_object_handle_put_unlocked+0x12c/0x140
>> [ 5.441079] drm_framebuffer_cleanup+0x60/0xe0
>> [ 5.441080] drm_gem_fb_destroy+0x79/0xc0
>> [ 5.441081] drm_framebuffer_free+0x43/0xa0
>> [ 5.441083] drm_mode_config_cleanup+0x29c/0x360
>> [ 5.441084] ? drm_mode_config_cleanup+0x1f2/0x360
>> [ 5.441085] ? drm_managed_release+0xc2/0x160
>> [ 5.441086] drm_mode_config_init_release+0xe/0x20
>> [ 5.441087] drm_managed_release+0x8f/0x160
>> [ 5.441088] drm_minor_release+0x5f/0x90
>> [ 5.441089] drm_release+0xda/0x140
>> [ 5.441090] __fput+0xed/0x2d0
>> [ 5.441091] fput_close_sync+0x3d/0xa0
>> [ 5.441092] __x64_sys_close+0x3e/0x90
>> [ 5.441094] x64_sys_call+0x1b5e/0x26a0
>> [ 5.441095] do_syscall_64+0x80/0x570
>> [ 5.441096] ? x64_sys_call+0x1144/0x26a0
>> [ 5.441097] ? do_syscall_64+0xb8/0x570
>> [ 5.441099] ? __vm_munmap+0xdb/0x190
>> [ 5.441101] ? __x64_sys_munmap+0x1b/0x30
>> [ 5.441102] ? x64_sys_call+0x1be5/0x26a0
>> [ 5.441103] ? do_syscall_64+0xb8/0x570
>> [ 5.441104] ? irqentry_exit+0x43/0x50
>> [ 5.441105] ? exc_page_fault+0x90/0x1b0
>> [ 5.441106] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> [ 5.441107] RIP: 0033:0x713c256fa74c
>> [ 5.441108] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
>> [ 5.441109] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
>> [ 5.441109] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
>> [ 5.441110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
>> [ 5.441110] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
>> [ 5.441111] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
>> [ 5.441111] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
>> [ 5.441112] </TASK>
>> [ 5.441113] ---[ end trace 0000000000000000 ]---
>> [ 5.441151] ------------[ cut here ]------------
>> [ 5.441152] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->pages_pin_count))
>> [ 5.441155] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:182 drm_gem_shmem_free+0x18d/0x1a0
>> [ 5.441157] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
>> [ 5.441179] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
>> [ 5.441180] Tainted: [W]=WARN
>> [ 5.441180] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
>> [ 5.441181] RIP: 0010:drm_gem_shmem_free+0x18d/0x1a0
>> [ 5.441182] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 ec 4e 02 00 48 c7 c1 58 04 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 13 09 46 ff <0f> 0b e9 35 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90
>> [ 5.441182] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
>> [ 5.441183] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
>> [ 5.441184] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
>> [ 5.441184] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
>> [ 5.441184] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
>> [ 5.441185] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
>> [ 5.441186] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
>> [ 5.441186] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 5.441187] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
>> [ 5.441187] PKRU: 55555554
>> [ 5.441188] Call Trace:
>> [ 5.441188] <TASK>
>> [ 5.441188] drm_gem_shmem_object_free+0x9/0x20
>> [ 5.441189] drm_gem_object_handle_put_unlocked+0x12c/0x140
>> [ 5.441191] drm_framebuffer_cleanup+0x60/0xe0
>> [ 5.441192] drm_gem_fb_destroy+0x79/0xc0
>> [ 5.441193] drm_framebuffer_free+0x43/0xa0
>> [ 5.441194] drm_mode_config_cleanup+0x29c/0x360
>> [ 5.441195] ? drm_mode_config_cleanup+0x1f2/0x360
>> [ 5.441196] ? drm_managed_release+0xc2/0x160
>> [ 5.441197] drm_mode_config_init_release+0xe/0x20
>> [ 5.441198] drm_managed_release+0x8f/0x160
>> [ 5.441199] drm_minor_release+0x5f/0x90
>> [ 5.441200] drm_release+0xda/0x140
>> [ 5.441201] __fput+0xed/0x2d0
>> [ 5.441202] fput_close_sync+0x3d/0xa0
>> [ 5.441204] __x64_sys_close+0x3e/0x90
>> [ 5.441205] x64_sys_call+0x1b5e/0x26a0
>> [ 5.441206] do_syscall_64+0x80/0x570
>> [ 5.441208] ? x64_sys_call+0x1144/0x26a0
>> [ 5.441209] ? do_syscall_64+0xb8/0x570
>> [ 5.441210] ? __vm_munmap+0xdb/0x190
>> [ 5.441212] ? __x64_sys_munmap+0x1b/0x30
>> [ 5.441213] ? x64_sys_call+0x1be5/0x26a0
>> [ 5.441214] ? do_syscall_64+0xb8/0x570
>> [ 5.441216] ? irqentry_exit+0x43/0x50
>> [ 5.441216] ? exc_page_fault+0x90/0x1b0
>> [ 5.441218] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> [ 5.441219] RIP: 0033:0x713c256fa74c
>> [ 5.441219] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
>> [ 5.441234] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
>> [ 5.441236] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
>> [ 5.441237] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
>> [ 5.441238] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
>> [ 5.441238] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
>> [ 5.441239] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
>> [ 5.441241] </TASK>
>> [ 5.441241] ---[ end trace 0000000000000000 ]---
>
^ permalink raw reply [flat|nested] 33+ messages in thread
* ✓ Xe.CI.BAT: success for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev3)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (6 preceding siblings ...)
2026-03-25 18:34 ` ✓ CI.KUnit: success " Patchwork
@ 2026-03-25 19:29 ` Patchwork
2026-03-25 20:35 ` ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev4) Patchwork
` (7 subsequent siblings)
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-25 19:29 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
[-- Attachment #1: Type: text/plain, Size: 2418 bytes --]
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev3)
URL : https://patchwork.freedesktop.org/series/162134/
State : success
== Summary ==
CI Bug Log - changes from xe-4784-cfe3d5f3eb5cf3b8aff1710c1c5c1d666f932aa8_BAT -> xe-pw-162134v3_BAT
====================================================
Summary
-------
**SUCCESS**
No regressions found.
Participating hosts (14 -> 14)
------------------------------
No changes in participating hosts
Known issues
------------
Here are the changes found in xe-pw-162134v3_BAT that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@kms_flip@basic-flip-vs-wf_vblank@c-edp1:
- bat-adlp-7: [PASS][1] -> [DMESG-WARN][2] ([Intel XE#7483])
[1]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4784-cfe3d5f3eb5cf3b8aff1710c1c5c1d666f932aa8/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@c-edp1.html
[2]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v3/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@c-edp1.html
* igt@xe_waitfence@reltime:
- bat-dg2-oem2: [PASS][3] -> [FAIL][4] ([Intel XE#6520])
[3]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4784-cfe3d5f3eb5cf3b8aff1710c1c5c1d666f932aa8/bat-dg2-oem2/igt@xe_waitfence@reltime.html
[4]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v3/bat-dg2-oem2/igt@xe_waitfence@reltime.html
#### Possible fixes ####
* igt@kms_flip@basic-flip-vs-wf_vblank@d-edp1:
- bat-adlp-7: [DMESG-WARN][5] ([Intel XE#7483]) -> [PASS][6]
[5]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4784-cfe3d5f3eb5cf3b8aff1710c1c5c1d666f932aa8/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@d-edp1.html
[6]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v3/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@d-edp1.html
[Intel XE#6520]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6520
[Intel XE#7483]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7483
Build changes
-------------
* IGT: IGT_8826 -> IGT_8827
* Linux: xe-4784-cfe3d5f3eb5cf3b8aff1710c1c5c1d666f932aa8 -> xe-pw-162134v3
IGT_8826: 8826
IGT_8827: 8827
xe-4784-cfe3d5f3eb5cf3b8aff1710c1c5c1d666f932aa8: cfe3d5f3eb5cf3b8aff1710c1c5c1d666f932aa8
xe-pw-162134v3: 162134v3
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v3/index.html
[-- Attachment #2: Type: text/html, Size: 3129 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-25 18:28 ` Maarten Lankhorst
2026-03-25 18:59 ` Guenter Roeck
@ 2026-03-25 20:12 ` Guenter Roeck
2026-03-25 20:31 ` Maarten Lankhorst
1 sibling, 1 reply; 33+ messages in thread
From: Guenter Roeck @ 2026-03-25 20:12 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: dri-devel, intel-xe, Thomas Hellström
Hi Maarten,
On Wed, Mar 25, 2026 at 07:28:06PM +0100, Maarten Lankhorst wrote:
> Hello,
>
> What about this patch?
>
> Kind regards,
> ~Maarten Lankhorst
>
> ------8<---------
> diff --git a/drivers/gpu/drm/sysfb/simpledrm.c b/drivers/gpu/drm/sysfb/simpledrm.c
> index 0358164a623c9..ae49aaf99fb2c 100644
> --- a/drivers/gpu/drm/sysfb/simpledrm.c
> +++ b/drivers/gpu/drm/sysfb/simpledrm.c
> @@ -588,6 +588,11 @@ static const struct drm_mode_config_funcs simpledrm_mode_config_funcs = {
> * Init / Cleanup
> */
>
> +static void simpledrm_shutdown(struct drm_device *dev, void *arg)
> +{
> + drm_atomic_helper_shutdown(dev);
> +}
> +
> static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
> struct platform_device *pdev)
> {
> @@ -808,6 +813,10 @@ static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
>
> drm_mode_config_reset(dev);
>
> + ret = drmm_add_action_or_reset(dev, simpledrm_shutdown, NULL);
> + if (ret)
> + return ERR_PTR(ret);
> +
> return sdev;
> }
>
Unfortunately, this results in an exciting new set of refcount underflows.
Guenter
---
[ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 12:10:19 PDT 2026
[ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.18.20-spi+ root=UUID=ce436484-f920-47a8-a8c4-c17ff3a877e8 ro quiet splash amdgpu.gpu_recovery=1 amdgpu.ppfeaturemask=0xfff73fff vt.handoff=7
...
[ 3.806644] nouveau 0000:2b:00.0: NVIDIA GK208B (b060b0b1)
...
[ 4.644370] nouveau 0000:2b:00.0: drm: VRAM: 2048 MiB
[ 4.644373] nouveau 0000:2b:00.0: drm: GART: 1048576 MiB
[ 4.644375] nouveau 0000:2b:00.0: drm: TMDS table version 2.0
[ 4.645032] nouveau 0000:2b:00.0: drm: MM: using COPY for buffer copies
[ 4.645959] snd_hda_intel 0000:2b:00.1: bound 0000:2b:00.0 (ops nv50_audio_component_bind_ops [nouveau])
[ 4.647016] nouveau 0000:2b:00.0: [drm] Registered 4 planes with drm panic
[ 4.647019] [drm] Initialized nouveau 1.4.0 for 0000:2b:00.0 on minor 1
...
[ 4.728390] fbcon: nouveaudrmfb (fb0) is primary device
[ 4.728392] fbcon: Deferring console take-over
[ 4.728393] nouveau 0000:2b:00.0: [drm] fb0: nouveaudrmfb frame buffer device
[ 4.826620] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
...
[ 4.986925] ------------[ cut here ]------------
[ 4.986926] refcount_t: addition on 0; use-after-free.
[ 4.986933] WARNING: CPU: 2 PID: 493 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x150
[ 4.986938] Modules linked in: qrtr bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep kvm_amd snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi kvm snd_seq btusb snd_seq_device snd_timer btmtk btrtl irqbypass polyval_clmulni btbcm snd ghash_clmulni_intel btintel aesni_intel bluetooth joydev input_leds ee1004 soundcore ccp rapl nouveau mxm_wmi drm_gpuvm gpu_sched drm_ttm_helper ttm drm_exec drm_display_helper cec rc_core i2c_piix4 video i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid igb nvme_core r8169 i2c_algo_bit nvme_keyring ahci realtek dca nvme_auth libahci hkdf wmi
[ 4.986973] CPU: 2 UID: 0 PID: 493 Comm: plymouthd Not tainted 6.18.20-spi+ #1 PREEMPT(full)
[ 4.986974] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
[ 4.986975] RIP: 0010:refcount_warn_saturate+0x12e/0x150
[ 4.986977] Code: 1d 28 43 ec 01 80 fb 01 0f 87 fe 61 6c ff 83 e3 01 0f 85 52 ff ff ff 48 c7 c7 18 a3 66 89 c6 05 08 43 ec 01 01 e8 a2 76 80 ff <0f> 0b e9 38 ff ff ff 48 c7 c7 f0 a2 66 89 c6 05 ef 42 ec 01 01 e8
[ 4.986978] RSP: 0018:ffffcdec80873990 EFLAGS: 00010246
[ 4.986979] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 4.986979] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 4.986980] RBP: ffffcdec80873998 R08: 0000000000000000 R09: 0000000000000000
[ 4.986980] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8af0493f7c80
[ 4.986981] R13: ffff8af0493f7c80 R14: ffff8af04085e740 R15: dead000000000100
[ 4.986982] FS: 0000739d3374e000(0000) GS:ffff8aff93d73000(0000) knlGS:0000000000000000
[ 4.986983] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4.986983] CR2: 0000739d2f268000 CR3: 0000000113bd6000 CR4: 0000000000f50ef0
[ 4.986984] PKRU: 55555554
[ 4.986984] Call Trace:
[ 4.986985] <TASK>
[ 4.986987] drm_dev_get+0x53/0x80
[ 4.986989] drm_atomic_state_init+0x7b/0xe0
[ 4.986991] drm_atomic_state_alloc+0x98/0xb0
[ 4.986992] drm_atomic_helper_disable_all+0x1d/0x1c0
[ 4.986994] drm_atomic_helper_shutdown+0x9c/0x140
[ 4.986995] simpledrm_shutdown+0xe/0x20
[ 4.986997] drm_managed_release+0x8f/0x160
[ 4.986999] drm_minor_release+0x5f/0x90
[ 4.987000] drm_release+0xda/0x140
[ 4.987001] __fput+0xed/0x2d0
[ 4.987010] fput_close_sync+0x3d/0xa0
[ 4.987012] __x64_sys_close+0x3e/0x90
[ 4.987015] x64_sys_call+0x1b5e/0x26a0
[ 4.987019] do_syscall_64+0x80/0x530
[ 4.987022] ? x64_sys_call+0x1144/0x26a0
[ 4.987024] ? do_syscall_64+0xb8/0x530
[ 4.987025] ? from_kgid_munged+0x17/0x30
[ 4.987028] ? cp_new_stat+0x141/0x180
[ 4.987030] ? __do_sys_newfstat+0x4c/0x80
[ 4.987032] ? __x64_sys_newfstat+0x15/0x20
[ 4.987034] ? x64_sys_call+0x204a/0x26a0
[ 4.987035] ? do_syscall_64+0xb8/0x530
[ 4.987037] ? __x64_sys_newfstat+0x15/0x20
[ 4.987038] ? x64_sys_call+0x204a/0x26a0
[ 4.987040] ? do_syscall_64+0xb8/0x530
[ 4.987041] ? irqentry_exit_to_user_mode+0x2e/0x320
[ 4.987043] ? irqentry_exit+0x43/0x50
[ 4.987044] ? exc_page_fault+0x90/0x1b0
[ 4.987046] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 4.987047] RIP: 0033:0x739d339f774c
[ 4.987048] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
[ 4.987049] RSP: 002b:00007ffd8ca10660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 4.987050] RAX: ffffffffffffffda RBX: 0000615423195870 RCX: 0000739d339f774c
[ 4.987051] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
[ 4.987052] RBP: 00007ffd8ca10670 R08: 0000000615423196 R09: 0000000000000007
[ 4.987053] R10: 0000615423196bc0 R11: 0000000000000293 R12: 0000739d3374df88
[ 4.987055] R13: 0000000000000013 R14: 0000615423209840 R15: 0000615423194130
[ 4.987057] </TASK>
[ 4.987058] ---[ end trace 0000000000000000 ]---
[ 4.987114] ------------[ cut here ]------------
[ 4.987115] refcount_t: underflow; use-after-free.
[ 4.987119] WARNING: CPU: 2 PID: 493 at lib/refcount.c:28 refcount_warn_saturate+0xfb/0x150
[ 4.987121] Modules linked in: qrtr bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep kvm_amd snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi kvm snd_seq btusb snd_seq_device snd_timer btmtk btrtl irqbypass polyval_clmulni btbcm snd ghash_clmulni_intel btintel aesni_intel bluetooth joydev input_leds ee1004 soundcore ccp rapl nouveau mxm_wmi drm_gpuvm gpu_sched drm_ttm_helper ttm drm_exec drm_display_helper cec rc_core i2c_piix4 video i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid igb nvme_core r8169 i2c_algo_bit nvme_keyring ahci realtek dca nvme_auth libahci hkdf wmi
[ 4.987147] CPU: 2 UID: 0 PID: 493 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
[ 4.987149] Tainted: [W]=WARN
[ 4.987149] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
[ 4.987150] RIP: 0010:refcount_warn_saturate+0xfb/0x150
[ 4.987151] Code: eb 9a 0f b6 1d 56 43 ec 01 80 fb 01 0f 87 41 62 6c ff 83 e3 01 75 85 48 c7 c7 48 a3 66 89 c6 05 3a 43 ec 01 01 e8 d5 76 80 ff <0f> 0b e9 6b ff ff ff 0f b6 1d 28 43 ec 01 80 fb 01 0f 87 fe 61 6c
[ 4.987152] RSP: 0018:ffffcdec808739b0 EFLAGS: 00010246
[ 4.987153] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 4.987154] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 4.987154] RBP: ffffcdec808739b8 R08: 0000000000000000 R09: 0000000000000000
[ 4.987155] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8af045e46000
[ 4.987155] R13: ffff8af042b0ba00 R14: ffff8af04085e740 R15: dead000000000100
[ 4.987156] FS: 0000739d3374e000(0000) GS:ffff8aff93d73000(0000) knlGS:0000000000000000
[ 4.987157] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4.987158] CR2: 0000739d2f268000 CR3: 0000000113bd6000 CR4: 0000000000f50ef0
[ 4.987159] PKRU: 55555554
[ 4.987159] Call Trace:
[ 4.987159] <TASK>
[ 4.987160] drm_dev_put+0x8c/0x90
[ 4.987162] __drm_atomic_state_free+0xbe/0xe0
[ 4.987163] drm_atomic_helper_disable_all+0xd0/0x1c0
[ 4.987164] drm_atomic_helper_shutdown+0x9c/0x140
[ 4.987165] simpledrm_shutdown+0xe/0x20
[ 4.987167] drm_managed_release+0x8f/0x160
[ 4.987168] drm_minor_release+0x5f/0x90
[ 4.987169] drm_release+0xda/0x140
[ 4.987171] __fput+0xed/0x2d0
[ 4.987172] fput_close_sync+0x3d/0xa0
[ 4.987174] __x64_sys_close+0x3e/0x90
[ 4.987175] x64_sys_call+0x1b5e/0x26a0
[ 4.987177] do_syscall_64+0x80/0x530
[ 4.987178] ? x64_sys_call+0x1144/0x26a0
[ 4.987180] ? do_syscall_64+0xb8/0x530
[ 4.987182] ? from_kgid_munged+0x17/0x30
[ 4.987183] ? cp_new_stat+0x141/0x180
[ 4.987185] ? __do_sys_newfstat+0x4c/0x80
[ 4.987187] ? __x64_sys_newfstat+0x15/0x20
[ 4.987188] ? x64_sys_call+0x204a/0x26a0
[ 4.987189] ? do_syscall_64+0xb8/0x530
[ 4.987191] ? __x64_sys_newfstat+0x15/0x20
[ 4.987193] ? x64_sys_call+0x204a/0x26a0
[ 4.987194] ? do_syscall_64+0xb8/0x530
[ 4.987195] ? irqentry_exit_to_user_mode+0x2e/0x320
[ 4.987196] ? irqentry_exit+0x43/0x50
[ 4.987197] ? exc_page_fault+0x90/0x1b0
[ 4.987199] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 4.987200] RIP: 0033:0x739d339f774c
[ 4.987201] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
[ 4.987201] RSP: 002b:00007ffd8ca10660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 4.987202] RAX: ffffffffffffffda RBX: 0000615423195870 RCX: 0000739d339f774c
[ 4.987203] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
[ 4.987203] RBP: 00007ffd8ca10670 R08: 0000000615423196 R09: 0000000000000007
[ 4.987204] R10: 0000615423196bc0 R11: 0000000000000293 R12: 0000739d3374df88
[ 4.987204] R13: 0000000000000013 R14: 0000615423209840 R15: 0000615423194130
[ 4.987206] </TASK>
[ 4.987206] ---[ end trace 0000000000000000 ]---
[ 4.987226] ------------[ cut here ]------------
[ 4.987227] WARNING: CPU: 2 PID: 493 at drivers/gpu/drm/drm_mode_config.c:571 drm_mode_config_cleanup+0x34f/0x360
[ 4.987229] Modules linked in: qrtr bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep kvm_amd snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi kvm snd_seq btusb snd_seq_device snd_timer btmtk btrtl irqbypass polyval_clmulni btbcm snd ghash_clmulni_intel btintel aesni_intel bluetooth joydev input_leds ee1004 soundcore ccp rapl nouveau mxm_wmi drm_gpuvm gpu_sched drm_ttm_helper ttm drm_exec drm_display_helper cec rc_core i2c_piix4 video i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid igb nvme_core r8169 i2c_algo_bit nvme_keyring ahci realtek dca nvme_auth libahci hkdf wmi
[ 4.987252] CPU: 2 UID: 0 PID: 493 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
[ 4.987254] Tainted: [W]=WARN
[ 4.987255] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
[ 4.987255] RIP: 0010:drm_mode_config_cleanup+0x34f/0x360
[ 4.987257] Code: 70 60 48 c7 c7 d7 90 73 89 e8 3d bb 00 00 48 8d 7d 88 e8 c4 32 fe ff 48 85 c0 75 e2 48 8d 7d 88 e8 d6 31 fe ff e9 7b fd ff ff <0f> 0b e9 79 fe ff ff 0f 0b eb 8e e8 01 a4 65 00 90 90 90 90 90 90
[ 4.987257] RSP: 0018:ffffcdec80873a10 EFLAGS: 00010297
[ 4.987258] RAX: ffff8af053f78e48 RBX: ffff8af045e46368 RCX: 0000000000000000
[ 4.987259] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8af045e46368
[ 4.987259] RBP: ffffcdec80873a90 R08: 0000000000000000 R09: 0000000000000000
[ 4.987260] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8af045e46000
[ 4.987260] R13: ffff8af045e46390 R14: ffff8af045e46230 R15: dead000000000100
[ 4.987261] FS: 0000739d3374e000(0000) GS:ffff8aff93d73000(0000) knlGS:0000000000000000
[ 4.987262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4.987262] CR2: 0000739d2f268000 CR3: 0000000113bd6000 CR4: 0000000000f50ef0
[ 4.987263] PKRU: 55555554
[ 4.987263] Call Trace:
[ 4.987264] <TASK>
[ 4.987264] ? drm_managed_release+0xc2/0x160
[ 4.987266] drm_mode_config_init_release+0xe/0x20
[ 4.987267] drm_managed_release+0x8f/0x160
[ 4.987268] drm_minor_release+0x5f/0x90
[ 4.987269] drm_release+0xda/0x140
[ 4.987271] __fput+0xed/0x2d0
[ 4.987272] fput_close_sync+0x3d/0xa0
[ 4.987273] __x64_sys_close+0x3e/0x90
[ 4.987275] x64_sys_call+0x1b5e/0x26a0
[ 4.987276] do_syscall_64+0x80/0x530
[ 4.987278] ? x64_sys_call+0x1144/0x26a0
[ 4.987279] ? do_syscall_64+0xb8/0x530
[ 4.987281] ? from_kgid_munged+0x17/0x30
[ 4.987282] ? cp_new_stat+0x141/0x180
[ 4.987284] ? __do_sys_newfstat+0x4c/0x80
[ 4.987286] ? __x64_sys_newfstat+0x15/0x20
[ 4.987287] ? x64_sys_call+0x204a/0x26a0
[ 4.987289] ? do_syscall_64+0xb8/0x530
[ 4.987290] ? __x64_sys_newfstat+0x15/0x20
[ 4.987291] ? x64_sys_call+0x204a/0x26a0
[ 4.987293] ? do_syscall_64+0xb8/0x530
[ 4.987294] ? irqentry_exit_to_user_mode+0x2e/0x320
[ 4.987295] ? irqentry_exit+0x43/0x50
[ 4.987296] ? exc_page_fault+0x90/0x1b0
[ 4.987298] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 4.987298] RIP: 0033:0x739d339f774c
[ 4.987299] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
[ 4.987300] RSP: 002b:00007ffd8ca10660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 4.987301] RAX: ffffffffffffffda RBX: 0000615423195870 RCX: 0000739d339f774c
[ 4.987302] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
[ 4.987302] RBP: 00007ffd8ca10670 R08: 0000000615423196 R09: 0000000000000007
[ 4.987303] R10: 0000615423196bc0 R11: 0000000000000293 R12: 0000739d3374df88
[ 4.987303] R13: 0000000000000013 R14: 0000615423209840 R15: 0000615423194130
[ 4.987304] </TASK>
[ 4.987305] ---[ end trace 0000000000000000 ]---
...
[ 5.124594] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
...
[ 14.891109] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
[ 14.891114] fbcon: Taking over console
[ 14.923125] Console: switching to colour frame buffer device 240x67
[ 15.349010] workqueue: drm_fb_helper_damage_work hogged CPU for >10000us 4 times, consider switching to WQ_UNBOUND
[ 16.124537] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
[ 17.855855] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-25 20:12 ` Guenter Roeck
@ 2026-03-25 20:31 ` Maarten Lankhorst
2026-03-25 21:07 ` Guenter Roeck
0 siblings, 1 reply; 33+ messages in thread
From: Maarten Lankhorst @ 2026-03-25 20:31 UTC (permalink / raw)
To: Guenter Roeck; +Cc: dri-devel, intel-xe, Thomas Hellström
Hey,
Den 2026-03-25 kl. 21:12, skrev Guenter Roeck:
> Hi Maarten,
>
> On Wed, Mar 25, 2026 at 07:28:06PM +0100, Maarten Lankhorst wrote:
>> Hello,
>>
>> What about this patch?
>>
>> Kind regards,
>> ~Maarten Lankhorst
>>
>> ------8<---------
>> diff --git a/drivers/gpu/drm/sysfb/simpledrm.c b/drivers/gpu/drm/sysfb/simpledrm.c
>> index 0358164a623c9..ae49aaf99fb2c 100644
>> --- a/drivers/gpu/drm/sysfb/simpledrm.c
>> +++ b/drivers/gpu/drm/sysfb/simpledrm.c
>> @@ -588,6 +588,11 @@ static const struct drm_mode_config_funcs simpledrm_mode_config_funcs = {
>> * Init / Cleanup
>> */
>>
>> +static void simpledrm_shutdown(struct drm_device *dev, void *arg)
>> +{
>> + drm_atomic_helper_shutdown(dev);
>> +}
>> +
>> static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
>> struct platform_device *pdev)
>> {
>> @@ -808,6 +813,10 @@ static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
>>
>> drm_mode_config_reset(dev);
>>
>> + ret = drmm_add_action_or_reset(dev, simpledrm_shutdown, NULL);
>> + if (ret)
>> + return ERR_PTR(ret);
>> +
>> return sdev;
>> }
>>
>
> Unfortunately, this results in an exciting new set of refcount underflows.
Thank you, that's very fascinating and unexpected..
What happens if you loudly complain on fd close instead?
---------8<----
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index c8c7155319951..237ab6d606127 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -251,7 +251,7 @@ void drm_file_free(struct drm_file *file)
drm_events_release(file);
if (drm_core_check_feature(dev, DRIVER_MODESET) &&
- drm_dev_enter(dev, &idx)) {
+ !WARN_ON(!drm_dev_enter(dev, &idx))) {
drm_fb_release(file);
drm_property_destroy_user_blobs(dev, file);
drm_dev_exit(idx);
---------------
> Guenter
>
> ---
> [ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 12:10:19 PDT 2026
> [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.18.20-spi+ root=UUID=ce436484-f920-47a8-a8c4-c17ff3a877e8 ro quiet splash amdgpu.gpu_recovery=1 amdgpu.ppfeaturemask=0xfff73fff vt.handoff=7
> ...
> [ 3.806644] nouveau 0000:2b:00.0: NVIDIA GK208B (b060b0b1)
> ...
> [ 4.644370] nouveau 0000:2b:00.0: drm: VRAM: 2048 MiB
> [ 4.644373] nouveau 0000:2b:00.0: drm: GART: 1048576 MiB
> [ 4.644375] nouveau 0000:2b:00.0: drm: TMDS table version 2.0
> [ 4.645032] nouveau 0000:2b:00.0: drm: MM: using COPY for buffer copies
> [ 4.645959] snd_hda_intel 0000:2b:00.1: bound 0000:2b:00.0 (ops nv50_audio_component_bind_ops [nouveau])
> [ 4.647016] nouveau 0000:2b:00.0: [drm] Registered 4 planes with drm panic
> [ 4.647019] [drm] Initialized nouveau 1.4.0 for 0000:2b:00.0 on minor 1
> ...
> [ 4.728390] fbcon: nouveaudrmfb (fb0) is primary device
> [ 4.728392] fbcon: Deferring console take-over
> [ 4.728393] nouveau 0000:2b:00.0: [drm] fb0: nouveaudrmfb frame buffer device
> [ 4.826620] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
> ...
> [ 4.986925] ------------[ cut here ]------------
> [ 4.986926] refcount_t: addition on 0; use-after-free.
> [ 4.986933] WARNING: CPU: 2 PID: 493 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x150
> [ 4.986938] Modules linked in: qrtr bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep kvm_amd snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi kvm snd_seq btusb snd_seq_device snd_timer btmtk btrtl irqbypass polyval_clmulni btbcm snd ghash_clmulni_intel btintel aesni_intel bluetooth joydev input_leds ee1004 soundcore ccp rapl nouveau mxm_wmi drm_gpuvm gpu_sched drm_ttm_helper ttm drm_exec drm_display_helper cec rc_core i2c_piix4 video i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid igb nvme_core r8169 i2c_algo_bit nvme_keyring ahci realtek dca nvme_auth libahci hkdf wmi
> [ 4.986973] CPU: 2 UID: 0 PID: 493 Comm: plymouthd Not tainted 6.18.20-spi+ #1 PREEMPT(full)
> [ 4.986974] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 4.986975] RIP: 0010:refcount_warn_saturate+0x12e/0x150
> [ 4.986977] Code: 1d 28 43 ec 01 80 fb 01 0f 87 fe 61 6c ff 83 e3 01 0f 85 52 ff ff ff 48 c7 c7 18 a3 66 89 c6 05 08 43 ec 01 01 e8 a2 76 80 ff <0f> 0b e9 38 ff ff ff 48 c7 c7 f0 a2 66 89 c6 05 ef 42 ec 01 01 e8
> [ 4.986978] RSP: 0018:ffffcdec80873990 EFLAGS: 00010246
> [ 4.986979] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> [ 4.986979] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 4.986980] RBP: ffffcdec80873998 R08: 0000000000000000 R09: 0000000000000000
> [ 4.986980] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8af0493f7c80
> [ 4.986981] R13: ffff8af0493f7c80 R14: ffff8af04085e740 R15: dead000000000100
> [ 4.986982] FS: 0000739d3374e000(0000) GS:ffff8aff93d73000(0000) knlGS:0000000000000000
> [ 4.986983] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 4.986983] CR2: 0000739d2f268000 CR3: 0000000113bd6000 CR4: 0000000000f50ef0
> [ 4.986984] PKRU: 55555554
> [ 4.986984] Call Trace:
> [ 4.986985] <TASK>
> [ 4.986987] drm_dev_get+0x53/0x80
> [ 4.986989] drm_atomic_state_init+0x7b/0xe0
> [ 4.986991] drm_atomic_state_alloc+0x98/0xb0
> [ 4.986992] drm_atomic_helper_disable_all+0x1d/0x1c0
> [ 4.986994] drm_atomic_helper_shutdown+0x9c/0x140
> [ 4.986995] simpledrm_shutdown+0xe/0x20
> [ 4.986997] drm_managed_release+0x8f/0x160
> [ 4.986999] drm_minor_release+0x5f/0x90
> [ 4.987000] drm_release+0xda/0x140
> [ 4.987001] __fput+0xed/0x2d0
> [ 4.987010] fput_close_sync+0x3d/0xa0
> [ 4.987012] __x64_sys_close+0x3e/0x90
> [ 4.987015] x64_sys_call+0x1b5e/0x26a0
> [ 4.987019] do_syscall_64+0x80/0x530
> [ 4.987022] ? x64_sys_call+0x1144/0x26a0
> [ 4.987024] ? do_syscall_64+0xb8/0x530
> [ 4.987025] ? from_kgid_munged+0x17/0x30
> [ 4.987028] ? cp_new_stat+0x141/0x180
> [ 4.987030] ? __do_sys_newfstat+0x4c/0x80
> [ 4.987032] ? __x64_sys_newfstat+0x15/0x20
> [ 4.987034] ? x64_sys_call+0x204a/0x26a0
> [ 4.987035] ? do_syscall_64+0xb8/0x530
> [ 4.987037] ? __x64_sys_newfstat+0x15/0x20
> [ 4.987038] ? x64_sys_call+0x204a/0x26a0
> [ 4.987040] ? do_syscall_64+0xb8/0x530
> [ 4.987041] ? irqentry_exit_to_user_mode+0x2e/0x320
> [ 4.987043] ? irqentry_exit+0x43/0x50
> [ 4.987044] ? exc_page_fault+0x90/0x1b0
> [ 4.987046] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 4.987047] RIP: 0033:0x739d339f774c
> [ 4.987048] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 4.987049] RSP: 002b:00007ffd8ca10660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 4.987050] RAX: ffffffffffffffda RBX: 0000615423195870 RCX: 0000739d339f774c
> [ 4.987051] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 4.987052] RBP: 00007ffd8ca10670 R08: 0000000615423196 R09: 0000000000000007
> [ 4.987053] R10: 0000615423196bc0 R11: 0000000000000293 R12: 0000739d3374df88
> [ 4.987055] R13: 0000000000000013 R14: 0000615423209840 R15: 0000615423194130
> [ 4.987057] </TASK>
> [ 4.987058] ---[ end trace 0000000000000000 ]---
> [ 4.987114] ------------[ cut here ]------------
> [ 4.987115] refcount_t: underflow; use-after-free.
> [ 4.987119] WARNING: CPU: 2 PID: 493 at lib/refcount.c:28 refcount_warn_saturate+0xfb/0x150
> [ 4.987121] Modules linked in: qrtr bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep kvm_amd snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi kvm snd_seq btusb snd_seq_device snd_timer btmtk btrtl irqbypass polyval_clmulni btbcm snd ghash_clmulni_intel btintel aesni_intel bluetooth joydev input_leds ee1004 soundcore ccp rapl nouveau mxm_wmi drm_gpuvm gpu_sched drm_ttm_helper ttm drm_exec drm_display_helper cec rc_core i2c_piix4 video i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid igb nvme_core r8169 i2c_algo_bit nvme_keyring ahci realtek dca nvme_auth libahci hkdf wmi
> [ 4.987147] CPU: 2 UID: 0 PID: 493 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 4.987149] Tainted: [W]=WARN
> [ 4.987149] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 4.987150] RIP: 0010:refcount_warn_saturate+0xfb/0x150
> [ 4.987151] Code: eb 9a 0f b6 1d 56 43 ec 01 80 fb 01 0f 87 41 62 6c ff 83 e3 01 75 85 48 c7 c7 48 a3 66 89 c6 05 3a 43 ec 01 01 e8 d5 76 80 ff <0f> 0b e9 6b ff ff ff 0f b6 1d 28 43 ec 01 80 fb 01 0f 87 fe 61 6c
> [ 4.987152] RSP: 0018:ffffcdec808739b0 EFLAGS: 00010246
> [ 4.987153] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> [ 4.987154] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 4.987154] RBP: ffffcdec808739b8 R08: 0000000000000000 R09: 0000000000000000
> [ 4.987155] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8af045e46000
> [ 4.987155] R13: ffff8af042b0ba00 R14: ffff8af04085e740 R15: dead000000000100
> [ 4.987156] FS: 0000739d3374e000(0000) GS:ffff8aff93d73000(0000) knlGS:0000000000000000
> [ 4.987157] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 4.987158] CR2: 0000739d2f268000 CR3: 0000000113bd6000 CR4: 0000000000f50ef0
> [ 4.987159] PKRU: 55555554
> [ 4.987159] Call Trace:
> [ 4.987159] <TASK>
> [ 4.987160] drm_dev_put+0x8c/0x90
> [ 4.987162] __drm_atomic_state_free+0xbe/0xe0
> [ 4.987163] drm_atomic_helper_disable_all+0xd0/0x1c0
> [ 4.987164] drm_atomic_helper_shutdown+0x9c/0x140
> [ 4.987165] simpledrm_shutdown+0xe/0x20
> [ 4.987167] drm_managed_release+0x8f/0x160
> [ 4.987168] drm_minor_release+0x5f/0x90
> [ 4.987169] drm_release+0xda/0x140
> [ 4.987171] __fput+0xed/0x2d0
> [ 4.987172] fput_close_sync+0x3d/0xa0
> [ 4.987174] __x64_sys_close+0x3e/0x90
> [ 4.987175] x64_sys_call+0x1b5e/0x26a0
> [ 4.987177] do_syscall_64+0x80/0x530
> [ 4.987178] ? x64_sys_call+0x1144/0x26a0
> [ 4.987180] ? do_syscall_64+0xb8/0x530
> [ 4.987182] ? from_kgid_munged+0x17/0x30
> [ 4.987183] ? cp_new_stat+0x141/0x180
> [ 4.987185] ? __do_sys_newfstat+0x4c/0x80
> [ 4.987187] ? __x64_sys_newfstat+0x15/0x20
> [ 4.987188] ? x64_sys_call+0x204a/0x26a0
> [ 4.987189] ? do_syscall_64+0xb8/0x530
> [ 4.987191] ? __x64_sys_newfstat+0x15/0x20
> [ 4.987193] ? x64_sys_call+0x204a/0x26a0
> [ 4.987194] ? do_syscall_64+0xb8/0x530
> [ 4.987195] ? irqentry_exit_to_user_mode+0x2e/0x320
> [ 4.987196] ? irqentry_exit+0x43/0x50
> [ 4.987197] ? exc_page_fault+0x90/0x1b0
> [ 4.987199] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 4.987200] RIP: 0033:0x739d339f774c
> [ 4.987201] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 4.987201] RSP: 002b:00007ffd8ca10660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 4.987202] RAX: ffffffffffffffda RBX: 0000615423195870 RCX: 0000739d339f774c
> [ 4.987203] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 4.987203] RBP: 00007ffd8ca10670 R08: 0000000615423196 R09: 0000000000000007
> [ 4.987204] R10: 0000615423196bc0 R11: 0000000000000293 R12: 0000739d3374df88
> [ 4.987204] R13: 0000000000000013 R14: 0000615423209840 R15: 0000615423194130
> [ 4.987206] </TASK>
> [ 4.987206] ---[ end trace 0000000000000000 ]---
> [ 4.987226] ------------[ cut here ]------------
> [ 4.987227] WARNING: CPU: 2 PID: 493 at drivers/gpu/drm/drm_mode_config.c:571 drm_mode_config_cleanup+0x34f/0x360
> [ 4.987229] Modules linked in: qrtr bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep kvm_amd snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi kvm snd_seq btusb snd_seq_device snd_timer btmtk btrtl irqbypass polyval_clmulni btbcm snd ghash_clmulni_intel btintel aesni_intel bluetooth joydev input_leds ee1004 soundcore ccp rapl nouveau mxm_wmi drm_gpuvm gpu_sched drm_ttm_helper ttm drm_exec drm_display_helper cec rc_core i2c_piix4 video i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid igb nvme_core r8169 i2c_algo_bit nvme_keyring ahci realtek dca nvme_auth libahci hkdf wmi
> [ 4.987252] CPU: 2 UID: 0 PID: 493 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 4.987254] Tainted: [W]=WARN
> [ 4.987255] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 4.987255] RIP: 0010:drm_mode_config_cleanup+0x34f/0x360
> [ 4.987257] Code: 70 60 48 c7 c7 d7 90 73 89 e8 3d bb 00 00 48 8d 7d 88 e8 c4 32 fe ff 48 85 c0 75 e2 48 8d 7d 88 e8 d6 31 fe ff e9 7b fd ff ff <0f> 0b e9 79 fe ff ff 0f 0b eb 8e e8 01 a4 65 00 90 90 90 90 90 90
> [ 4.987257] RSP: 0018:ffffcdec80873a10 EFLAGS: 00010297
> [ 4.987258] RAX: ffff8af053f78e48 RBX: ffff8af045e46368 RCX: 0000000000000000
> [ 4.987259] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8af045e46368
> [ 4.987259] RBP: ffffcdec80873a90 R08: 0000000000000000 R09: 0000000000000000
> [ 4.987260] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8af045e46000
> [ 4.987260] R13: ffff8af045e46390 R14: ffff8af045e46230 R15: dead000000000100
> [ 4.987261] FS: 0000739d3374e000(0000) GS:ffff8aff93d73000(0000) knlGS:0000000000000000
> [ 4.987262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 4.987262] CR2: 0000739d2f268000 CR3: 0000000113bd6000 CR4: 0000000000f50ef0
> [ 4.987263] PKRU: 55555554
> [ 4.987263] Call Trace:
> [ 4.987264] <TASK>
> [ 4.987264] ? drm_managed_release+0xc2/0x160
> [ 4.987266] drm_mode_config_init_release+0xe/0x20
> [ 4.987267] drm_managed_release+0x8f/0x160
> [ 4.987268] drm_minor_release+0x5f/0x90
> [ 4.987269] drm_release+0xda/0x140
> [ 4.987271] __fput+0xed/0x2d0
> [ 4.987272] fput_close_sync+0x3d/0xa0
> [ 4.987273] __x64_sys_close+0x3e/0x90
> [ 4.987275] x64_sys_call+0x1b5e/0x26a0
> [ 4.987276] do_syscall_64+0x80/0x530
> [ 4.987278] ? x64_sys_call+0x1144/0x26a0
> [ 4.987279] ? do_syscall_64+0xb8/0x530
> [ 4.987281] ? from_kgid_munged+0x17/0x30
> [ 4.987282] ? cp_new_stat+0x141/0x180
> [ 4.987284] ? __do_sys_newfstat+0x4c/0x80
> [ 4.987286] ? __x64_sys_newfstat+0x15/0x20
> [ 4.987287] ? x64_sys_call+0x204a/0x26a0
> [ 4.987289] ? do_syscall_64+0xb8/0x530
> [ 4.987290] ? __x64_sys_newfstat+0x15/0x20
> [ 4.987291] ? x64_sys_call+0x204a/0x26a0
> [ 4.987293] ? do_syscall_64+0xb8/0x530
> [ 4.987294] ? irqentry_exit_to_user_mode+0x2e/0x320
> [ 4.987295] ? irqentry_exit+0x43/0x50
> [ 4.987296] ? exc_page_fault+0x90/0x1b0
> [ 4.987298] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 4.987298] RIP: 0033:0x739d339f774c
> [ 4.987299] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 4.987300] RSP: 002b:00007ffd8ca10660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 4.987301] RAX: ffffffffffffffda RBX: 0000615423195870 RCX: 0000739d339f774c
> [ 4.987302] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 4.987302] RBP: 00007ffd8ca10670 R08: 0000000615423196 R09: 0000000000000007
> [ 4.987303] R10: 0000615423196bc0 R11: 0000000000000293 R12: 0000739d3374df88
> [ 4.987303] R13: 0000000000000013 R14: 0000615423209840 R15: 0000615423194130
> [ 4.987304] </TASK>
> [ 4.987305] ---[ end trace 0000000000000000 ]---
> ...
> [ 5.124594] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
> ...
> [ 14.891109] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
> [ 14.891114] fbcon: Taking over console
> [ 14.923125] Console: switching to colour frame buffer device 240x67
> [ 15.349010] workqueue: drm_fb_helper_damage_work hogged CPU for >10000us 4 times, consider switching to WQ_UNBOUND
> [ 16.124537] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
> [ 17.855855] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
^ permalink raw reply related [flat|nested] 33+ messages in thread
* ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev4)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (7 preceding siblings ...)
2026-03-25 19:29 ` ✓ Xe.CI.BAT: " Patchwork
@ 2026-03-25 20:35 ` Patchwork
2026-03-25 20:37 ` ✓ CI.KUnit: success " Patchwork
` (6 subsequent siblings)
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-25 20:35 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev4)
URL : https://patchwork.freedesktop.org/series/162134/
State : warning
== Summary ==
+ KERNEL=/kernel
+ git clone https://gitlab.freedesktop.org/drm/maintainer-tools mt
Cloning into 'mt'...
warning: redirecting to https://gitlab.freedesktop.org/drm/maintainer-tools.git/
+ git -C mt rev-list -n1 origin/master
1f57ba1afceae32108bd24770069f764d940a0e4
+ cd /kernel
+ git config --global --add safe.directory /kernel
+ git log -n1
commit 417dbb9b98cbc1179c1024e149ad8d51239ba781
Author: Maarten Lankhorst <dev@lankhorst.se>
Date: Wed Mar 25 21:31:00 2026 +0100
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
Hey,
Den 2026-03-25 kl. 21:12, skrev Guenter Roeck:
> Hi Maarten,
>
> On Wed, Mar 25, 2026 at 07:28:06PM +0100, Maarten Lankhorst wrote:
>> Hello,
>>
>> What about this patch?
>>
>> Kind regards,
>> ~Maarten Lankhorst
>>
>> ------8<---------
>> diff --git a/drivers/gpu/drm/sysfb/simpledrm.c b/drivers/gpu/drm/sysfb/simpledrm.c
>> index 0358164a623c9..ae49aaf99fb2c 100644
>> --- a/drivers/gpu/drm/sysfb/simpledrm.c
>> +++ b/drivers/gpu/drm/sysfb/simpledrm.c
>> @@ -588,6 +588,11 @@ static const struct drm_mode_config_funcs simpledrm_mode_config_funcs = {
>> * Init / Cleanup
>> */
>>
>> +static void simpledrm_shutdown(struct drm_device *dev, void *arg)
>> +{
>> + drm_atomic_helper_shutdown(dev);
>> +}
>> +
>> static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
>> struct platform_device *pdev)
>> {
>> @@ -808,6 +813,10 @@ static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
>>
>> drm_mode_config_reset(dev);
>>
>> + ret = drmm_add_action_or_reset(dev, simpledrm_shutdown, NULL);
>> + if (ret)
>> + return ERR_PTR(ret);
>> +
>> return sdev;
>> }
>>
>
> Unfortunately, this results in an exciting new set of refcount underflows.
Thank you, that's very fascinating and unexpected..
What happens if you loudly complain on fd close instead?
---------8<----
---------------
> Guenter
>
> ---
> [ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 12:10:19 PDT 2026
> [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.18.20-spi+ root=UUID=ce436484-f920-47a8-a8c4-c17ff3a877e8 ro quiet splash amdgpu.gpu_recovery=1 amdgpu.ppfeaturemask=0xfff73fff vt.handoff=7
> ...
> [ 3.806644] nouveau 0000:2b:00.0: NVIDIA GK208B (b060b0b1)
> ...
> [ 4.644370] nouveau 0000:2b:00.0: drm: VRAM: 2048 MiB
> [ 4.644373] nouveau 0000:2b:00.0: drm: GART: 1048576 MiB
> [ 4.644375] nouveau 0000:2b:00.0: drm: TMDS table version 2.0
> [ 4.645032] nouveau 0000:2b:00.0: drm: MM: using COPY for buffer copies
> [ 4.645959] snd_hda_intel 0000:2b:00.1: bound 0000:2b:00.0 (ops nv50_audio_component_bind_ops [nouveau])
> [ 4.647016] nouveau 0000:2b:00.0: [drm] Registered 4 planes with drm panic
> [ 4.647019] [drm] Initialized nouveau 1.4.0 for 0000:2b:00.0 on minor 1
> ...
> [ 4.728390] fbcon: nouveaudrmfb (fb0) is primary device
> [ 4.728392] fbcon: Deferring console take-over
> [ 4.728393] nouveau 0000:2b:00.0: [drm] fb0: nouveaudrmfb frame buffer device
> [ 4.826620] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
> ...
> [ 4.986925] ------------[ cut here ]------------
> [ 4.986926] refcount_t: addition on 0; use-after-free.
> [ 4.986933] WARNING: CPU: 2 PID: 493 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x150
> [ 4.986938] Modules linked in: qrtr bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep kvm_amd snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi kvm snd_seq btusb snd_seq_device snd_timer btmtk btrtl irqbypass polyval_clmulni btbcm snd ghash_clmulni_intel btintel aesni_intel bluetooth joydev input_leds ee1004 soundcore ccp rapl nouveau mxm_wmi drm_gpuvm gpu_sched drm_ttm_helper ttm drm_exec drm_display_helper cec rc_core i2c_piix4 video i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid igb nvme_core r8169 i2c_algo_bit nvme_keyring ahci realtek dca nvme_auth libahci hkdf wmi
> [ 4.986973] CPU: 2 UID: 0 PID: 493 Comm: plymouthd Not tainted 6.18.20-spi+ #1 PREEMPT(full)
> [ 4.986974] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 4.986975] RIP: 0010:refcount_warn_saturate+0x12e/0x150
> [ 4.986977] Code: 1d 28 43 ec 01 80 fb 01 0f 87 fe 61 6c ff 83 e3 01 0f 85 52 ff ff ff 48 c7 c7 18 a3 66 89 c6 05 08 43 ec 01 01 e8 a2 76 80 ff <0f> 0b e9 38 ff ff ff 48 c7 c7 f0 a2 66 89 c6 05 ef 42 ec 01 01 e8
> [ 4.986978] RSP: 0018:ffffcdec80873990 EFLAGS: 00010246
> [ 4.986979] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> [ 4.986979] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 4.986980] RBP: ffffcdec80873998 R08: 0000000000000000 R09: 0000000000000000
> [ 4.986980] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8af0493f7c80
> [ 4.986981] R13: ffff8af0493f7c80 R14: ffff8af04085e740 R15: dead000000000100
> [ 4.986982] FS: 0000739d3374e000(0000) GS:ffff8aff93d73000(0000) knlGS:0000000000000000
> [ 4.986983] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 4.986983] CR2: 0000739d2f268000 CR3: 0000000113bd6000 CR4: 0000000000f50ef0
> [ 4.986984] PKRU: 55555554
> [ 4.986984] Call Trace:
> [ 4.986985] <TASK>
> [ 4.986987] drm_dev_get+0x53/0x80
> [ 4.986989] drm_atomic_state_init+0x7b/0xe0
> [ 4.986991] drm_atomic_state_alloc+0x98/0xb0
> [ 4.986992] drm_atomic_helper_disable_all+0x1d/0x1c0
> [ 4.986994] drm_atomic_helper_shutdown+0x9c/0x140
> [ 4.986995] simpledrm_shutdown+0xe/0x20
> [ 4.986997] drm_managed_release+0x8f/0x160
> [ 4.986999] drm_minor_release+0x5f/0x90
> [ 4.987000] drm_release+0xda/0x140
> [ 4.987001] __fput+0xed/0x2d0
> [ 4.987010] fput_close_sync+0x3d/0xa0
> [ 4.987012] __x64_sys_close+0x3e/0x90
> [ 4.987015] x64_sys_call+0x1b5e/0x26a0
> [ 4.987019] do_syscall_64+0x80/0x530
> [ 4.987022] ? x64_sys_call+0x1144/0x26a0
> [ 4.987024] ? do_syscall_64+0xb8/0x530
> [ 4.987025] ? from_kgid_munged+0x17/0x30
> [ 4.987028] ? cp_new_stat+0x141/0x180
> [ 4.987030] ? __do_sys_newfstat+0x4c/0x80
> [ 4.987032] ? __x64_sys_newfstat+0x15/0x20
> [ 4.987034] ? x64_sys_call+0x204a/0x26a0
> [ 4.987035] ? do_syscall_64+0xb8/0x530
> [ 4.987037] ? __x64_sys_newfstat+0x15/0x20
> [ 4.987038] ? x64_sys_call+0x204a/0x26a0
> [ 4.987040] ? do_syscall_64+0xb8/0x530
> [ 4.987041] ? irqentry_exit_to_user_mode+0x2e/0x320
> [ 4.987043] ? irqentry_exit+0x43/0x50
> [ 4.987044] ? exc_page_fault+0x90/0x1b0
> [ 4.987046] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 4.987047] RIP: 0033:0x739d339f774c
> [ 4.987048] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 4.987049] RSP: 002b:00007ffd8ca10660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 4.987050] RAX: ffffffffffffffda RBX: 0000615423195870 RCX: 0000739d339f774c
> [ 4.987051] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 4.987052] RBP: 00007ffd8ca10670 R08: 0000000615423196 R09: 0000000000000007
> [ 4.987053] R10: 0000615423196bc0 R11: 0000000000000293 R12: 0000739d3374df88
> [ 4.987055] R13: 0000000000000013 R14: 0000615423209840 R15: 0000615423194130
> [ 4.987057] </TASK>
> [ 4.987058] ---[ end trace 0000000000000000 ]---
> [ 4.987114] ------------[ cut here ]------------
> [ 4.987115] refcount_t: underflow; use-after-free.
> [ 4.987119] WARNING: CPU: 2 PID: 493 at lib/refcount.c:28 refcount_warn_saturate+0xfb/0x150
> [ 4.987121] Modules linked in: qrtr bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep kvm_amd snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi kvm snd_seq btusb snd_seq_device snd_timer btmtk btrtl irqbypass polyval_clmulni btbcm snd ghash_clmulni_intel btintel aesni_intel bluetooth joydev input_leds ee1004 soundcore ccp rapl nouveau mxm_wmi drm_gpuvm gpu_sched drm_ttm_helper ttm drm_exec drm_display_helper cec rc_core i2c_piix4 video i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid igb nvme_core r8169 i2c_algo_bit nvme_keyring ahci realtek dca nvme_auth libahci hkdf wmi
> [ 4.987147] CPU: 2 UID: 0 PID: 493 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 4.987149] Tainted: [W]=WARN
> [ 4.987149] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 4.987150] RIP: 0010:refcount_warn_saturate+0xfb/0x150
> [ 4.987151] Code: eb 9a 0f b6 1d 56 43 ec 01 80 fb 01 0f 87 41 62 6c ff 83 e3 01 75 85 48 c7 c7 48 a3 66 89 c6 05 3a 43 ec 01 01 e8 d5 76 80 ff <0f> 0b e9 6b ff ff ff 0f b6 1d 28 43 ec 01 80 fb 01 0f 87 fe 61 6c
> [ 4.987152] RSP: 0018:ffffcdec808739b0 EFLAGS: 00010246
> [ 4.987153] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> [ 4.987154] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 4.987154] RBP: ffffcdec808739b8 R08: 0000000000000000 R09: 0000000000000000
> [ 4.987155] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8af045e46000
> [ 4.987155] R13: ffff8af042b0ba00 R14: ffff8af04085e740 R15: dead000000000100
> [ 4.987156] FS: 0000739d3374e000(0000) GS:ffff8aff93d73000(0000) knlGS:0000000000000000
> [ 4.987157] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 4.987158] CR2: 0000739d2f268000 CR3: 0000000113bd6000 CR4: 0000000000f50ef0
> [ 4.987159] PKRU: 55555554
> [ 4.987159] Call Trace:
> [ 4.987159] <TASK>
> [ 4.987160] drm_dev_put+0x8c/0x90
> [ 4.987162] __drm_atomic_state_free+0xbe/0xe0
> [ 4.987163] drm_atomic_helper_disable_all+0xd0/0x1c0
> [ 4.987164] drm_atomic_helper_shutdown+0x9c/0x140
> [ 4.987165] simpledrm_shutdown+0xe/0x20
> [ 4.987167] drm_managed_release+0x8f/0x160
> [ 4.987168] drm_minor_release+0x5f/0x90
> [ 4.987169] drm_release+0xda/0x140
> [ 4.987171] __fput+0xed/0x2d0
> [ 4.987172] fput_close_sync+0x3d/0xa0
> [ 4.987174] __x64_sys_close+0x3e/0x90
> [ 4.987175] x64_sys_call+0x1b5e/0x26a0
> [ 4.987177] do_syscall_64+0x80/0x530
> [ 4.987178] ? x64_sys_call+0x1144/0x26a0
> [ 4.987180] ? do_syscall_64+0xb8/0x530
> [ 4.987182] ? from_kgid_munged+0x17/0x30
> [ 4.987183] ? cp_new_stat+0x141/0x180
> [ 4.987185] ? __do_sys_newfstat+0x4c/0x80
> [ 4.987187] ? __x64_sys_newfstat+0x15/0x20
> [ 4.987188] ? x64_sys_call+0x204a/0x26a0
> [ 4.987189] ? do_syscall_64+0xb8/0x530
> [ 4.987191] ? __x64_sys_newfstat+0x15/0x20
> [ 4.987193] ? x64_sys_call+0x204a/0x26a0
> [ 4.987194] ? do_syscall_64+0xb8/0x530
> [ 4.987195] ? irqentry_exit_to_user_mode+0x2e/0x320
> [ 4.987196] ? irqentry_exit+0x43/0x50
> [ 4.987197] ? exc_page_fault+0x90/0x1b0
> [ 4.987199] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 4.987200] RIP: 0033:0x739d339f774c
> [ 4.987201] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 4.987201] RSP: 002b:00007ffd8ca10660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 4.987202] RAX: ffffffffffffffda RBX: 0000615423195870 RCX: 0000739d339f774c
> [ 4.987203] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 4.987203] RBP: 00007ffd8ca10670 R08: 0000000615423196 R09: 0000000000000007
> [ 4.987204] R10: 0000615423196bc0 R11: 0000000000000293 R12: 0000739d3374df88
> [ 4.987204] R13: 0000000000000013 R14: 0000615423209840 R15: 0000615423194130
> [ 4.987206] </TASK>
> [ 4.987206] ---[ end trace 0000000000000000 ]---
> [ 4.987226] ------------[ cut here ]------------
> [ 4.987227] WARNING: CPU: 2 PID: 493 at drivers/gpu/drm/drm_mode_config.c:571 drm_mode_config_cleanup+0x34f/0x360
> [ 4.987229] Modules linked in: qrtr bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep kvm_amd snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi kvm snd_seq btusb snd_seq_device snd_timer btmtk btrtl irqbypass polyval_clmulni btbcm snd ghash_clmulni_intel btintel aesni_intel bluetooth joydev input_leds ee1004 soundcore ccp rapl nouveau mxm_wmi drm_gpuvm gpu_sched drm_ttm_helper ttm drm_exec drm_display_helper cec rc_core i2c_piix4 video i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid igb nvme_core r8169 i2c_algo_bit nvme_keyring ahci realtek dca nvme_auth libahci hkdf wmi
> [ 4.987252] CPU: 2 UID: 0 PID: 493 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 4.987254] Tainted: [W]=WARN
> [ 4.987255] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 4.987255] RIP: 0010:drm_mode_config_cleanup+0x34f/0x360
> [ 4.987257] Code: 70 60 48 c7 c7 d7 90 73 89 e8 3d bb 00 00 48 8d 7d 88 e8 c4 32 fe ff 48 85 c0 75 e2 48 8d 7d 88 e8 d6 31 fe ff e9 7b fd ff ff <0f> 0b e9 79 fe ff ff 0f 0b eb 8e e8 01 a4 65 00 90 90 90 90 90 90
> [ 4.987257] RSP: 0018:ffffcdec80873a10 EFLAGS: 00010297
> [ 4.987258] RAX: ffff8af053f78e48 RBX: ffff8af045e46368 RCX: 0000000000000000
> [ 4.987259] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8af045e46368
> [ 4.987259] RBP: ffffcdec80873a90 R08: 0000000000000000 R09: 0000000000000000
> [ 4.987260] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8af045e46000
> [ 4.987260] R13: ffff8af045e46390 R14: ffff8af045e46230 R15: dead000000000100
> [ 4.987261] FS: 0000739d3374e000(0000) GS:ffff8aff93d73000(0000) knlGS:0000000000000000
> [ 4.987262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 4.987262] CR2: 0000739d2f268000 CR3: 0000000113bd6000 CR4: 0000000000f50ef0
> [ 4.987263] PKRU: 55555554
> [ 4.987263] Call Trace:
> [ 4.987264] <TASK>
> [ 4.987264] ? drm_managed_release+0xc2/0x160
> [ 4.987266] drm_mode_config_init_release+0xe/0x20
> [ 4.987267] drm_managed_release+0x8f/0x160
> [ 4.987268] drm_minor_release+0x5f/0x90
> [ 4.987269] drm_release+0xda/0x140
> [ 4.987271] __fput+0xed/0x2d0
> [ 4.987272] fput_close_sync+0x3d/0xa0
> [ 4.987273] __x64_sys_close+0x3e/0x90
> [ 4.987275] x64_sys_call+0x1b5e/0x26a0
> [ 4.987276] do_syscall_64+0x80/0x530
> [ 4.987278] ? x64_sys_call+0x1144/0x26a0
> [ 4.987279] ? do_syscall_64+0xb8/0x530
> [ 4.987281] ? from_kgid_munged+0x17/0x30
> [ 4.987282] ? cp_new_stat+0x141/0x180
> [ 4.987284] ? __do_sys_newfstat+0x4c/0x80
> [ 4.987286] ? __x64_sys_newfstat+0x15/0x20
> [ 4.987287] ? x64_sys_call+0x204a/0x26a0
> [ 4.987289] ? do_syscall_64+0xb8/0x530
> [ 4.987290] ? __x64_sys_newfstat+0x15/0x20
> [ 4.987291] ? x64_sys_call+0x204a/0x26a0
> [ 4.987293] ? do_syscall_64+0xb8/0x530
> [ 4.987294] ? irqentry_exit_to_user_mode+0x2e/0x320
> [ 4.987295] ? irqentry_exit+0x43/0x50
> [ 4.987296] ? exc_page_fault+0x90/0x1b0
> [ 4.987298] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 4.987298] RIP: 0033:0x739d339f774c
> [ 4.987299] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 4.987300] RSP: 002b:00007ffd8ca10660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 4.987301] RAX: ffffffffffffffda RBX: 0000615423195870 RCX: 0000739d339f774c
> [ 4.987302] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 4.987302] RBP: 00007ffd8ca10670 R08: 0000000615423196 R09: 0000000000000007
> [ 4.987303] R10: 0000615423196bc0 R11: 0000000000000293 R12: 0000739d3374df88
> [ 4.987303] R13: 0000000000000013 R14: 0000615423209840 R15: 0000615423194130
> [ 4.987304] </TASK>
> [ 4.987305] ---[ end trace 0000000000000000 ]---
> ...
> [ 5.124594] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
> ...
> [ 14.891109] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
> [ 14.891114] fbcon: Taking over console
> [ 14.923125] Console: switching to colour frame buffer device 240x67
> [ 15.349010] workqueue: drm_fb_helper_damage_work hogged CPU for >10000us 4 times, consider switching to WQ_UNBOUND
> [ 16.124537] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
> [ 17.855855] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
+ /mt/dim checkpatch ec0484d20b9f962d04a62ff1feb03676c3ce7611 drm-intel
417dbb9b98cb drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
-:21: WARNING:COMMIT_LOG_LONG_LINE: Prefer a maximum 75 chars per line (possible unwrapped commit description?)
#21:
>> diff --git a/drivers/gpu/drm/sysfb/simpledrm.c b/drivers/gpu/drm/sysfb/simpledrm.c
-:54: ERROR:BAD_COMMIT_SEPARATOR: Invalid commit separator - some tools may have problems applying this
#54:
---------8<----
-:55: ERROR:BAD_COMMIT_SEPARATOR: Invalid commit separator - some tools may have problems applying this
#55:
---------------
-:272: WARNING:MISSING_FIXES_TAG: The commit message has 'Call Trace:', perhaps it also needs a 'Fixes:' tag?
-:272: ERROR:MISSING_SIGN_OFF: Missing Signed-off-by: line(s)
total: 3 errors, 2 warnings, 0 checks, 8 lines checked
^ permalink raw reply [flat|nested] 33+ messages in thread
* ✓ CI.KUnit: success for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev4)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (8 preceding siblings ...)
2026-03-25 20:35 ` ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev4) Patchwork
@ 2026-03-25 20:37 ` Patchwork
2026-03-25 21:10 ` ✓ Xe.CI.BAT: " Patchwork
` (5 subsequent siblings)
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-25 20:37 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev4)
URL : https://patchwork.freedesktop.org/series/162134/
State : success
== Summary ==
+ trap cleanup EXIT
+ /kernel/tools/testing/kunit/kunit.py run --kunitconfig /kernel/drivers/gpu/drm/xe/.kunitconfig
[20:35:46] Configuring KUnit Kernel ...
Generating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[20:35:50] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=48
[20:36:20] Starting KUnit Kernel (1/1)...
[20:36:20] ============================================================
Running tests with:
$ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[20:36:21] ================== guc_buf (11 subtests) ===================
[20:36:21] [PASSED] test_smallest
[20:36:21] [PASSED] test_largest
[20:36:21] [PASSED] test_granular
[20:36:21] [PASSED] test_unique
[20:36:21] [PASSED] test_overlap
[20:36:21] [PASSED] test_reusable
[20:36:21] [PASSED] test_too_big
[20:36:21] [PASSED] test_flush
[20:36:21] [PASSED] test_lookup
[20:36:21] [PASSED] test_data
[20:36:21] [PASSED] test_class
[20:36:21] ===================== [PASSED] guc_buf =====================
[20:36:21] =================== guc_dbm (7 subtests) ===================
[20:36:21] [PASSED] test_empty
[20:36:21] [PASSED] test_default
[20:36:21] ======================== test_size ========================
[20:36:21] [PASSED] 4
[20:36:21] [PASSED] 8
[20:36:21] [PASSED] 32
[20:36:21] [PASSED] 256
[20:36:21] ==================== [PASSED] test_size ====================
[20:36:21] ======================= test_reuse ========================
[20:36:21] [PASSED] 4
[20:36:21] [PASSED] 8
[20:36:21] [PASSED] 32
[20:36:21] [PASSED] 256
[20:36:21] =================== [PASSED] test_reuse ====================
[20:36:21] =================== test_range_overlap ====================
[20:36:21] [PASSED] 4
[20:36:21] [PASSED] 8
[20:36:21] [PASSED] 32
[20:36:21] [PASSED] 256
[20:36:21] =============== [PASSED] test_range_overlap ================
[20:36:21] =================== test_range_compact ====================
[20:36:21] [PASSED] 4
[20:36:21] [PASSED] 8
[20:36:21] [PASSED] 32
[20:36:21] [PASSED] 256
[20:36:21] =============== [PASSED] test_range_compact ================
[20:36:21] ==================== test_range_spare =====================
[20:36:21] [PASSED] 4
[20:36:21] [PASSED] 8
[20:36:21] [PASSED] 32
[20:36:21] [PASSED] 256
[20:36:21] ================ [PASSED] test_range_spare =================
[20:36:21] ===================== [PASSED] guc_dbm =====================
[20:36:21] =================== guc_idm (6 subtests) ===================
[20:36:21] [PASSED] bad_init
[20:36:21] [PASSED] no_init
[20:36:21] [PASSED] init_fini
[20:36:21] [PASSED] check_used
[20:36:21] [PASSED] check_quota
[20:36:21] [PASSED] check_all
[20:36:21] ===================== [PASSED] guc_idm =====================
[20:36:21] ================== no_relay (3 subtests) ===================
[20:36:21] [PASSED] xe_drops_guc2pf_if_not_ready
[20:36:21] [PASSED] xe_drops_guc2vf_if_not_ready
[20:36:21] [PASSED] xe_rejects_send_if_not_ready
[20:36:21] ==================== [PASSED] no_relay =====================
[20:36:21] ================== pf_relay (14 subtests) ==================
[20:36:21] [PASSED] pf_rejects_guc2pf_too_short
[20:36:21] [PASSED] pf_rejects_guc2pf_too_long
[20:36:21] [PASSED] pf_rejects_guc2pf_no_payload
[20:36:21] [PASSED] pf_fails_no_payload
[20:36:21] [PASSED] pf_fails_bad_origin
[20:36:21] [PASSED] pf_fails_bad_type
[20:36:21] [PASSED] pf_txn_reports_error
[20:36:21] [PASSED] pf_txn_sends_pf2guc
[20:36:21] [PASSED] pf_sends_pf2guc
[20:36:21] [SKIPPED] pf_loopback_nop
[20:36:21] [SKIPPED] pf_loopback_echo
[20:36:21] [SKIPPED] pf_loopback_fail
[20:36:21] [SKIPPED] pf_loopback_busy
[20:36:21] [SKIPPED] pf_loopback_retry
[20:36:21] ==================== [PASSED] pf_relay =====================
[20:36:21] ================== vf_relay (3 subtests) ===================
[20:36:21] [PASSED] vf_rejects_guc2vf_too_short
[20:36:21] [PASSED] vf_rejects_guc2vf_too_long
[20:36:21] [PASSED] vf_rejects_guc2vf_no_payload
[20:36:21] ==================== [PASSED] vf_relay =====================
[20:36:21] ================ pf_gt_config (9 subtests) =================
[20:36:21] [PASSED] fair_contexts_1vf
[20:36:21] [PASSED] fair_doorbells_1vf
[20:36:21] [PASSED] fair_ggtt_1vf
[20:36:21] ====================== fair_vram_1vf ======================
[20:36:21] [PASSED] 3.50 GiB
[20:36:21] [PASSED] 11.5 GiB
[20:36:21] [PASSED] 15.5 GiB
[20:36:21] [PASSED] 31.5 GiB
[20:36:21] [PASSED] 63.5 GiB
[20:36:21] [PASSED] 1.91 GiB
[20:36:21] ================== [PASSED] fair_vram_1vf ==================
[20:36:21] ================ fair_vram_1vf_admin_only =================
[20:36:21] [PASSED] 3.50 GiB
[20:36:21] [PASSED] 11.5 GiB
[20:36:21] [PASSED] 15.5 GiB
[20:36:21] [PASSED] 31.5 GiB
[20:36:21] [PASSED] 63.5 GiB
[20:36:21] [PASSED] 1.91 GiB
[20:36:21] ============ [PASSED] fair_vram_1vf_admin_only =============
[20:36:21] ====================== fair_contexts ======================
[20:36:21] [PASSED] 1 VF
[20:36:21] [PASSED] 2 VFs
[20:36:21] [PASSED] 3 VFs
[20:36:21] [PASSED] 4 VFs
[20:36:21] [PASSED] 5 VFs
[20:36:21] [PASSED] 6 VFs
[20:36:21] [PASSED] 7 VFs
[20:36:21] [PASSED] 8 VFs
[20:36:21] [PASSED] 9 VFs
[20:36:21] [PASSED] 10 VFs
[20:36:21] [PASSED] 11 VFs
[20:36:21] [PASSED] 12 VFs
[20:36:21] [PASSED] 13 VFs
[20:36:21] [PASSED] 14 VFs
[20:36:21] [PASSED] 15 VFs
[20:36:21] [PASSED] 16 VFs
[20:36:21] [PASSED] 17 VFs
[20:36:21] [PASSED] 18 VFs
[20:36:21] [PASSED] 19 VFs
[20:36:21] [PASSED] 20 VFs
[20:36:21] [PASSED] 21 VFs
[20:36:21] [PASSED] 22 VFs
[20:36:21] [PASSED] 23 VFs
[20:36:21] [PASSED] 24 VFs
[20:36:21] [PASSED] 25 VFs
[20:36:21] [PASSED] 26 VFs
[20:36:21] [PASSED] 27 VFs
[20:36:21] [PASSED] 28 VFs
[20:36:21] [PASSED] 29 VFs
[20:36:21] [PASSED] 30 VFs
[20:36:21] [PASSED] 31 VFs
[20:36:21] [PASSED] 32 VFs
[20:36:21] [PASSED] 33 VFs
[20:36:21] [PASSED] 34 VFs
[20:36:21] [PASSED] 35 VFs
[20:36:21] [PASSED] 36 VFs
[20:36:21] [PASSED] 37 VFs
[20:36:21] [PASSED] 38 VFs
[20:36:21] [PASSED] 39 VFs
[20:36:21] [PASSED] 40 VFs
[20:36:21] [PASSED] 41 VFs
[20:36:21] [PASSED] 42 VFs
[20:36:21] [PASSED] 43 VFs
[20:36:21] [PASSED] 44 VFs
[20:36:21] [PASSED] 45 VFs
[20:36:21] [PASSED] 46 VFs
[20:36:21] [PASSED] 47 VFs
[20:36:21] [PASSED] 48 VFs
[20:36:21] [PASSED] 49 VFs
[20:36:21] [PASSED] 50 VFs
[20:36:21] [PASSED] 51 VFs
[20:36:21] [PASSED] 52 VFs
[20:36:21] [PASSED] 53 VFs
[20:36:21] [PASSED] 54 VFs
[20:36:21] [PASSED] 55 VFs
[20:36:21] [PASSED] 56 VFs
[20:36:21] [PASSED] 57 VFs
[20:36:21] [PASSED] 58 VFs
[20:36:21] [PASSED] 59 VFs
[20:36:21] [PASSED] 60 VFs
[20:36:21] [PASSED] 61 VFs
[20:36:21] [PASSED] 62 VFs
[20:36:21] [PASSED] 63 VFs
[20:36:21] ================== [PASSED] fair_contexts ==================
[20:36:21] ===================== fair_doorbells ======================
[20:36:21] [PASSED] 1 VF
[20:36:21] [PASSED] 2 VFs
[20:36:21] [PASSED] 3 VFs
[20:36:21] [PASSED] 4 VFs
[20:36:21] [PASSED] 5 VFs
[20:36:21] [PASSED] 6 VFs
[20:36:21] [PASSED] 7 VFs
[20:36:21] [PASSED] 8 VFs
[20:36:21] [PASSED] 9 VFs
[20:36:21] [PASSED] 10 VFs
[20:36:21] [PASSED] 11 VFs
[20:36:21] [PASSED] 12 VFs
[20:36:21] [PASSED] 13 VFs
[20:36:21] [PASSED] 14 VFs
[20:36:21] [PASSED] 15 VFs
[20:36:21] [PASSED] 16 VFs
[20:36:21] [PASSED] 17 VFs
[20:36:21] [PASSED] 18 VFs
[20:36:21] [PASSED] 19 VFs
[20:36:21] [PASSED] 20 VFs
[20:36:21] [PASSED] 21 VFs
[20:36:21] [PASSED] 22 VFs
[20:36:21] [PASSED] 23 VFs
[20:36:21] [PASSED] 24 VFs
[20:36:21] [PASSED] 25 VFs
[20:36:21] [PASSED] 26 VFs
[20:36:21] [PASSED] 27 VFs
[20:36:21] [PASSED] 28 VFs
[20:36:21] [PASSED] 29 VFs
[20:36:21] [PASSED] 30 VFs
[20:36:21] [PASSED] 31 VFs
[20:36:21] [PASSED] 32 VFs
[20:36:21] [PASSED] 33 VFs
[20:36:21] [PASSED] 34 VFs
[20:36:21] [PASSED] 35 VFs
[20:36:21] [PASSED] 36 VFs
[20:36:21] [PASSED] 37 VFs
[20:36:21] [PASSED] 38 VFs
[20:36:21] [PASSED] 39 VFs
[20:36:21] [PASSED] 40 VFs
[20:36:21] [PASSED] 41 VFs
[20:36:21] [PASSED] 42 VFs
[20:36:21] [PASSED] 43 VFs
[20:36:21] [PASSED] 44 VFs
[20:36:21] [PASSED] 45 VFs
[20:36:21] [PASSED] 46 VFs
[20:36:21] [PASSED] 47 VFs
[20:36:21] [PASSED] 48 VFs
[20:36:21] [PASSED] 49 VFs
[20:36:21] [PASSED] 50 VFs
[20:36:21] [PASSED] 51 VFs
[20:36:21] [PASSED] 52 VFs
[20:36:21] [PASSED] 53 VFs
[20:36:21] [PASSED] 54 VFs
[20:36:21] [PASSED] 55 VFs
[20:36:21] [PASSED] 56 VFs
[20:36:21] [PASSED] 57 VFs
[20:36:21] [PASSED] 58 VFs
[20:36:21] [PASSED] 59 VFs
[20:36:21] [PASSED] 60 VFs
[20:36:21] [PASSED] 61 VFs
[20:36:21] [PASSED] 62 VFs
[20:36:21] [PASSED] 63 VFs
[20:36:21] ================= [PASSED] fair_doorbells ==================
[20:36:21] ======================== fair_ggtt ========================
[20:36:21] [PASSED] 1 VF
[20:36:21] [PASSED] 2 VFs
[20:36:21] [PASSED] 3 VFs
[20:36:21] [PASSED] 4 VFs
[20:36:21] [PASSED] 5 VFs
[20:36:21] [PASSED] 6 VFs
[20:36:21] [PASSED] 7 VFs
[20:36:21] [PASSED] 8 VFs
[20:36:21] [PASSED] 9 VFs
[20:36:21] [PASSED] 10 VFs
[20:36:21] [PASSED] 11 VFs
[20:36:21] [PASSED] 12 VFs
[20:36:21] [PASSED] 13 VFs
[20:36:21] [PASSED] 14 VFs
[20:36:21] [PASSED] 15 VFs
[20:36:21] [PASSED] 16 VFs
[20:36:21] [PASSED] 17 VFs
[20:36:21] [PASSED] 18 VFs
[20:36:21] [PASSED] 19 VFs
[20:36:21] [PASSED] 20 VFs
[20:36:21] [PASSED] 21 VFs
[20:36:21] [PASSED] 22 VFs
[20:36:21] [PASSED] 23 VFs
[20:36:21] [PASSED] 24 VFs
[20:36:21] [PASSED] 25 VFs
[20:36:21] [PASSED] 26 VFs
[20:36:21] [PASSED] 27 VFs
[20:36:21] [PASSED] 28 VFs
[20:36:21] [PASSED] 29 VFs
[20:36:21] [PASSED] 30 VFs
[20:36:21] [PASSED] 31 VFs
[20:36:21] [PASSED] 32 VFs
[20:36:21] [PASSED] 33 VFs
[20:36:21] [PASSED] 34 VFs
[20:36:21] [PASSED] 35 VFs
[20:36:21] [PASSED] 36 VFs
[20:36:21] [PASSED] 37 VFs
[20:36:21] [PASSED] 38 VFs
[20:36:21] [PASSED] 39 VFs
[20:36:21] [PASSED] 40 VFs
[20:36:21] [PASSED] 41 VFs
[20:36:21] [PASSED] 42 VFs
[20:36:21] [PASSED] 43 VFs
[20:36:21] [PASSED] 44 VFs
[20:36:21] [PASSED] 45 VFs
[20:36:21] [PASSED] 46 VFs
[20:36:21] [PASSED] 47 VFs
[20:36:21] [PASSED] 48 VFs
[20:36:21] [PASSED] 49 VFs
[20:36:21] [PASSED] 50 VFs
[20:36:21] [PASSED] 51 VFs
[20:36:21] [PASSED] 52 VFs
[20:36:21] [PASSED] 53 VFs
[20:36:21] [PASSED] 54 VFs
[20:36:21] [PASSED] 55 VFs
[20:36:21] [PASSED] 56 VFs
[20:36:21] [PASSED] 57 VFs
[20:36:21] [PASSED] 58 VFs
[20:36:21] [PASSED] 59 VFs
[20:36:21] [PASSED] 60 VFs
[20:36:21] [PASSED] 61 VFs
[20:36:21] [PASSED] 62 VFs
[20:36:21] [PASSED] 63 VFs
[20:36:21] ==================== [PASSED] fair_ggtt ====================
[20:36:21] ======================== fair_vram ========================
[20:36:21] [PASSED] 1 VF
[20:36:21] [PASSED] 2 VFs
[20:36:21] [PASSED] 3 VFs
[20:36:21] [PASSED] 4 VFs
[20:36:21] [PASSED] 5 VFs
[20:36:21] [PASSED] 6 VFs
[20:36:21] [PASSED] 7 VFs
[20:36:21] [PASSED] 8 VFs
[20:36:21] [PASSED] 9 VFs
[20:36:21] [PASSED] 10 VFs
[20:36:21] [PASSED] 11 VFs
[20:36:21] [PASSED] 12 VFs
[20:36:21] [PASSED] 13 VFs
[20:36:21] [PASSED] 14 VFs
[20:36:21] [PASSED] 15 VFs
[20:36:21] [PASSED] 16 VFs
[20:36:21] [PASSED] 17 VFs
[20:36:21] [PASSED] 18 VFs
[20:36:21] [PASSED] 19 VFs
[20:36:21] [PASSED] 20 VFs
[20:36:21] [PASSED] 21 VFs
[20:36:21] [PASSED] 22 VFs
[20:36:21] [PASSED] 23 VFs
[20:36:21] [PASSED] 24 VFs
[20:36:21] [PASSED] 25 VFs
[20:36:21] [PASSED] 26 VFs
[20:36:21] [PASSED] 27 VFs
[20:36:21] [PASSED] 28 VFs
[20:36:21] [PASSED] 29 VFs
[20:36:21] [PASSED] 30 VFs
[20:36:21] [PASSED] 31 VFs
[20:36:21] [PASSED] 32 VFs
[20:36:21] [PASSED] 33 VFs
[20:36:21] [PASSED] 34 VFs
[20:36:21] [PASSED] 35 VFs
[20:36:21] [PASSED] 36 VFs
[20:36:21] [PASSED] 37 VFs
[20:36:21] [PASSED] 38 VFs
[20:36:21] [PASSED] 39 VFs
[20:36:21] [PASSED] 40 VFs
[20:36:21] [PASSED] 41 VFs
[20:36:21] [PASSED] 42 VFs
[20:36:21] [PASSED] 43 VFs
[20:36:21] [PASSED] 44 VFs
[20:36:21] [PASSED] 45 VFs
[20:36:21] [PASSED] 46 VFs
[20:36:21] [PASSED] 47 VFs
[20:36:21] [PASSED] 48 VFs
[20:36:21] [PASSED] 49 VFs
[20:36:21] [PASSED] 50 VFs
[20:36:21] [PASSED] 51 VFs
[20:36:21] [PASSED] 52 VFs
[20:36:21] [PASSED] 53 VFs
[20:36:21] [PASSED] 54 VFs
[20:36:21] [PASSED] 55 VFs
[20:36:21] [PASSED] 56 VFs
[20:36:21] [PASSED] 57 VFs
[20:36:21] [PASSED] 58 VFs
[20:36:21] [PASSED] 59 VFs
[20:36:21] [PASSED] 60 VFs
[20:36:21] [PASSED] 61 VFs
[20:36:21] [PASSED] 62 VFs
[20:36:21] [PASSED] 63 VFs
[20:36:21] ==================== [PASSED] fair_vram ====================
[20:36:21] ================== [PASSED] pf_gt_config ===================
[20:36:21] ===================== lmtt (1 subtest) =====================
[20:36:21] ======================== test_ops =========================
[20:36:21] [PASSED] 2-level
[20:36:21] [PASSED] multi-level
[20:36:21] ==================== [PASSED] test_ops =====================
[20:36:21] ====================== [PASSED] lmtt =======================
[20:36:21] ================= pf_service (11 subtests) =================
[20:36:21] [PASSED] pf_negotiate_any
[20:36:21] [PASSED] pf_negotiate_base_match
[20:36:21] [PASSED] pf_negotiate_base_newer
[20:36:21] [PASSED] pf_negotiate_base_next
[20:36:21] [SKIPPED] pf_negotiate_base_older
[20:36:21] [PASSED] pf_negotiate_base_prev
[20:36:21] [PASSED] pf_negotiate_latest_match
[20:36:21] [PASSED] pf_negotiate_latest_newer
[20:36:21] [PASSED] pf_negotiate_latest_next
[20:36:21] [SKIPPED] pf_negotiate_latest_older
[20:36:21] [SKIPPED] pf_negotiate_latest_prev
[20:36:21] =================== [PASSED] pf_service ====================
[20:36:21] ================= xe_guc_g2g (2 subtests) ==================
[20:36:21] ============== xe_live_guc_g2g_kunit_default ==============
[20:36:21] ========= [SKIPPED] xe_live_guc_g2g_kunit_default ==========
[20:36:21] ============== xe_live_guc_g2g_kunit_allmem ===============
[20:36:21] ========== [SKIPPED] xe_live_guc_g2g_kunit_allmem ==========
[20:36:21] =================== [SKIPPED] xe_guc_g2g ===================
[20:36:21] =================== xe_mocs (2 subtests) ===================
[20:36:21] ================ xe_live_mocs_kernel_kunit ================
[20:36:21] =========== [SKIPPED] xe_live_mocs_kernel_kunit ============
[20:36:21] ================ xe_live_mocs_reset_kunit =================
[20:36:21] ============ [SKIPPED] xe_live_mocs_reset_kunit ============
[20:36:21] ==================== [SKIPPED] xe_mocs =====================
[20:36:21] ================= xe_migrate (2 subtests) ==================
[20:36:21] ================= xe_migrate_sanity_kunit =================
[20:36:21] ============ [SKIPPED] xe_migrate_sanity_kunit =============
[20:36:21] ================== xe_validate_ccs_kunit ==================
[20:36:21] ============= [SKIPPED] xe_validate_ccs_kunit ==============
[20:36:21] =================== [SKIPPED] xe_migrate ===================
[20:36:21] ================== xe_dma_buf (1 subtest) ==================
[20:36:21] ==================== xe_dma_buf_kunit =====================
[20:36:21] ================ [SKIPPED] xe_dma_buf_kunit ================
[20:36:21] =================== [SKIPPED] xe_dma_buf ===================
[20:36:21] ================= xe_bo_shrink (1 subtest) =================
[20:36:21] =================== xe_bo_shrink_kunit ====================
[20:36:21] =============== [SKIPPED] xe_bo_shrink_kunit ===============
[20:36:21] ================== [SKIPPED] xe_bo_shrink ==================
[20:36:21] ==================== xe_bo (2 subtests) ====================
[20:36:21] ================== xe_ccs_migrate_kunit ===================
[20:36:21] ============== [SKIPPED] xe_ccs_migrate_kunit ==============
[20:36:21] ==================== xe_bo_evict_kunit ====================
[20:36:21] =============== [SKIPPED] xe_bo_evict_kunit ================
[20:36:21] ===================== [SKIPPED] xe_bo ======================
[20:36:21] ==================== args (13 subtests) ====================
[20:36:21] [PASSED] count_args_test
[20:36:21] [PASSED] call_args_example
[20:36:21] [PASSED] call_args_test
[20:36:21] [PASSED] drop_first_arg_example
[20:36:21] [PASSED] drop_first_arg_test
[20:36:21] [PASSED] first_arg_example
[20:36:21] [PASSED] first_arg_test
[20:36:21] [PASSED] last_arg_example
[20:36:21] [PASSED] last_arg_test
[20:36:21] [PASSED] pick_arg_example
[20:36:21] [PASSED] if_args_example
[20:36:21] [PASSED] if_args_test
[20:36:21] [PASSED] sep_comma_example
[20:36:21] ====================== [PASSED] args =======================
[20:36:21] =================== xe_pci (3 subtests) ====================
[20:36:21] ==================== check_graphics_ip ====================
[20:36:21] [PASSED] 12.00 Xe_LP
[20:36:21] [PASSED] 12.10 Xe_LP+
[20:36:21] [PASSED] 12.55 Xe_HPG
[20:36:21] [PASSED] 12.60 Xe_HPC
[20:36:21] [PASSED] 12.70 Xe_LPG
[20:36:21] [PASSED] 12.71 Xe_LPG
[20:36:21] [PASSED] 12.74 Xe_LPG+
[20:36:21] [PASSED] 20.01 Xe2_HPG
[20:36:21] [PASSED] 20.02 Xe2_HPG
[20:36:21] [PASSED] 20.04 Xe2_LPG
[20:36:21] [PASSED] 30.00 Xe3_LPG
[20:36:21] [PASSED] 30.01 Xe3_LPG
[20:36:21] [PASSED] 30.03 Xe3_LPG
[20:36:21] [PASSED] 30.04 Xe3_LPG
[20:36:21] [PASSED] 30.05 Xe3_LPG
[20:36:21] [PASSED] 35.10 Xe3p_LPG
[20:36:21] [PASSED] 35.11 Xe3p_XPC
[20:36:21] ================ [PASSED] check_graphics_ip ================
[20:36:21] ===================== check_media_ip ======================
[20:36:21] [PASSED] 12.00 Xe_M
[20:36:21] [PASSED] 12.55 Xe_HPM
[20:36:21] [PASSED] 13.00 Xe_LPM+
[20:36:21] [PASSED] 13.01 Xe2_HPM
[20:36:21] [PASSED] 20.00 Xe2_LPM
[20:36:21] [PASSED] 30.00 Xe3_LPM
[20:36:21] [PASSED] 30.02 Xe3_LPM
[20:36:21] [PASSED] 35.00 Xe3p_LPM
[20:36:21] [PASSED] 35.03 Xe3p_HPM
[20:36:21] ================= [PASSED] check_media_ip ==================
[20:36:21] =================== check_platform_desc ===================
[20:36:21] [PASSED] 0x9A60 (TIGERLAKE)
[20:36:21] [PASSED] 0x9A68 (TIGERLAKE)
[20:36:21] [PASSED] 0x9A70 (TIGERLAKE)
[20:36:21] [PASSED] 0x9A40 (TIGERLAKE)
[20:36:21] [PASSED] 0x9A49 (TIGERLAKE)
[20:36:21] [PASSED] 0x9A59 (TIGERLAKE)
[20:36:21] [PASSED] 0x9A78 (TIGERLAKE)
[20:36:21] [PASSED] 0x9AC0 (TIGERLAKE)
[20:36:21] [PASSED] 0x9AC9 (TIGERLAKE)
[20:36:21] [PASSED] 0x9AD9 (TIGERLAKE)
[20:36:21] [PASSED] 0x9AF8 (TIGERLAKE)
[20:36:21] [PASSED] 0x4C80 (ROCKETLAKE)
[20:36:21] [PASSED] 0x4C8A (ROCKETLAKE)
[20:36:21] [PASSED] 0x4C8B (ROCKETLAKE)
[20:36:21] [PASSED] 0x4C8C (ROCKETLAKE)
[20:36:21] [PASSED] 0x4C90 (ROCKETLAKE)
[20:36:21] [PASSED] 0x4C9A (ROCKETLAKE)
[20:36:21] [PASSED] 0x4680 (ALDERLAKE_S)
[20:36:21] [PASSED] 0x4682 (ALDERLAKE_S)
[20:36:21] [PASSED] 0x4688 (ALDERLAKE_S)
[20:36:21] [PASSED] 0x468A (ALDERLAKE_S)
[20:36:21] [PASSED] 0x468B (ALDERLAKE_S)
[20:36:21] [PASSED] 0x4690 (ALDERLAKE_S)
[20:36:21] [PASSED] 0x4692 (ALDERLAKE_S)
[20:36:21] [PASSED] 0x4693 (ALDERLAKE_S)
[20:36:21] [PASSED] 0x46A0 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46A1 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46A2 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46A3 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46A6 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46A8 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46AA (ALDERLAKE_P)
[20:36:21] [PASSED] 0x462A (ALDERLAKE_P)
[20:36:21] [PASSED] 0x4626 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x4628 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46B0 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46B1 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46B2 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46B3 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46C0 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46C1 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46C2 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46C3 (ALDERLAKE_P)
[20:36:21] [PASSED] 0x46D0 (ALDERLAKE_N)
[20:36:21] [PASSED] 0x46D1 (ALDERLAKE_N)
[20:36:21] [PASSED] 0x46D2 (ALDERLAKE_N)
[20:36:21] [PASSED] 0x46D3 (ALDERLAKE_N)
[20:36:21] [PASSED] 0x46D4 (ALDERLAKE_N)
[20:36:21] [PASSED] 0xA721 (ALDERLAKE_P)
[20:36:21] [PASSED] 0xA7A1 (ALDERLAKE_P)
[20:36:21] [PASSED] 0xA7A9 (ALDERLAKE_P)
[20:36:21] [PASSED] 0xA7AC (ALDERLAKE_P)
[20:36:21] [PASSED] 0xA7AD (ALDERLAKE_P)
[20:36:21] [PASSED] 0xA720 (ALDERLAKE_P)
[20:36:21] [PASSED] 0xA7A0 (ALDERLAKE_P)
[20:36:21] [PASSED] 0xA7A8 (ALDERLAKE_P)
[20:36:21] [PASSED] 0xA7AA (ALDERLAKE_P)
[20:36:21] [PASSED] 0xA7AB (ALDERLAKE_P)
[20:36:21] [PASSED] 0xA780 (ALDERLAKE_S)
[20:36:21] [PASSED] 0xA781 (ALDERLAKE_S)
[20:36:21] [PASSED] 0xA782 (ALDERLAKE_S)
[20:36:21] [PASSED] 0xA783 (ALDERLAKE_S)
[20:36:21] [PASSED] 0xA788 (ALDERLAKE_S)
[20:36:21] [PASSED] 0xA789 (ALDERLAKE_S)
[20:36:21] [PASSED] 0xA78A (ALDERLAKE_S)
[20:36:21] [PASSED] 0xA78B (ALDERLAKE_S)
[20:36:21] [PASSED] 0x4905 (DG1)
[20:36:21] [PASSED] 0x4906 (DG1)
[20:36:21] [PASSED] 0x4907 (DG1)
[20:36:21] [PASSED] 0x4908 (DG1)
[20:36:21] [PASSED] 0x4909 (DG1)
[20:36:21] [PASSED] 0x56C0 (DG2)
[20:36:21] [PASSED] 0x56C2 (DG2)
[20:36:21] [PASSED] 0x56C1 (DG2)
[20:36:21] [PASSED] 0x7D51 (METEORLAKE)
[20:36:21] [PASSED] 0x7DD1 (METEORLAKE)
[20:36:21] [PASSED] 0x7D41 (METEORLAKE)
[20:36:21] [PASSED] 0x7D67 (METEORLAKE)
[20:36:21] [PASSED] 0xB640 (METEORLAKE)
[20:36:21] [PASSED] 0x56A0 (DG2)
[20:36:21] [PASSED] 0x56A1 (DG2)
[20:36:21] [PASSED] 0x56A2 (DG2)
[20:36:21] [PASSED] 0x56BE (DG2)
[20:36:21] [PASSED] 0x56BF (DG2)
[20:36:21] [PASSED] 0x5690 (DG2)
[20:36:21] [PASSED] 0x5691 (DG2)
[20:36:21] [PASSED] 0x5692 (DG2)
[20:36:21] [PASSED] 0x56A5 (DG2)
[20:36:21] [PASSED] 0x56A6 (DG2)
[20:36:21] [PASSED] 0x56B0 (DG2)
[20:36:21] [PASSED] 0x56B1 (DG2)
[20:36:21] [PASSED] 0x56BA (DG2)
[20:36:21] [PASSED] 0x56BB (DG2)
[20:36:21] [PASSED] 0x56BC (DG2)
[20:36:21] [PASSED] 0x56BD (DG2)
[20:36:21] [PASSED] 0x5693 (DG2)
[20:36:21] [PASSED] 0x5694 (DG2)
[20:36:21] [PASSED] 0x5695 (DG2)
[20:36:21] [PASSED] 0x56A3 (DG2)
[20:36:21] [PASSED] 0x56A4 (DG2)
[20:36:21] [PASSED] 0x56B2 (DG2)
[20:36:21] [PASSED] 0x56B3 (DG2)
[20:36:21] [PASSED] 0x5696 (DG2)
[20:36:21] [PASSED] 0x5697 (DG2)
[20:36:21] [PASSED] 0xB69 (PVC)
[20:36:21] [PASSED] 0xB6E (PVC)
[20:36:21] [PASSED] 0xBD4 (PVC)
[20:36:21] [PASSED] 0xBD5 (PVC)
[20:36:21] [PASSED] 0xBD6 (PVC)
[20:36:21] [PASSED] 0xBD7 (PVC)
[20:36:21] [PASSED] 0xBD8 (PVC)
[20:36:21] [PASSED] 0xBD9 (PVC)
[20:36:21] [PASSED] 0xBDA (PVC)
[20:36:21] [PASSED] 0xBDB (PVC)
[20:36:21] [PASSED] 0xBE0 (PVC)
[20:36:21] [PASSED] 0xBE1 (PVC)
[20:36:21] [PASSED] 0xBE5 (PVC)
[20:36:21] [PASSED] 0x7D40 (METEORLAKE)
[20:36:21] [PASSED] 0x7D45 (METEORLAKE)
[20:36:21] [PASSED] 0x7D55 (METEORLAKE)
[20:36:21] [PASSED] 0x7D60 (METEORLAKE)
[20:36:21] [PASSED] 0x7DD5 (METEORLAKE)
[20:36:21] [PASSED] 0x6420 (LUNARLAKE)
[20:36:21] [PASSED] 0x64A0 (LUNARLAKE)
[20:36:21] [PASSED] 0x64B0 (LUNARLAKE)
[20:36:21] [PASSED] 0xE202 (BATTLEMAGE)
[20:36:21] [PASSED] 0xE209 (BATTLEMAGE)
[20:36:21] [PASSED] 0xE20B (BATTLEMAGE)
[20:36:21] [PASSED] 0xE20C (BATTLEMAGE)
[20:36:21] [PASSED] 0xE20D (BATTLEMAGE)
[20:36:21] [PASSED] 0xE210 (BATTLEMAGE)
[20:36:21] [PASSED] 0xE211 (BATTLEMAGE)
[20:36:21] [PASSED] 0xE212 (BATTLEMAGE)
[20:36:21] [PASSED] 0xE216 (BATTLEMAGE)
[20:36:21] [PASSED] 0xE220 (BATTLEMAGE)
[20:36:21] [PASSED] 0xE221 (BATTLEMAGE)
[20:36:21] [PASSED] 0xE222 (BATTLEMAGE)
[20:36:21] [PASSED] 0xE223 (BATTLEMAGE)
[20:36:21] [PASSED] 0xB080 (PANTHERLAKE)
[20:36:21] [PASSED] 0xB081 (PANTHERLAKE)
[20:36:21] [PASSED] 0xB082 (PANTHERLAKE)
[20:36:21] [PASSED] 0xB083 (PANTHERLAKE)
[20:36:21] [PASSED] 0xB084 (PANTHERLAKE)
[20:36:21] [PASSED] 0xB085 (PANTHERLAKE)
[20:36:21] [PASSED] 0xB086 (PANTHERLAKE)
[20:36:21] [PASSED] 0xB087 (PANTHERLAKE)
[20:36:21] [PASSED] 0xB08F (PANTHERLAKE)
[20:36:21] [PASSED] 0xB090 (PANTHERLAKE)
[20:36:21] [PASSED] 0xB0A0 (PANTHERLAKE)
[20:36:21] [PASSED] 0xB0B0 (PANTHERLAKE)
[20:36:21] [PASSED] 0xFD80 (PANTHERLAKE)
[20:36:21] [PASSED] 0xFD81 (PANTHERLAKE)
[20:36:21] [PASSED] 0xD740 (NOVALAKE_S)
[20:36:21] [PASSED] 0xD741 (NOVALAKE_S)
[20:36:21] [PASSED] 0xD742 (NOVALAKE_S)
[20:36:21] [PASSED] 0xD743 (NOVALAKE_S)
[20:36:21] [PASSED] 0xD744 (NOVALAKE_S)
[20:36:21] [PASSED] 0xD745 (NOVALAKE_S)
[20:36:21] [PASSED] 0x674C (CRESCENTISLAND)
[20:36:21] [PASSED] 0xD750 (NOVALAKE_P)
[20:36:21] [PASSED] 0xD751 (NOVALAKE_P)
[20:36:21] [PASSED] 0xD752 (NOVALAKE_P)
[20:36:21] [PASSED] 0xD753 (NOVALAKE_P)
[20:36:21] [PASSED] 0xD754 (NOVALAKE_P)
[20:36:21] [PASSED] 0xD755 (NOVALAKE_P)
[20:36:21] [PASSED] 0xD756 (NOVALAKE_P)
[20:36:21] [PASSED] 0xD757 (NOVALAKE_P)
[20:36:21] [PASSED] 0xD75F (NOVALAKE_P)
[20:36:21] =============== [PASSED] check_platform_desc ===============
[20:36:21] ===================== [PASSED] xe_pci ======================
[20:36:21] =================== xe_rtp (2 subtests) ====================
[20:36:21] =============== xe_rtp_process_to_sr_tests ================
[20:36:21] [PASSED] coalesce-same-reg
[20:36:21] [PASSED] no-match-no-add
[20:36:21] [PASSED] match-or
[20:36:21] [PASSED] match-or-xfail
[20:36:21] [PASSED] no-match-no-add-multiple-rules
[20:36:21] [PASSED] two-regs-two-entries
[20:36:21] [PASSED] clr-one-set-other
[20:36:21] [PASSED] set-field
[20:36:21] [PASSED] conflict-duplicate
stty: 'standard input': Inappropriate ioctl for device
[20:36:21] [PASSED] conflict-not-disjoint
[20:36:21] [PASSED] conflict-reg-type
[20:36:21] =========== [PASSED] xe_rtp_process_to_sr_tests ============
[20:36:21] ================== xe_rtp_process_tests ===================
[20:36:21] [PASSED] active1
[20:36:21] [PASSED] active2
[20:36:21] [PASSED] active-inactive
[20:36:21] [PASSED] inactive-active
[20:36:21] [PASSED] inactive-1st_or_active-inactive
[20:36:21] [PASSED] inactive-2nd_or_active-inactive
[20:36:21] [PASSED] inactive-last_or_active-inactive
[20:36:21] [PASSED] inactive-no_or_active-inactive
[20:36:21] ============== [PASSED] xe_rtp_process_tests ===============
[20:36:21] ===================== [PASSED] xe_rtp ======================
[20:36:21] ==================== xe_wa (1 subtest) =====================
[20:36:21] ======================== xe_wa_gt =========================
[20:36:21] [PASSED] TIGERLAKE B0
[20:36:21] [PASSED] DG1 A0
[20:36:21] [PASSED] DG1 B0
[20:36:21] [PASSED] ALDERLAKE_S A0
[20:36:21] [PASSED] ALDERLAKE_S B0
[20:36:21] [PASSED] ALDERLAKE_S C0
[20:36:21] [PASSED] ALDERLAKE_S D0
[20:36:21] [PASSED] ALDERLAKE_P A0
[20:36:21] [PASSED] ALDERLAKE_P B0
[20:36:21] [PASSED] ALDERLAKE_P C0
[20:36:21] [PASSED] ALDERLAKE_S RPLS D0
[20:36:21] [PASSED] ALDERLAKE_P RPLU E0
[20:36:21] [PASSED] DG2 G10 C0
[20:36:21] [PASSED] DG2 G11 B1
[20:36:21] [PASSED] DG2 G12 A1
[20:36:21] [PASSED] METEORLAKE 12.70(Xe_LPG) A0 13.00(Xe_LPM+) A0
[20:36:21] [PASSED] METEORLAKE 12.71(Xe_LPG) A0 13.00(Xe_LPM+) A0
[20:36:21] [PASSED] METEORLAKE 12.74(Xe_LPG+) A0 13.00(Xe_LPM+) A0
[20:36:21] [PASSED] LUNARLAKE 20.04(Xe2_LPG) A0 20.00(Xe2_LPM) A0
[20:36:21] [PASSED] LUNARLAKE 20.04(Xe2_LPG) B0 20.00(Xe2_LPM) A0
[20:36:21] [PASSED] BATTLEMAGE 20.01(Xe2_HPG) A0 13.01(Xe2_HPM) A1
[20:36:21] [PASSED] PANTHERLAKE 30.00(Xe3_LPG) A0 30.00(Xe3_LPM) A0
[20:36:21] ==================== [PASSED] xe_wa_gt =====================
[20:36:21] ====================== [PASSED] xe_wa ======================
[20:36:21] ============================================================
[20:36:21] Testing complete. Ran 597 tests: passed: 579, skipped: 18
[20:36:21] Elapsed time: 35.538s total, 4.297s configuring, 30.623s building, 0.608s running
+ /kernel/tools/testing/kunit/kunit.py run --kunitconfig /kernel/drivers/gpu/drm/tests/.kunitconfig
[20:36:21] Configuring KUnit Kernel ...
Regenerating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[20:36:23] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=48
[20:36:47] Starting KUnit Kernel (1/1)...
[20:36:47] ============================================================
Running tests with:
$ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[20:36:47] ============ drm_test_pick_cmdline (2 subtests) ============
[20:36:47] [PASSED] drm_test_pick_cmdline_res_1920_1080_60
[20:36:47] =============== drm_test_pick_cmdline_named ===============
[20:36:47] [PASSED] NTSC
[20:36:47] [PASSED] NTSC-J
[20:36:47] [PASSED] PAL
[20:36:47] [PASSED] PAL-M
[20:36:47] =========== [PASSED] drm_test_pick_cmdline_named ===========
[20:36:47] ============== [PASSED] drm_test_pick_cmdline ==============
[20:36:47] == drm_test_atomic_get_connector_for_encoder (1 subtest) ===
[20:36:47] [PASSED] drm_test_drm_atomic_get_connector_for_encoder
[20:36:47] ==== [PASSED] drm_test_atomic_get_connector_for_encoder ====
[20:36:47] =========== drm_validate_clone_mode (2 subtests) ===========
[20:36:47] ============== drm_test_check_in_clone_mode ===============
[20:36:47] [PASSED] in_clone_mode
[20:36:47] [PASSED] not_in_clone_mode
[20:36:47] ========== [PASSED] drm_test_check_in_clone_mode ===========
[20:36:47] =============== drm_test_check_valid_clones ===============
[20:36:47] [PASSED] not_in_clone_mode
[20:36:47] [PASSED] valid_clone
[20:36:47] [PASSED] invalid_clone
[20:36:47] =========== [PASSED] drm_test_check_valid_clones ===========
[20:36:47] ============= [PASSED] drm_validate_clone_mode =============
[20:36:47] ============= drm_validate_modeset (1 subtest) =============
[20:36:47] [PASSED] drm_test_check_connector_changed_modeset
[20:36:47] ============== [PASSED] drm_validate_modeset ===============
[20:36:47] ====== drm_test_bridge_get_current_state (2 subtests) ======
[20:36:47] [PASSED] drm_test_drm_bridge_get_current_state_atomic
[20:36:47] [PASSED] drm_test_drm_bridge_get_current_state_legacy
[20:36:47] ======== [PASSED] drm_test_bridge_get_current_state ========
[20:36:47] ====== drm_test_bridge_helper_reset_crtc (3 subtests) ======
[20:36:47] [PASSED] drm_test_drm_bridge_helper_reset_crtc_atomic
[20:36:47] [PASSED] drm_test_drm_bridge_helper_reset_crtc_atomic_disabled
[20:36:47] [PASSED] drm_test_drm_bridge_helper_reset_crtc_legacy
[20:36:47] ======== [PASSED] drm_test_bridge_helper_reset_crtc ========
[20:36:47] ============== drm_bridge_alloc (2 subtests) ===============
[20:36:47] [PASSED] drm_test_drm_bridge_alloc_basic
[20:36:47] [PASSED] drm_test_drm_bridge_alloc_get_put
[20:36:47] ================ [PASSED] drm_bridge_alloc =================
[20:36:47] ============= drm_cmdline_parser (40 subtests) =============
[20:36:47] [PASSED] drm_test_cmdline_force_d_only
[20:36:47] [PASSED] drm_test_cmdline_force_D_only_dvi
[20:36:47] [PASSED] drm_test_cmdline_force_D_only_hdmi
[20:36:47] [PASSED] drm_test_cmdline_force_D_only_not_digital
[20:36:47] [PASSED] drm_test_cmdline_force_e_only
[20:36:47] [PASSED] drm_test_cmdline_res
[20:36:47] [PASSED] drm_test_cmdline_res_vesa
[20:36:47] [PASSED] drm_test_cmdline_res_vesa_rblank
[20:36:47] [PASSED] drm_test_cmdline_res_rblank
[20:36:47] [PASSED] drm_test_cmdline_res_bpp
[20:36:47] [PASSED] drm_test_cmdline_res_refresh
[20:36:47] [PASSED] drm_test_cmdline_res_bpp_refresh
[20:36:47] [PASSED] drm_test_cmdline_res_bpp_refresh_interlaced
[20:36:47] [PASSED] drm_test_cmdline_res_bpp_refresh_margins
[20:36:47] [PASSED] drm_test_cmdline_res_bpp_refresh_force_off
[20:36:47] [PASSED] drm_test_cmdline_res_bpp_refresh_force_on
[20:36:47] [PASSED] drm_test_cmdline_res_bpp_refresh_force_on_analog
[20:36:47] [PASSED] drm_test_cmdline_res_bpp_refresh_force_on_digital
[20:36:47] [PASSED] drm_test_cmdline_res_bpp_refresh_interlaced_margins_force_on
[20:36:47] [PASSED] drm_test_cmdline_res_margins_force_on
[20:36:47] [PASSED] drm_test_cmdline_res_vesa_margins
[20:36:47] [PASSED] drm_test_cmdline_name
[20:36:47] [PASSED] drm_test_cmdline_name_bpp
[20:36:47] [PASSED] drm_test_cmdline_name_option
[20:36:47] [PASSED] drm_test_cmdline_name_bpp_option
[20:36:47] [PASSED] drm_test_cmdline_rotate_0
[20:36:47] [PASSED] drm_test_cmdline_rotate_90
[20:36:47] [PASSED] drm_test_cmdline_rotate_180
[20:36:47] [PASSED] drm_test_cmdline_rotate_270
[20:36:47] [PASSED] drm_test_cmdline_hmirror
[20:36:47] [PASSED] drm_test_cmdline_vmirror
[20:36:47] [PASSED] drm_test_cmdline_margin_options
[20:36:47] [PASSED] drm_test_cmdline_multiple_options
[20:36:47] [PASSED] drm_test_cmdline_bpp_extra_and_option
[20:36:47] [PASSED] drm_test_cmdline_extra_and_option
[20:36:47] [PASSED] drm_test_cmdline_freestanding_options
[20:36:47] [PASSED] drm_test_cmdline_freestanding_force_e_and_options
[20:36:47] [PASSED] drm_test_cmdline_panel_orientation
[20:36:47] ================ drm_test_cmdline_invalid =================
[20:36:47] [PASSED] margin_only
[20:36:47] [PASSED] interlace_only
[20:36:47] [PASSED] res_missing_x
[20:36:47] [PASSED] res_missing_y
[20:36:47] [PASSED] res_bad_y
[20:36:47] [PASSED] res_missing_y_bpp
[20:36:47] [PASSED] res_bad_bpp
[20:36:47] [PASSED] res_bad_refresh
[20:36:47] [PASSED] res_bpp_refresh_force_on_off
[20:36:47] [PASSED] res_invalid_mode
[20:36:47] [PASSED] res_bpp_wrong_place_mode
[20:36:47] [PASSED] name_bpp_refresh
[20:36:47] [PASSED] name_refresh
[20:36:47] [PASSED] name_refresh_wrong_mode
[20:36:47] [PASSED] name_refresh_invalid_mode
[20:36:47] [PASSED] rotate_multiple
[20:36:47] [PASSED] rotate_invalid_val
[20:36:47] [PASSED] rotate_truncated
[20:36:47] [PASSED] invalid_option
[20:36:47] [PASSED] invalid_tv_option
[20:36:47] [PASSED] truncated_tv_option
[20:36:47] ============ [PASSED] drm_test_cmdline_invalid =============
[20:36:47] =============== drm_test_cmdline_tv_options ===============
[20:36:47] [PASSED] NTSC
[20:36:47] [PASSED] NTSC_443
[20:36:47] [PASSED] NTSC_J
[20:36:47] [PASSED] PAL
[20:36:47] [PASSED] PAL_M
[20:36:47] [PASSED] PAL_N
[20:36:47] [PASSED] SECAM
[20:36:47] [PASSED] MONO_525
[20:36:47] [PASSED] MONO_625
[20:36:47] =========== [PASSED] drm_test_cmdline_tv_options ===========
[20:36:47] =============== [PASSED] drm_cmdline_parser ================
[20:36:47] ========== drmm_connector_hdmi_init (20 subtests) ==========
[20:36:47] [PASSED] drm_test_connector_hdmi_init_valid
[20:36:47] [PASSED] drm_test_connector_hdmi_init_bpc_8
[20:36:47] [PASSED] drm_test_connector_hdmi_init_bpc_10
[20:36:47] [PASSED] drm_test_connector_hdmi_init_bpc_12
[20:36:47] [PASSED] drm_test_connector_hdmi_init_bpc_invalid
[20:36:47] [PASSED] drm_test_connector_hdmi_init_bpc_null
[20:36:47] [PASSED] drm_test_connector_hdmi_init_formats_empty
[20:36:47] [PASSED] drm_test_connector_hdmi_init_formats_no_rgb
[20:36:47] === drm_test_connector_hdmi_init_formats_yuv420_allowed ===
[20:36:47] [PASSED] supported_formats=0x9 yuv420_allowed=1
[20:36:47] [PASSED] supported_formats=0x9 yuv420_allowed=0
[20:36:47] [PASSED] supported_formats=0x5 yuv420_allowed=1
[20:36:47] [PASSED] supported_formats=0x5 yuv420_allowed=0
[20:36:47] === [PASSED] drm_test_connector_hdmi_init_formats_yuv420_allowed ===
[20:36:47] [PASSED] drm_test_connector_hdmi_init_null_ddc
[20:36:47] [PASSED] drm_test_connector_hdmi_init_null_product
[20:36:47] [PASSED] drm_test_connector_hdmi_init_null_vendor
[20:36:47] [PASSED] drm_test_connector_hdmi_init_product_length_exact
[20:36:47] [PASSED] drm_test_connector_hdmi_init_product_length_too_long
[20:36:47] [PASSED] drm_test_connector_hdmi_init_product_valid
[20:36:47] [PASSED] drm_test_connector_hdmi_init_vendor_length_exact
[20:36:47] [PASSED] drm_test_connector_hdmi_init_vendor_length_too_long
[20:36:47] [PASSED] drm_test_connector_hdmi_init_vendor_valid
[20:36:47] ========= drm_test_connector_hdmi_init_type_valid =========
[20:36:47] [PASSED] HDMI-A
[20:36:47] [PASSED] HDMI-B
[20:36:47] ===== [PASSED] drm_test_connector_hdmi_init_type_valid =====
[20:36:47] ======== drm_test_connector_hdmi_init_type_invalid ========
[20:36:47] [PASSED] Unknown
[20:36:47] [PASSED] VGA
[20:36:47] [PASSED] DVI-I
[20:36:47] [PASSED] DVI-D
[20:36:47] [PASSED] DVI-A
[20:36:47] [PASSED] Composite
[20:36:47] [PASSED] SVIDEO
[20:36:47] [PASSED] LVDS
[20:36:47] [PASSED] Component
[20:36:47] [PASSED] DIN
[20:36:47] [PASSED] DP
[20:36:47] [PASSED] TV
[20:36:47] [PASSED] eDP
[20:36:47] [PASSED] Virtual
[20:36:47] [PASSED] DSI
[20:36:47] [PASSED] DPI
[20:36:47] [PASSED] Writeback
[20:36:47] [PASSED] SPI
[20:36:47] [PASSED] USB
[20:36:47] ==== [PASSED] drm_test_connector_hdmi_init_type_invalid ====
[20:36:47] ============ [PASSED] drmm_connector_hdmi_init =============
[20:36:47] ============= drmm_connector_init (3 subtests) =============
[20:36:47] [PASSED] drm_test_drmm_connector_init
[20:36:47] [PASSED] drm_test_drmm_connector_init_null_ddc
[20:36:47] ========= drm_test_drmm_connector_init_type_valid =========
[20:36:47] [PASSED] Unknown
[20:36:47] [PASSED] VGA
[20:36:47] [PASSED] DVI-I
[20:36:47] [PASSED] DVI-D
[20:36:47] [PASSED] DVI-A
[20:36:47] [PASSED] Composite
[20:36:47] [PASSED] SVIDEO
[20:36:47] [PASSED] LVDS
[20:36:47] [PASSED] Component
[20:36:47] [PASSED] DIN
[20:36:47] [PASSED] DP
[20:36:47] [PASSED] HDMI-A
[20:36:47] [PASSED] HDMI-B
[20:36:47] [PASSED] TV
[20:36:47] [PASSED] eDP
[20:36:47] [PASSED] Virtual
[20:36:47] [PASSED] DSI
[20:36:47] [PASSED] DPI
[20:36:47] [PASSED] Writeback
[20:36:47] [PASSED] SPI
[20:36:47] [PASSED] USB
[20:36:47] ===== [PASSED] drm_test_drmm_connector_init_type_valid =====
[20:36:47] =============== [PASSED] drmm_connector_init ===============
[20:36:47] ========= drm_connector_dynamic_init (6 subtests) ==========
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_init
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_init_null_ddc
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_init_not_added
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_init_properties
[20:36:47] ===== drm_test_drm_connector_dynamic_init_type_valid ======
[20:36:47] [PASSED] Unknown
[20:36:47] [PASSED] VGA
[20:36:47] [PASSED] DVI-I
[20:36:47] [PASSED] DVI-D
[20:36:47] [PASSED] DVI-A
[20:36:47] [PASSED] Composite
[20:36:47] [PASSED] SVIDEO
[20:36:47] [PASSED] LVDS
[20:36:47] [PASSED] Component
[20:36:47] [PASSED] DIN
[20:36:47] [PASSED] DP
[20:36:47] [PASSED] HDMI-A
[20:36:47] [PASSED] HDMI-B
[20:36:47] [PASSED] TV
[20:36:47] [PASSED] eDP
[20:36:47] [PASSED] Virtual
[20:36:47] [PASSED] DSI
[20:36:47] [PASSED] DPI
[20:36:47] [PASSED] Writeback
[20:36:47] [PASSED] SPI
[20:36:47] [PASSED] USB
[20:36:47] = [PASSED] drm_test_drm_connector_dynamic_init_type_valid ==
[20:36:47] ======== drm_test_drm_connector_dynamic_init_name =========
[20:36:47] [PASSED] Unknown
[20:36:47] [PASSED] VGA
[20:36:47] [PASSED] DVI-I
[20:36:47] [PASSED] DVI-D
[20:36:47] [PASSED] DVI-A
[20:36:47] [PASSED] Composite
[20:36:47] [PASSED] SVIDEO
[20:36:47] [PASSED] LVDS
[20:36:47] [PASSED] Component
[20:36:47] [PASSED] DIN
[20:36:47] [PASSED] DP
[20:36:47] [PASSED] HDMI-A
[20:36:47] [PASSED] HDMI-B
[20:36:47] [PASSED] TV
[20:36:47] [PASSED] eDP
[20:36:47] [PASSED] Virtual
[20:36:47] [PASSED] DSI
[20:36:47] [PASSED] DPI
[20:36:47] [PASSED] Writeback
[20:36:47] [PASSED] SPI
[20:36:47] [PASSED] USB
[20:36:47] ==== [PASSED] drm_test_drm_connector_dynamic_init_name =====
[20:36:47] =========== [PASSED] drm_connector_dynamic_init ============
[20:36:47] ==== drm_connector_dynamic_register_early (4 subtests) =====
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_register_early_on_list
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_register_early_defer
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_register_early_no_init
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_register_early_no_mode_object
[20:36:47] ====== [PASSED] drm_connector_dynamic_register_early =======
[20:36:47] ======= drm_connector_dynamic_register (7 subtests) ========
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_register_on_list
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_register_no_defer
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_register_no_init
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_register_mode_object
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_register_sysfs
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_register_sysfs_name
[20:36:47] [PASSED] drm_test_drm_connector_dynamic_register_debugfs
[20:36:47] ========= [PASSED] drm_connector_dynamic_register ==========
[20:36:47] = drm_connector_attach_broadcast_rgb_property (2 subtests) =
[20:36:47] [PASSED] drm_test_drm_connector_attach_broadcast_rgb_property
[20:36:47] [PASSED] drm_test_drm_connector_attach_broadcast_rgb_property_hdmi_connector
[20:36:47] === [PASSED] drm_connector_attach_broadcast_rgb_property ===
[20:36:47] ========== drm_get_tv_mode_from_name (2 subtests) ==========
[20:36:47] ========== drm_test_get_tv_mode_from_name_valid ===========
[20:36:47] [PASSED] NTSC
[20:36:47] [PASSED] NTSC-443
[20:36:47] [PASSED] NTSC-J
[20:36:47] [PASSED] PAL
[20:36:47] [PASSED] PAL-M
[20:36:47] [PASSED] PAL-N
[20:36:47] [PASSED] SECAM
[20:36:47] [PASSED] Mono
[20:36:47] ====== [PASSED] drm_test_get_tv_mode_from_name_valid =======
[20:36:47] [PASSED] drm_test_get_tv_mode_from_name_truncated
[20:36:47] ============ [PASSED] drm_get_tv_mode_from_name ============
[20:36:47] = drm_test_connector_hdmi_compute_mode_clock (12 subtests) =
[20:36:47] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb
[20:36:47] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_10bpc
[20:36:47] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_10bpc_vic_1
[20:36:47] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_12bpc
[20:36:47] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_12bpc_vic_1
[20:36:47] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_double
[20:36:47] = drm_test_connector_hdmi_compute_mode_clock_yuv420_valid =
[20:36:47] [PASSED] VIC 96
[20:36:47] [PASSED] VIC 97
[20:36:47] [PASSED] VIC 101
[20:36:47] [PASSED] VIC 102
[20:36:47] [PASSED] VIC 106
[20:36:47] [PASSED] VIC 107
[20:36:47] === [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv420_valid ===
[20:36:47] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv420_10_bpc
[20:36:47] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv420_12_bpc
[20:36:47] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv422_8_bpc
[20:36:47] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv422_10_bpc
[20:36:47] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv422_12_bpc
[20:36:47] === [PASSED] drm_test_connector_hdmi_compute_mode_clock ====
[20:36:47] == drm_hdmi_connector_get_broadcast_rgb_name (2 subtests) ==
[20:36:47] === drm_test_drm_hdmi_connector_get_broadcast_rgb_name ====
[20:36:47] [PASSED] Automatic
[20:36:47] [PASSED] Full
[20:36:47] [PASSED] Limited 16:235
[20:36:47] === [PASSED] drm_test_drm_hdmi_connector_get_broadcast_rgb_name ===
[20:36:47] [PASSED] drm_test_drm_hdmi_connector_get_broadcast_rgb_name_invalid
[20:36:47] ==== [PASSED] drm_hdmi_connector_get_broadcast_rgb_name ====
[20:36:47] == drm_hdmi_connector_get_output_format_name (2 subtests) ==
[20:36:47] === drm_test_drm_hdmi_connector_get_output_format_name ====
[20:36:47] [PASSED] RGB
[20:36:47] [PASSED] YUV 4:2:0
[20:36:47] [PASSED] YUV 4:2:2
[20:36:47] [PASSED] YUV 4:4:4
[20:36:47] === [PASSED] drm_test_drm_hdmi_connector_get_output_format_name ===
[20:36:47] [PASSED] drm_test_drm_hdmi_connector_get_output_format_name_invalid
[20:36:47] ==== [PASSED] drm_hdmi_connector_get_output_format_name ====
[20:36:47] ============= drm_damage_helper (21 subtests) ==============
[20:36:47] [PASSED] drm_test_damage_iter_no_damage
[20:36:47] [PASSED] drm_test_damage_iter_no_damage_fractional_src
[20:36:47] [PASSED] drm_test_damage_iter_no_damage_src_moved
[20:36:47] [PASSED] drm_test_damage_iter_no_damage_fractional_src_moved
[20:36:47] [PASSED] drm_test_damage_iter_no_damage_not_visible
[20:36:47] [PASSED] drm_test_damage_iter_no_damage_no_crtc
[20:36:47] [PASSED] drm_test_damage_iter_no_damage_no_fb
[20:36:47] [PASSED] drm_test_damage_iter_simple_damage
[20:36:47] [PASSED] drm_test_damage_iter_single_damage
[20:36:47] [PASSED] drm_test_damage_iter_single_damage_intersect_src
[20:36:47] [PASSED] drm_test_damage_iter_single_damage_outside_src
[20:36:47] [PASSED] drm_test_damage_iter_single_damage_fractional_src
[20:36:47] [PASSED] drm_test_damage_iter_single_damage_intersect_fractional_src
[20:36:47] [PASSED] drm_test_damage_iter_single_damage_outside_fractional_src
[20:36:47] [PASSED] drm_test_damage_iter_single_damage_src_moved
[20:36:47] [PASSED] drm_test_damage_iter_single_damage_fractional_src_moved
[20:36:47] [PASSED] drm_test_damage_iter_damage
[20:36:47] [PASSED] drm_test_damage_iter_damage_one_intersect
[20:36:47] [PASSED] drm_test_damage_iter_damage_one_outside
[20:36:47] [PASSED] drm_test_damage_iter_damage_src_moved
[20:36:47] [PASSED] drm_test_damage_iter_damage_not_visible
[20:36:47] ================ [PASSED] drm_damage_helper ================
[20:36:47] ============== drm_dp_mst_helper (3 subtests) ==============
[20:36:47] ============== drm_test_dp_mst_calc_pbn_mode ==============
[20:36:47] [PASSED] Clock 154000 BPP 30 DSC disabled
[20:36:47] [PASSED] Clock 234000 BPP 30 DSC disabled
[20:36:47] [PASSED] Clock 297000 BPP 24 DSC disabled
[20:36:47] [PASSED] Clock 332880 BPP 24 DSC enabled
[20:36:47] [PASSED] Clock 324540 BPP 24 DSC enabled
[20:36:47] ========== [PASSED] drm_test_dp_mst_calc_pbn_mode ==========
[20:36:47] ============== drm_test_dp_mst_calc_pbn_div ===============
[20:36:47] [PASSED] Link rate 2000000 lane count 4
[20:36:47] [PASSED] Link rate 2000000 lane count 2
[20:36:47] [PASSED] Link rate 2000000 lane count 1
[20:36:47] [PASSED] Link rate 1350000 lane count 4
[20:36:47] [PASSED] Link rate 1350000 lane count 2
[20:36:47] [PASSED] Link rate 1350000 lane count 1
[20:36:47] [PASSED] Link rate 1000000 lane count 4
[20:36:47] [PASSED] Link rate 1000000 lane count 2
[20:36:47] [PASSED] Link rate 1000000 lane count 1
[20:36:47] [PASSED] Link rate 810000 lane count 4
[20:36:47] [PASSED] Link rate 810000 lane count 2
[20:36:47] [PASSED] Link rate 810000 lane count 1
[20:36:47] [PASSED] Link rate 540000 lane count 4
[20:36:47] [PASSED] Link rate 540000 lane count 2
[20:36:47] [PASSED] Link rate 540000 lane count 1
[20:36:47] [PASSED] Link rate 270000 lane count 4
[20:36:47] [PASSED] Link rate 270000 lane count 2
[20:36:47] [PASSED] Link rate 270000 lane count 1
[20:36:47] [PASSED] Link rate 162000 lane count 4
[20:36:47] [PASSED] Link rate 162000 lane count 2
[20:36:47] [PASSED] Link rate 162000 lane count 1
[20:36:47] ========== [PASSED] drm_test_dp_mst_calc_pbn_div ===========
[20:36:47] ========= drm_test_dp_mst_sideband_msg_req_decode =========
[20:36:47] [PASSED] DP_ENUM_PATH_RESOURCES with port number
[20:36:47] [PASSED] DP_POWER_UP_PHY with port number
[20:36:47] [PASSED] DP_POWER_DOWN_PHY with port number
[20:36:47] [PASSED] DP_ALLOCATE_PAYLOAD with SDP stream sinks
[20:36:47] [PASSED] DP_ALLOCATE_PAYLOAD with port number
[20:36:47] [PASSED] DP_ALLOCATE_PAYLOAD with VCPI
[20:36:47] [PASSED] DP_ALLOCATE_PAYLOAD with PBN
[20:36:47] [PASSED] DP_QUERY_PAYLOAD with port number
[20:36:47] [PASSED] DP_QUERY_PAYLOAD with VCPI
[20:36:47] [PASSED] DP_REMOTE_DPCD_READ with port number
[20:36:47] [PASSED] DP_REMOTE_DPCD_READ with DPCD address
[20:36:47] [PASSED] DP_REMOTE_DPCD_READ with max number of bytes
[20:36:47] [PASSED] DP_REMOTE_DPCD_WRITE with port number
[20:36:47] [PASSED] DP_REMOTE_DPCD_WRITE with DPCD address
[20:36:47] [PASSED] DP_REMOTE_DPCD_WRITE with data array
[20:36:47] [PASSED] DP_REMOTE_I2C_READ with port number
[20:36:47] [PASSED] DP_REMOTE_I2C_READ with I2C device ID
[20:36:47] [PASSED] DP_REMOTE_I2C_READ with transactions array
[20:36:47] [PASSED] DP_REMOTE_I2C_WRITE with port number
[20:36:47] [PASSED] DP_REMOTE_I2C_WRITE with I2C device ID
[20:36:47] [PASSED] DP_REMOTE_I2C_WRITE with data array
[20:36:47] [PASSED] DP_QUERY_STREAM_ENC_STATUS with stream ID
[20:36:47] [PASSED] DP_QUERY_STREAM_ENC_STATUS with client ID
[20:36:47] [PASSED] DP_QUERY_STREAM_ENC_STATUS with stream event
[20:36:47] [PASSED] DP_QUERY_STREAM_ENC_STATUS with valid stream event
[20:36:47] [PASSED] DP_QUERY_STREAM_ENC_STATUS with stream behavior
[20:36:47] [PASSED] DP_QUERY_STREAM_ENC_STATUS with a valid stream behavior
[20:36:47] ===== [PASSED] drm_test_dp_mst_sideband_msg_req_decode =====
[20:36:47] ================ [PASSED] drm_dp_mst_helper ================
[20:36:47] ================== drm_exec (7 subtests) ===================
[20:36:47] [PASSED] sanitycheck
[20:36:47] [PASSED] test_lock
[20:36:47] [PASSED] test_lock_unlock
[20:36:47] [PASSED] test_duplicates
[20:36:47] [PASSED] test_prepare
[20:36:47] [PASSED] test_prepare_array
[20:36:47] [PASSED] test_multiple_loops
[20:36:47] ==================== [PASSED] drm_exec =====================
[20:36:47] =========== drm_format_helper_test (17 subtests) ===========
[20:36:47] ============== drm_test_fb_xrgb8888_to_gray8 ==============
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ========== [PASSED] drm_test_fb_xrgb8888_to_gray8 ==========
[20:36:47] ============= drm_test_fb_xrgb8888_to_rgb332 ==============
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ========= [PASSED] drm_test_fb_xrgb8888_to_rgb332 ==========
[20:36:47] ============= drm_test_fb_xrgb8888_to_rgb565 ==============
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ========= [PASSED] drm_test_fb_xrgb8888_to_rgb565 ==========
[20:36:47] ============ drm_test_fb_xrgb8888_to_xrgb1555 =============
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ======== [PASSED] drm_test_fb_xrgb8888_to_xrgb1555 =========
[20:36:47] ============ drm_test_fb_xrgb8888_to_argb1555 =============
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ======== [PASSED] drm_test_fb_xrgb8888_to_argb1555 =========
[20:36:47] ============ drm_test_fb_xrgb8888_to_rgba5551 =============
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ======== [PASSED] drm_test_fb_xrgb8888_to_rgba5551 =========
[20:36:47] ============= drm_test_fb_xrgb8888_to_rgb888 ==============
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ========= [PASSED] drm_test_fb_xrgb8888_to_rgb888 ==========
[20:36:47] ============= drm_test_fb_xrgb8888_to_bgr888 ==============
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ========= [PASSED] drm_test_fb_xrgb8888_to_bgr888 ==========
[20:36:47] ============ drm_test_fb_xrgb8888_to_argb8888 =============
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ======== [PASSED] drm_test_fb_xrgb8888_to_argb8888 =========
[20:36:47] =========== drm_test_fb_xrgb8888_to_xrgb2101010 ===========
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ======= [PASSED] drm_test_fb_xrgb8888_to_xrgb2101010 =======
[20:36:47] =========== drm_test_fb_xrgb8888_to_argb2101010 ===========
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ======= [PASSED] drm_test_fb_xrgb8888_to_argb2101010 =======
[20:36:47] ============== drm_test_fb_xrgb8888_to_mono ===============
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ========== [PASSED] drm_test_fb_xrgb8888_to_mono ===========
[20:36:47] ==================== drm_test_fb_swab =====================
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ================ [PASSED] drm_test_fb_swab =================
[20:36:47] ============ drm_test_fb_xrgb8888_to_xbgr8888 =============
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ======== [PASSED] drm_test_fb_xrgb8888_to_xbgr8888 =========
[20:36:47] ============ drm_test_fb_xrgb8888_to_abgr8888 =============
[20:36:47] [PASSED] single_pixel_source_buffer
[20:36:47] [PASSED] single_pixel_clip_rectangle
[20:36:47] [PASSED] well_known_colors
[20:36:47] [PASSED] destination_pitch
[20:36:47] ======== [PASSED] drm_test_fb_xrgb8888_to_abgr8888 =========
[20:36:47] ================= drm_test_fb_clip_offset =================
[20:36:47] [PASSED] pass through
[20:36:47] [PASSED] horizontal offset
[20:36:47] [PASSED] vertical offset
[20:36:47] [PASSED] horizontal and vertical offset
[20:36:47] [PASSED] horizontal offset (custom pitch)
[20:36:47] [PASSED] vertical offset (custom pitch)
[20:36:47] [PASSED] horizontal and vertical offset (custom pitch)
[20:36:47] ============= [PASSED] drm_test_fb_clip_offset =============
[20:36:47] =================== drm_test_fb_memcpy ====================
[20:36:47] [PASSED] single_pixel_source_buffer: XR24 little-endian (0x34325258)
[20:36:47] [PASSED] single_pixel_source_buffer: XRA8 little-endian (0x38415258)
[20:36:47] [PASSED] single_pixel_source_buffer: YU24 little-endian (0x34325559)
[20:36:47] [PASSED] single_pixel_clip_rectangle: XB24 little-endian (0x34324258)
[20:36:47] [PASSED] single_pixel_clip_rectangle: XRA8 little-endian (0x38415258)
[20:36:47] [PASSED] single_pixel_clip_rectangle: YU24 little-endian (0x34325559)
[20:36:47] [PASSED] well_known_colors: XB24 little-endian (0x34324258)
[20:36:47] [PASSED] well_known_colors: XRA8 little-endian (0x38415258)
[20:36:47] [PASSED] well_known_colors: YU24 little-endian (0x34325559)
[20:36:47] [PASSED] destination_pitch: XB24 little-endian (0x34324258)
[20:36:47] [PASSED] destination_pitch: XRA8 little-endian (0x38415258)
[20:36:47] [PASSED] destination_pitch: YU24 little-endian (0x34325559)
[20:36:47] =============== [PASSED] drm_test_fb_memcpy ================
[20:36:47] ============= [PASSED] drm_format_helper_test ==============
[20:36:47] ================= drm_format (18 subtests) =================
[20:36:47] [PASSED] drm_test_format_block_width_invalid
[20:36:47] [PASSED] drm_test_format_block_width_one_plane
[20:36:47] [PASSED] drm_test_format_block_width_two_plane
[20:36:47] [PASSED] drm_test_format_block_width_three_plane
[20:36:47] [PASSED] drm_test_format_block_width_tiled
[20:36:47] [PASSED] drm_test_format_block_height_invalid
[20:36:47] [PASSED] drm_test_format_block_height_one_plane
[20:36:47] [PASSED] drm_test_format_block_height_two_plane
[20:36:47] [PASSED] drm_test_format_block_height_three_plane
[20:36:47] [PASSED] drm_test_format_block_height_tiled
[20:36:47] [PASSED] drm_test_format_min_pitch_invalid
[20:36:47] [PASSED] drm_test_format_min_pitch_one_plane_8bpp
[20:36:47] [PASSED] drm_test_format_min_pitch_one_plane_16bpp
[20:36:47] [PASSED] drm_test_format_min_pitch_one_plane_24bpp
[20:36:47] [PASSED] drm_test_format_min_pitch_one_plane_32bpp
[20:36:47] [PASSED] drm_test_format_min_pitch_two_plane
[20:36:47] [PASSED] drm_test_format_min_pitch_three_plane_8bpp
[20:36:47] [PASSED] drm_test_format_min_pitch_tiled
[20:36:47] =================== [PASSED] drm_format ====================
[20:36:47] ============== drm_framebuffer (10 subtests) ===============
[20:36:47] ========== drm_test_framebuffer_check_src_coords ==========
[20:36:47] [PASSED] Success: source fits into fb
[20:36:47] [PASSED] Fail: overflowing fb with x-axis coordinate
[20:36:47] [PASSED] Fail: overflowing fb with y-axis coordinate
[20:36:47] [PASSED] Fail: overflowing fb with source width
[20:36:47] [PASSED] Fail: overflowing fb with source height
[20:36:47] ====== [PASSED] drm_test_framebuffer_check_src_coords ======
[20:36:47] [PASSED] drm_test_framebuffer_cleanup
[20:36:47] =============== drm_test_framebuffer_create ===============
[20:36:47] [PASSED] ABGR8888 normal sizes
[20:36:47] [PASSED] ABGR8888 max sizes
[20:36:47] [PASSED] ABGR8888 pitch greater than min required
[20:36:47] [PASSED] ABGR8888 pitch less than min required
[20:36:47] [PASSED] ABGR8888 Invalid width
[20:36:47] [PASSED] ABGR8888 Invalid buffer handle
[20:36:47] [PASSED] No pixel format
[20:36:47] [PASSED] ABGR8888 Width 0
[20:36:47] [PASSED] ABGR8888 Height 0
[20:36:47] [PASSED] ABGR8888 Out of bound height * pitch combination
[20:36:47] [PASSED] ABGR8888 Large buffer offset
[20:36:47] [PASSED] ABGR8888 Buffer offset for inexistent plane
[20:36:47] [PASSED] ABGR8888 Invalid flag
[20:36:47] [PASSED] ABGR8888 Set DRM_MODE_FB_MODIFIERS without modifiers
[20:36:47] [PASSED] ABGR8888 Valid buffer modifier
[20:36:47] [PASSED] ABGR8888 Invalid buffer modifier(DRM_FORMAT_MOD_SAMSUNG_64_32_TILE)
[20:36:47] [PASSED] ABGR8888 Extra pitches without DRM_MODE_FB_MODIFIERS
[20:36:47] [PASSED] ABGR8888 Extra pitches with DRM_MODE_FB_MODIFIERS
[20:36:47] [PASSED] NV12 Normal sizes
[20:36:47] [PASSED] NV12 Max sizes
[20:36:47] [PASSED] NV12 Invalid pitch
[20:36:47] [PASSED] NV12 Invalid modifier/missing DRM_MODE_FB_MODIFIERS flag
[20:36:47] [PASSED] NV12 different modifier per-plane
[20:36:47] [PASSED] NV12 with DRM_FORMAT_MOD_SAMSUNG_64_32_TILE
[20:36:47] [PASSED] NV12 Valid modifiers without DRM_MODE_FB_MODIFIERS
[20:36:47] [PASSED] NV12 Modifier for inexistent plane
[20:36:47] [PASSED] NV12 Handle for inexistent plane
[20:36:47] [PASSED] NV12 Handle for inexistent plane without DRM_MODE_FB_MODIFIERS
[20:36:47] [PASSED] YVU420 DRM_MODE_FB_MODIFIERS set without modifier
[20:36:47] [PASSED] YVU420 Normal sizes
[20:36:47] [PASSED] YVU420 Max sizes
[20:36:47] [PASSED] YVU420 Invalid pitch
[20:36:47] [PASSED] YVU420 Different pitches
[20:36:47] [PASSED] YVU420 Different buffer offsets/pitches
[20:36:47] [PASSED] YVU420 Modifier set just for plane 0, without DRM_MODE_FB_MODIFIERS
[20:36:47] [PASSED] YVU420 Modifier set just for planes 0, 1, without DRM_MODE_FB_MODIFIERS
[20:36:47] [PASSED] YVU420 Modifier set just for plane 0, 1, with DRM_MODE_FB_MODIFIERS
[20:36:47] [PASSED] YVU420 Valid modifier
[20:36:47] [PASSED] YVU420 Different modifiers per plane
[20:36:47] [PASSED] YVU420 Modifier for inexistent plane
[20:36:47] [PASSED] YUV420_10BIT Invalid modifier(DRM_FORMAT_MOD_LINEAR)
[20:36:47] [PASSED] X0L2 Normal sizes
[20:36:47] [PASSED] X0L2 Max sizes
[20:36:47] [PASSED] X0L2 Invalid pitch
[20:36:47] [PASSED] X0L2 Pitch greater than minimum required
[20:36:47] [PASSED] X0L2 Handle for inexistent plane
[20:36:47] [PASSED] X0L2 Offset for inexistent plane, without DRM_MODE_FB_MODIFIERS set
[20:36:47] [PASSED] X0L2 Modifier without DRM_MODE_FB_MODIFIERS set
[20:36:47] [PASSED] X0L2 Valid modifier
[20:36:47] [PASSED] X0L2 Modifier for inexistent plane
[20:36:47] =========== [PASSED] drm_test_framebuffer_create ===========
[20:36:47] [PASSED] drm_test_framebuffer_free
[20:36:47] [PASSED] drm_test_framebuffer_init
[20:36:47] [PASSED] drm_test_framebuffer_init_bad_format
[20:36:47] [PASSED] drm_test_framebuffer_init_dev_mismatch
[20:36:47] [PASSED] drm_test_framebuffer_lookup
[20:36:47] [PASSED] drm_test_framebuffer_lookup_inexistent
[20:36:47] [PASSED] drm_test_framebuffer_modifiers_not_supported
[20:36:47] ================= [PASSED] drm_framebuffer =================
[20:36:47] ================ drm_gem_shmem (8 subtests) ================
[20:36:47] [PASSED] drm_gem_shmem_test_obj_create
[20:36:47] [PASSED] drm_gem_shmem_test_obj_create_private
[20:36:47] [PASSED] drm_gem_shmem_test_pin_pages
[20:36:47] [PASSED] drm_gem_shmem_test_vmap
[20:36:47] [PASSED] drm_gem_shmem_test_get_sg_table
[20:36:47] [PASSED] drm_gem_shmem_test_get_pages_sgt
[20:36:47] [PASSED] drm_gem_shmem_test_madvise
[20:36:47] [PASSED] drm_gem_shmem_test_purge
[20:36:47] ================== [PASSED] drm_gem_shmem ==================
[20:36:47] === drm_atomic_helper_connector_hdmi_check (27 subtests) ===
[20:36:47] [PASSED] drm_test_check_broadcast_rgb_auto_cea_mode
[20:36:47] [PASSED] drm_test_check_broadcast_rgb_auto_cea_mode_vic_1
[20:36:47] [PASSED] drm_test_check_broadcast_rgb_full_cea_mode
[20:36:47] [PASSED] drm_test_check_broadcast_rgb_full_cea_mode_vic_1
[20:36:47] [PASSED] drm_test_check_broadcast_rgb_limited_cea_mode
[20:36:47] [PASSED] drm_test_check_broadcast_rgb_limited_cea_mode_vic_1
[20:36:47] ====== drm_test_check_broadcast_rgb_cea_mode_yuv420 =======
[20:36:47] [PASSED] Automatic
[20:36:47] [PASSED] Full
[20:36:47] [PASSED] Limited 16:235
[20:36:47] == [PASSED] drm_test_check_broadcast_rgb_cea_mode_yuv420 ===
[20:36:47] [PASSED] drm_test_check_broadcast_rgb_crtc_mode_changed
[20:36:47] [PASSED] drm_test_check_broadcast_rgb_crtc_mode_not_changed
[20:36:47] [PASSED] drm_test_check_disable_connector
[20:36:47] [PASSED] drm_test_check_hdmi_funcs_reject_rate
[20:36:47] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_rgb
[20:36:47] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_yuv420
[20:36:47] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_ignore_yuv422
[20:36:47] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_ignore_yuv420
[20:36:47] [PASSED] drm_test_check_driver_unsupported_fallback_yuv420
[20:36:47] [PASSED] drm_test_check_output_bpc_crtc_mode_changed
[20:36:47] [PASSED] drm_test_check_output_bpc_crtc_mode_not_changed
[20:36:47] [PASSED] drm_test_check_output_bpc_dvi
[20:36:47] [PASSED] drm_test_check_output_bpc_format_vic_1
[20:36:47] [PASSED] drm_test_check_output_bpc_format_display_8bpc_only
[20:36:47] [PASSED] drm_test_check_output_bpc_format_display_rgb_only
[20:36:47] [PASSED] drm_test_check_output_bpc_format_driver_8bpc_only
[20:36:47] [PASSED] drm_test_check_output_bpc_format_driver_rgb_only
[20:36:47] [PASSED] drm_test_check_tmds_char_rate_rgb_8bpc
[20:36:47] [PASSED] drm_test_check_tmds_char_rate_rgb_10bpc
[20:36:47] [PASSED] drm_test_check_tmds_char_rate_rgb_12bpc
[20:36:47] ===== [PASSED] drm_atomic_helper_connector_hdmi_check ======
[20:36:47] === drm_atomic_helper_connector_hdmi_reset (6 subtests) ====
[20:36:47] [PASSED] drm_test_check_broadcast_rgb_value
[20:36:47] [PASSED] drm_test_check_bpc_8_value
[20:36:47] [PASSED] drm_test_check_bpc_10_value
[20:36:47] [PASSED] drm_test_check_bpc_12_value
[20:36:47] [PASSED] drm_test_check_format_value
[20:36:47] [PASSED] drm_test_check_tmds_char_value
[20:36:47] ===== [PASSED] drm_atomic_helper_connector_hdmi_reset ======
[20:36:47] = drm_atomic_helper_connector_hdmi_mode_valid (4 subtests) =
[20:36:47] [PASSED] drm_test_check_mode_valid
[20:36:47] [PASSED] drm_test_check_mode_valid_reject
[20:36:47] [PASSED] drm_test_check_mode_valid_reject_rate
[20:36:47] [PASSED] drm_test_check_mode_valid_reject_max_clock
[20:36:47] === [PASSED] drm_atomic_helper_connector_hdmi_mode_valid ===
[20:36:47] = drm_atomic_helper_connector_hdmi_infoframes (5 subtests) =
[20:36:47] [PASSED] drm_test_check_infoframes
[20:36:47] [PASSED] drm_test_check_reject_avi_infoframe
[20:36:47] [PASSED] drm_test_check_reject_hdr_infoframe_bpc_8
[20:36:47] [PASSED] drm_test_check_reject_hdr_infoframe_bpc_10
[20:36:47] [PASSED] drm_test_check_reject_audio_infoframe
[20:36:47] === [PASSED] drm_atomic_helper_connector_hdmi_infoframes ===
[20:36:47] ================= drm_managed (2 subtests) =================
[20:36:47] [PASSED] drm_test_managed_release_action
[20:36:47] [PASSED] drm_test_managed_run_action
[20:36:47] =================== [PASSED] drm_managed ===================
[20:36:47] =================== drm_mm (6 subtests) ====================
[20:36:47] [PASSED] drm_test_mm_init
[20:36:47] [PASSED] drm_test_mm_debug
[20:36:47] [PASSED] drm_test_mm_align32
[20:36:47] [PASSED] drm_test_mm_align64
[20:36:47] [PASSED] drm_test_mm_lowest
[20:36:47] [PASSED] drm_test_mm_highest
[20:36:47] ===================== [PASSED] drm_mm ======================
[20:36:47] ============= drm_modes_analog_tv (5 subtests) =============
[20:36:47] [PASSED] drm_test_modes_analog_tv_mono_576i
[20:36:47] [PASSED] drm_test_modes_analog_tv_ntsc_480i
[20:36:47] [PASSED] drm_test_modes_analog_tv_ntsc_480i_inlined
[20:36:47] [PASSED] drm_test_modes_analog_tv_pal_576i
[20:36:47] [PASSED] drm_test_modes_analog_tv_pal_576i_inlined
[20:36:47] =============== [PASSED] drm_modes_analog_tv ===============
[20:36:47] ============== drm_plane_helper (2 subtests) ===============
[20:36:47] =============== drm_test_check_plane_state ================
[20:36:47] [PASSED] clipping_simple
[20:36:47] [PASSED] clipping_rotate_reflect
[20:36:47] [PASSED] positioning_simple
[20:36:47] [PASSED] upscaling
[20:36:47] [PASSED] downscaling
[20:36:47] [PASSED] rounding1
[20:36:47] [PASSED] rounding2
[20:36:47] [PASSED] rounding3
[20:36:47] [PASSED] rounding4
[20:36:47] =========== [PASSED] drm_test_check_plane_state ============
[20:36:47] =========== drm_test_check_invalid_plane_state ============
[20:36:47] [PASSED] positioning_invalid
[20:36:47] [PASSED] upscaling_invalid
[20:36:47] [PASSED] downscaling_invalid
[20:36:47] ======= [PASSED] drm_test_check_invalid_plane_state ========
[20:36:47] ================ [PASSED] drm_plane_helper =================
[20:36:47] ====== drm_connector_helper_tv_get_modes (1 subtest) =======
[20:36:47] ====== drm_test_connector_helper_tv_get_modes_check =======
[20:36:47] [PASSED] None
[20:36:47] [PASSED] PAL
[20:36:47] [PASSED] NTSC
[20:36:47] [PASSED] Both, NTSC Default
[20:36:47] [PASSED] Both, PAL Default
[20:36:47] [PASSED] Both, NTSC Default, with PAL on command-line
[20:36:47] [PASSED] Both, PAL Default, with NTSC on command-line
[20:36:47] == [PASSED] drm_test_connector_helper_tv_get_modes_check ===
[20:36:47] ======== [PASSED] drm_connector_helper_tv_get_modes ========
[20:36:47] ================== drm_rect (9 subtests) ===================
[20:36:47] [PASSED] drm_test_rect_clip_scaled_div_by_zero
[20:36:47] [PASSED] drm_test_rect_clip_scaled_not_clipped
[20:36:47] [PASSED] drm_test_rect_clip_scaled_clipped
[20:36:47] [PASSED] drm_test_rect_clip_scaled_signed_vs_unsigned
[20:36:47] ================= drm_test_rect_intersect =================
[20:36:47] [PASSED] top-left x bottom-right: 2x2+1+1 x 2x2+0+0
[20:36:47] [PASSED] top-right x bottom-left: 2x2+0+0 x 2x2+1-1
[20:36:47] [PASSED] bottom-left x top-right: 2x2+1-1 x 2x2+0+0
[20:36:47] [PASSED] bottom-right x top-left: 2x2+0+0 x 2x2+1+1
[20:36:47] [PASSED] right x left: 2x1+0+0 x 3x1+1+0
[20:36:47] [PASSED] left x right: 3x1+1+0 x 2x1+0+0
[20:36:47] [PASSED] up x bottom: 1x2+0+0 x 1x3+0-1
[20:36:47] [PASSED] bottom x up: 1x3+0-1 x 1x2+0+0
[20:36:47] [PASSED] touching corner: 1x1+0+0 x 2x2+1+1
[20:36:47] [PASSED] touching side: 1x1+0+0 x 1x1+1+0
[20:36:47] [PASSED] equal rects: 2x2+0+0 x 2x2+0+0
[20:36:47] [PASSED] inside another: 2x2+0+0 x 1x1+1+1
[20:36:47] [PASSED] far away: 1x1+0+0 x 1x1+3+6
[20:36:47] [PASSED] points intersecting: 0x0+5+10 x 0x0+5+10
[20:36:47] [PASSED] points not intersecting: 0x0+0+0 x 0x0+5+10
[20:36:47] ============= [PASSED] drm_test_rect_intersect =============
[20:36:47] ================ drm_test_rect_calc_hscale ================
[20:36:47] [PASSED] normal use
[20:36:47] [PASSED] out of max range
[20:36:47] [PASSED] out of min range
[20:36:47] [PASSED] zero dst
[20:36:47] [PASSED] negative src
[20:36:47] [PASSED] negative dst
[20:36:47] ============ [PASSED] drm_test_rect_calc_hscale ============
[20:36:47] ================ drm_test_rect_calc_vscale ================
[20:36:47] [PASSED] normal use
[20:36:47] [PASSED] out of max range
[20:36:47] [PASSED] out of min range
[20:36:47] [PASSED] zero dst
[20:36:47] [PASSED] negative src
[20:36:47] [PASSED] negative dst
stty: 'standard input': Inappropriate ioctl for device
[20:36:47] ============ [PASSED] drm_test_rect_calc_vscale ============
[20:36:47] ================== drm_test_rect_rotate ===================
[20:36:47] [PASSED] reflect-x
[20:36:47] [PASSED] reflect-y
[20:36:47] [PASSED] rotate-0
[20:36:47] [PASSED] rotate-90
[20:36:47] [PASSED] rotate-180
[20:36:47] [PASSED] rotate-270
[20:36:47] ============== [PASSED] drm_test_rect_rotate ===============
[20:36:47] ================ drm_test_rect_rotate_inv =================
[20:36:47] [PASSED] reflect-x
[20:36:47] [PASSED] reflect-y
[20:36:47] [PASSED] rotate-0
[20:36:47] [PASSED] rotate-90
[20:36:47] [PASSED] rotate-180
[20:36:47] [PASSED] rotate-270
[20:36:47] ============ [PASSED] drm_test_rect_rotate_inv =============
[20:36:47] ==================== [PASSED] drm_rect =====================
[20:36:47] ============ drm_sysfb_modeset_test (1 subtest) ============
[20:36:47] ============ drm_test_sysfb_build_fourcc_list =============
[20:36:47] [PASSED] no native formats
[20:36:47] [PASSED] XRGB8888 as native format
[20:36:47] [PASSED] remove duplicates
[20:36:47] [PASSED] convert alpha formats
[20:36:47] [PASSED] random formats
[20:36:47] ======== [PASSED] drm_test_sysfb_build_fourcc_list =========
[20:36:47] ============= [PASSED] drm_sysfb_modeset_test ==============
[20:36:47] ================== drm_fixp (2 subtests) ===================
[20:36:47] [PASSED] drm_test_int2fixp
[20:36:47] [PASSED] drm_test_sm2fixp
[20:36:47] ==================== [PASSED] drm_fixp =====================
[20:36:47] ============================================================
[20:36:47] Testing complete. Ran 621 tests: passed: 621
[20:36:47] Elapsed time: 26.214s total, 1.708s configuring, 24.338s building, 0.126s running
+ /kernel/tools/testing/kunit/kunit.py run --kunitconfig /kernel/drivers/gpu/drm/ttm/tests/.kunitconfig
[20:36:48] Configuring KUnit Kernel ...
Regenerating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[20:36:49] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=48
[20:36:59] Starting KUnit Kernel (1/1)...
[20:36:59] ============================================================
Running tests with:
$ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[20:36:59] ================= ttm_device (5 subtests) ==================
[20:36:59] [PASSED] ttm_device_init_basic
[20:36:59] [PASSED] ttm_device_init_multiple
[20:36:59] [PASSED] ttm_device_fini_basic
[20:36:59] [PASSED] ttm_device_init_no_vma_man
[20:36:59] ================== ttm_device_init_pools ==================
[20:36:59] [PASSED] No DMA allocations, no DMA32 required
[20:36:59] [PASSED] DMA allocations, DMA32 required
[20:36:59] [PASSED] No DMA allocations, DMA32 required
[20:36:59] [PASSED] DMA allocations, no DMA32 required
[20:36:59] ============== [PASSED] ttm_device_init_pools ==============
[20:36:59] =================== [PASSED] ttm_device ====================
[20:36:59] ================== ttm_pool (8 subtests) ===================
[20:36:59] ================== ttm_pool_alloc_basic ===================
[20:36:59] [PASSED] One page
[20:36:59] [PASSED] More than one page
[20:36:59] [PASSED] Above the allocation limit
[20:36:59] [PASSED] One page, with coherent DMA mappings enabled
[20:36:59] [PASSED] Above the allocation limit, with coherent DMA mappings enabled
[20:36:59] ============== [PASSED] ttm_pool_alloc_basic ===============
[20:36:59] ============== ttm_pool_alloc_basic_dma_addr ==============
[20:36:59] [PASSED] One page
[20:36:59] [PASSED] More than one page
[20:36:59] [PASSED] Above the allocation limit
[20:36:59] [PASSED] One page, with coherent DMA mappings enabled
[20:36:59] [PASSED] Above the allocation limit, with coherent DMA mappings enabled
[20:36:59] ========== [PASSED] ttm_pool_alloc_basic_dma_addr ==========
[20:36:59] [PASSED] ttm_pool_alloc_order_caching_match
[20:36:59] [PASSED] ttm_pool_alloc_caching_mismatch
[20:36:59] [PASSED] ttm_pool_alloc_order_mismatch
[20:36:59] [PASSED] ttm_pool_free_dma_alloc
[20:36:59] [PASSED] ttm_pool_free_no_dma_alloc
[20:36:59] [PASSED] ttm_pool_fini_basic
[20:36:59] ==================== [PASSED] ttm_pool =====================
[20:36:59] ================ ttm_resource (8 subtests) =================
[20:36:59] ================= ttm_resource_init_basic =================
[20:36:59] [PASSED] Init resource in TTM_PL_SYSTEM
[20:36:59] [PASSED] Init resource in TTM_PL_VRAM
[20:36:59] [PASSED] Init resource in a private placement
[20:36:59] [PASSED] Init resource in TTM_PL_SYSTEM, set placement flags
[20:36:59] ============= [PASSED] ttm_resource_init_basic =============
[20:36:59] [PASSED] ttm_resource_init_pinned
[20:36:59] [PASSED] ttm_resource_fini_basic
[20:36:59] [PASSED] ttm_resource_manager_init_basic
[20:36:59] [PASSED] ttm_resource_manager_usage_basic
[20:36:59] [PASSED] ttm_resource_manager_set_used_basic
[20:36:59] [PASSED] ttm_sys_man_alloc_basic
[20:36:59] [PASSED] ttm_sys_man_free_basic
[20:36:59] ================== [PASSED] ttm_resource ===================
[20:36:59] =================== ttm_tt (15 subtests) ===================
[20:36:59] ==================== ttm_tt_init_basic ====================
[20:36:59] [PASSED] Page-aligned size
[20:36:59] [PASSED] Extra pages requested
[20:36:59] ================ [PASSED] ttm_tt_init_basic ================
[20:36:59] [PASSED] ttm_tt_init_misaligned
[20:36:59] [PASSED] ttm_tt_fini_basic
[20:36:59] [PASSED] ttm_tt_fini_sg
[20:36:59] [PASSED] ttm_tt_fini_shmem
[20:36:59] [PASSED] ttm_tt_create_basic
[20:36:59] [PASSED] ttm_tt_create_invalid_bo_type
[20:36:59] [PASSED] ttm_tt_create_ttm_exists
[20:36:59] [PASSED] ttm_tt_create_failed
[20:36:59] [PASSED] ttm_tt_destroy_basic
[20:36:59] [PASSED] ttm_tt_populate_null_ttm
[20:36:59] [PASSED] ttm_tt_populate_populated_ttm
[20:36:59] [PASSED] ttm_tt_unpopulate_basic
[20:36:59] [PASSED] ttm_tt_unpopulate_empty_ttm
[20:36:59] [PASSED] ttm_tt_swapin_basic
[20:36:59] ===================== [PASSED] ttm_tt ======================
[20:36:59] =================== ttm_bo (14 subtests) ===================
[20:36:59] =========== ttm_bo_reserve_optimistic_no_ticket ===========
[20:36:59] [PASSED] Cannot be interrupted and sleeps
[20:36:59] [PASSED] Cannot be interrupted, locks straight away
[20:36:59] [PASSED] Can be interrupted, sleeps
[20:36:59] ======= [PASSED] ttm_bo_reserve_optimistic_no_ticket =======
[20:36:59] [PASSED] ttm_bo_reserve_locked_no_sleep
[20:36:59] [PASSED] ttm_bo_reserve_no_wait_ticket
[20:36:59] [PASSED] ttm_bo_reserve_double_resv
[20:36:59] [PASSED] ttm_bo_reserve_interrupted
[20:36:59] [PASSED] ttm_bo_reserve_deadlock
[20:36:59] [PASSED] ttm_bo_unreserve_basic
[20:36:59] [PASSED] ttm_bo_unreserve_pinned
[20:36:59] [PASSED] ttm_bo_unreserve_bulk
[20:36:59] [PASSED] ttm_bo_fini_basic
[20:36:59] [PASSED] ttm_bo_fini_shared_resv
[20:36:59] [PASSED] ttm_bo_pin_basic
[20:36:59] [PASSED] ttm_bo_pin_unpin_resource
[20:36:59] [PASSED] ttm_bo_multiple_pin_one_unpin
[20:36:59] ===================== [PASSED] ttm_bo ======================
[20:36:59] ============== ttm_bo_validate (22 subtests) ===============
[20:36:59] ============== ttm_bo_init_reserved_sys_man ===============
[20:36:59] [PASSED] Buffer object for userspace
[20:36:59] [PASSED] Kernel buffer object
[20:36:59] [PASSED] Shared buffer object
[20:36:59] ========== [PASSED] ttm_bo_init_reserved_sys_man ===========
[20:36:59] ============== ttm_bo_init_reserved_mock_man ==============
[20:36:59] [PASSED] Buffer object for userspace
[20:36:59] [PASSED] Kernel buffer object
[20:36:59] [PASSED] Shared buffer object
[20:36:59] ========== [PASSED] ttm_bo_init_reserved_mock_man ==========
[20:36:59] [PASSED] ttm_bo_init_reserved_resv
[20:36:59] ================== ttm_bo_validate_basic ==================
[20:36:59] [PASSED] Buffer object for userspace
[20:36:59] [PASSED] Kernel buffer object
[20:36:59] [PASSED] Shared buffer object
[20:36:59] ============== [PASSED] ttm_bo_validate_basic ==============
[20:36:59] [PASSED] ttm_bo_validate_invalid_placement
[20:36:59] ============= ttm_bo_validate_same_placement ==============
[20:36:59] [PASSED] System manager
[20:36:59] [PASSED] VRAM manager
[20:36:59] ========= [PASSED] ttm_bo_validate_same_placement ==========
[20:36:59] [PASSED] ttm_bo_validate_failed_alloc
[20:36:59] [PASSED] ttm_bo_validate_pinned
[20:36:59] [PASSED] ttm_bo_validate_busy_placement
[20:36:59] ================ ttm_bo_validate_multihop =================
[20:36:59] [PASSED] Buffer object for userspace
[20:36:59] [PASSED] Kernel buffer object
[20:36:59] [PASSED] Shared buffer object
[20:36:59] ============ [PASSED] ttm_bo_validate_multihop =============
[20:36:59] ========== ttm_bo_validate_no_placement_signaled ==========
[20:36:59] [PASSED] Buffer object in system domain, no page vector
[20:36:59] [PASSED] Buffer object in system domain with an existing page vector
[20:36:59] ====== [PASSED] ttm_bo_validate_no_placement_signaled ======
[20:36:59] ======== ttm_bo_validate_no_placement_not_signaled ========
[20:36:59] [PASSED] Buffer object for userspace
[20:36:59] [PASSED] Kernel buffer object
[20:36:59] [PASSED] Shared buffer object
[20:36:59] ==== [PASSED] ttm_bo_validate_no_placement_not_signaled ====
[20:36:59] [PASSED] ttm_bo_validate_move_fence_signaled
[20:36:59] ========= ttm_bo_validate_move_fence_not_signaled =========
[20:36:59] [PASSED] Waits for GPU
[20:36:59] [PASSED] Tries to lock straight away
[20:36:59] ===== [PASSED] ttm_bo_validate_move_fence_not_signaled =====
[20:36:59] [PASSED] ttm_bo_validate_swapout
[20:36:59] [PASSED] ttm_bo_validate_happy_evict
[20:36:59] [PASSED] ttm_bo_validate_all_pinned_evict
[20:36:59] [PASSED] ttm_bo_validate_allowed_only_evict
[20:36:59] [PASSED] ttm_bo_validate_deleted_evict
[20:36:59] [PASSED] ttm_bo_validate_busy_domain_evict
[20:36:59] [PASSED] ttm_bo_validate_evict_gutting
[20:36:59] [PASSED] ttm_bo_validate_recrusive_evict
stty: 'standard input': Inappropriate ioctl for device
[20:36:59] ================= [PASSED] ttm_bo_validate =================
[20:36:59] ============================================================
[20:36:59] Testing complete. Ran 102 tests: passed: 102
[20:36:59] Elapsed time: 11.435s total, 1.714s configuring, 9.506s building, 0.184s running
+ cleanup
++ stat -c %u:%g /kernel
+ chown -R 1003:1003 /kernel
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-25 20:31 ` Maarten Lankhorst
@ 2026-03-25 21:07 ` Guenter Roeck
0 siblings, 0 replies; 33+ messages in thread
From: Guenter Roeck @ 2026-03-25 21:07 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: dri-devel, intel-xe, Thomas Hellström
On 3/25/26 13:31, Maarten Lankhorst wrote:
> Hey,
>
> Den 2026-03-25 kl. 21:12, skrev Guenter Roeck:
>> Hi Maarten,
>>
>> On Wed, Mar 25, 2026 at 07:28:06PM +0100, Maarten Lankhorst wrote:
>>> Hello,
>>>
>>> What about this patch?
>>>
>>> Kind regards,
>>> ~Maarten Lankhorst
>>>
>>> ------8<---------
>>> diff --git a/drivers/gpu/drm/sysfb/simpledrm.c b/drivers/gpu/drm/sysfb/simpledrm.c
>>> index 0358164a623c9..ae49aaf99fb2c 100644
>>> --- a/drivers/gpu/drm/sysfb/simpledrm.c
>>> +++ b/drivers/gpu/drm/sysfb/simpledrm.c
>>> @@ -588,6 +588,11 @@ static const struct drm_mode_config_funcs simpledrm_mode_config_funcs = {
>>> * Init / Cleanup
>>> */
>>>
>>> +static void simpledrm_shutdown(struct drm_device *dev, void *arg)
>>> +{
>>> + drm_atomic_helper_shutdown(dev);
>>> +}
>>> +
>>> static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
>>> struct platform_device *pdev)
>>> {
>>> @@ -808,6 +813,10 @@ static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
>>>
>>> drm_mode_config_reset(dev);
>>>
>>> + ret = drmm_add_action_or_reset(dev, simpledrm_shutdown, NULL);
>>> + if (ret)
>>> + return ERR_PTR(ret);
>>> +
>>> return sdev;
>>> }
>>>
>>
>> Unfortunately, this results in an exciting new set of refcount underflows.
>
>
> Thank you, that's very fascinating and unexpected..
>
> What happens if you loudly complain on fd close instead?
> ---------8<----
> diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
> index c8c7155319951..237ab6d606127 100644
> --- a/drivers/gpu/drm/drm_file.c
> +++ b/drivers/gpu/drm/drm_file.c
> @@ -251,7 +251,7 @@ void drm_file_free(struct drm_file *file)
> drm_events_release(file);
>
> if (drm_core_check_feature(dev, DRIVER_MODESET) &&
> - drm_dev_enter(dev, &idx)) {
> + !WARN_ON(!drm_dev_enter(dev, &idx))) {
> drm_fb_release(file);
> drm_property_destroy_user_blobs(dev, file);
> drm_dev_exit(idx);
With or without the simpledrm changes above ?
Thanks,
Guenter
> ---------------
>> Guenter
>>
>> ---
>> [ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 12:10:19 PDT 2026
>> [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.18.20-spi+ root=UUID=ce436484-f920-47a8-a8c4-c17ff3a877e8 ro quiet splash amdgpu.gpu_recovery=1 amdgpu.ppfeaturemask=0xfff73fff vt.handoff=7
>> ...
>> [ 3.806644] nouveau 0000:2b:00.0: NVIDIA GK208B (b060b0b1)
>> ...
>> [ 4.644370] nouveau 0000:2b:00.0: drm: VRAM: 2048 MiB
>> [ 4.644373] nouveau 0000:2b:00.0: drm: GART: 1048576 MiB
>> [ 4.644375] nouveau 0000:2b:00.0: drm: TMDS table version 2.0
>> [ 4.645032] nouveau 0000:2b:00.0: drm: MM: using COPY for buffer copies
>> [ 4.645959] snd_hda_intel 0000:2b:00.1: bound 0000:2b:00.0 (ops nv50_audio_component_bind_ops [nouveau])
>> [ 4.647016] nouveau 0000:2b:00.0: [drm] Registered 4 planes with drm panic
>> [ 4.647019] [drm] Initialized nouveau 1.4.0 for 0000:2b:00.0 on minor 1
>> ...
>> [ 4.728390] fbcon: nouveaudrmfb (fb0) is primary device
>> [ 4.728392] fbcon: Deferring console take-over
>> [ 4.728393] nouveau 0000:2b:00.0: [drm] fb0: nouveaudrmfb frame buffer device
>> [ 4.826620] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
>> ...
>> [ 4.986925] ------------[ cut here ]------------
>> [ 4.986926] refcount_t: addition on 0; use-after-free.
>> [ 4.986933] WARNING: CPU: 2 PID: 493 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x150
>> [ 4.986938] Modules linked in: qrtr bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep kvm_amd snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi kvm snd_seq btusb snd_seq_device snd_timer btmtk btrtl irqbypass polyval_clmulni btbcm snd ghash_clmulni_intel btintel aesni_intel bluetooth joydev input_leds ee1004 soundcore ccp rapl nouveau mxm_wmi drm_gpuvm gpu_sched drm_ttm_helper ttm drm_exec drm_display_helper cec rc_core i2c_piix4 video i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid igb nvme_core r8169 i2c_algo_bit nvme_keyring ahci realtek dca nvme_auth libahci hkdf wmi
>> [ 4.986973] CPU: 2 UID: 0 PID: 493 Comm: plymouthd Not tainted 6.18.20-spi+ #1 PREEMPT(full)
>> [ 4.986974] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
>> [ 4.986975] RIP: 0010:refcount_warn_saturate+0x12e/0x150
>> [ 4.986977] Code: 1d 28 43 ec 01 80 fb 01 0f 87 fe 61 6c ff 83 e3 01 0f 85 52 ff ff ff 48 c7 c7 18 a3 66 89 c6 05 08 43 ec 01 01 e8 a2 76 80 ff <0f> 0b e9 38 ff ff ff 48 c7 c7 f0 a2 66 89 c6 05 ef 42 ec 01 01 e8
>> [ 4.986978] RSP: 0018:ffffcdec80873990 EFLAGS: 00010246
>> [ 4.986979] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
>> [ 4.986979] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
>> [ 4.986980] RBP: ffffcdec80873998 R08: 0000000000000000 R09: 0000000000000000
>> [ 4.986980] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8af0493f7c80
>> [ 4.986981] R13: ffff8af0493f7c80 R14: ffff8af04085e740 R15: dead000000000100
>> [ 4.986982] FS: 0000739d3374e000(0000) GS:ffff8aff93d73000(0000) knlGS:0000000000000000
>> [ 4.986983] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 4.986983] CR2: 0000739d2f268000 CR3: 0000000113bd6000 CR4: 0000000000f50ef0
>> [ 4.986984] PKRU: 55555554
>> [ 4.986984] Call Trace:
>> [ 4.986985] <TASK>
>> [ 4.986987] drm_dev_get+0x53/0x80
>> [ 4.986989] drm_atomic_state_init+0x7b/0xe0
>> [ 4.986991] drm_atomic_state_alloc+0x98/0xb0
>> [ 4.986992] drm_atomic_helper_disable_all+0x1d/0x1c0
>> [ 4.986994] drm_atomic_helper_shutdown+0x9c/0x140
>> [ 4.986995] simpledrm_shutdown+0xe/0x20
>> [ 4.986997] drm_managed_release+0x8f/0x160
>> [ 4.986999] drm_minor_release+0x5f/0x90
>> [ 4.987000] drm_release+0xda/0x140
>> [ 4.987001] __fput+0xed/0x2d0
>> [ 4.987010] fput_close_sync+0x3d/0xa0
>> [ 4.987012] __x64_sys_close+0x3e/0x90
>> [ 4.987015] x64_sys_call+0x1b5e/0x26a0
>> [ 4.987019] do_syscall_64+0x80/0x530
>> [ 4.987022] ? x64_sys_call+0x1144/0x26a0
>> [ 4.987024] ? do_syscall_64+0xb8/0x530
>> [ 4.987025] ? from_kgid_munged+0x17/0x30
>> [ 4.987028] ? cp_new_stat+0x141/0x180
>> [ 4.987030] ? __do_sys_newfstat+0x4c/0x80
>> [ 4.987032] ? __x64_sys_newfstat+0x15/0x20
>> [ 4.987034] ? x64_sys_call+0x204a/0x26a0
>> [ 4.987035] ? do_syscall_64+0xb8/0x530
>> [ 4.987037] ? __x64_sys_newfstat+0x15/0x20
>> [ 4.987038] ? x64_sys_call+0x204a/0x26a0
>> [ 4.987040] ? do_syscall_64+0xb8/0x530
>> [ 4.987041] ? irqentry_exit_to_user_mode+0x2e/0x320
>> [ 4.987043] ? irqentry_exit+0x43/0x50
>> [ 4.987044] ? exc_page_fault+0x90/0x1b0
>> [ 4.987046] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> [ 4.987047] RIP: 0033:0x739d339f774c
>> [ 4.987048] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
>> [ 4.987049] RSP: 002b:00007ffd8ca10660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
>> [ 4.987050] RAX: ffffffffffffffda RBX: 0000615423195870 RCX: 0000739d339f774c
>> [ 4.987051] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
>> [ 4.987052] RBP: 00007ffd8ca10670 R08: 0000000615423196 R09: 0000000000000007
>> [ 4.987053] R10: 0000615423196bc0 R11: 0000000000000293 R12: 0000739d3374df88
>> [ 4.987055] R13: 0000000000000013 R14: 0000615423209840 R15: 0000615423194130
>> [ 4.987057] </TASK>
>> [ 4.987058] ---[ end trace 0000000000000000 ]---
>> [ 4.987114] ------------[ cut here ]------------
>> [ 4.987115] refcount_t: underflow; use-after-free.
>> [ 4.987119] WARNING: CPU: 2 PID: 493 at lib/refcount.c:28 refcount_warn_saturate+0xfb/0x150
>> [ 4.987121] Modules linked in: qrtr bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep kvm_amd snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi kvm snd_seq btusb snd_seq_device snd_timer btmtk btrtl irqbypass polyval_clmulni btbcm snd ghash_clmulni_intel btintel aesni_intel bluetooth joydev input_leds ee1004 soundcore ccp rapl nouveau mxm_wmi drm_gpuvm gpu_sched drm_ttm_helper ttm drm_exec drm_display_helper cec rc_core i2c_piix4 video i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid igb nvme_core r8169 i2c_algo_bit nvme_keyring ahci realtek dca nvme_auth libahci hkdf wmi
>> [ 4.987147] CPU: 2 UID: 0 PID: 493 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
>> [ 4.987149] Tainted: [W]=WARN
>> [ 4.987149] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
>> [ 4.987150] RIP: 0010:refcount_warn_saturate+0xfb/0x150
>> [ 4.987151] Code: eb 9a 0f b6 1d 56 43 ec 01 80 fb 01 0f 87 41 62 6c ff 83 e3 01 75 85 48 c7 c7 48 a3 66 89 c6 05 3a 43 ec 01 01 e8 d5 76 80 ff <0f> 0b e9 6b ff ff ff 0f b6 1d 28 43 ec 01 80 fb 01 0f 87 fe 61 6c
>> [ 4.987152] RSP: 0018:ffffcdec808739b0 EFLAGS: 00010246
>> [ 4.987153] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
>> [ 4.987154] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
>> [ 4.987154] RBP: ffffcdec808739b8 R08: 0000000000000000 R09: 0000000000000000
>> [ 4.987155] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8af045e46000
>> [ 4.987155] R13: ffff8af042b0ba00 R14: ffff8af04085e740 R15: dead000000000100
>> [ 4.987156] FS: 0000739d3374e000(0000) GS:ffff8aff93d73000(0000) knlGS:0000000000000000
>> [ 4.987157] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 4.987158] CR2: 0000739d2f268000 CR3: 0000000113bd6000 CR4: 0000000000f50ef0
>> [ 4.987159] PKRU: 55555554
>> [ 4.987159] Call Trace:
>> [ 4.987159] <TASK>
>> [ 4.987160] drm_dev_put+0x8c/0x90
>> [ 4.987162] __drm_atomic_state_free+0xbe/0xe0
>> [ 4.987163] drm_atomic_helper_disable_all+0xd0/0x1c0
>> [ 4.987164] drm_atomic_helper_shutdown+0x9c/0x140
>> [ 4.987165] simpledrm_shutdown+0xe/0x20
>> [ 4.987167] drm_managed_release+0x8f/0x160
>> [ 4.987168] drm_minor_release+0x5f/0x90
>> [ 4.987169] drm_release+0xda/0x140
>> [ 4.987171] __fput+0xed/0x2d0
>> [ 4.987172] fput_close_sync+0x3d/0xa0
>> [ 4.987174] __x64_sys_close+0x3e/0x90
>> [ 4.987175] x64_sys_call+0x1b5e/0x26a0
>> [ 4.987177] do_syscall_64+0x80/0x530
>> [ 4.987178] ? x64_sys_call+0x1144/0x26a0
>> [ 4.987180] ? do_syscall_64+0xb8/0x530
>> [ 4.987182] ? from_kgid_munged+0x17/0x30
>> [ 4.987183] ? cp_new_stat+0x141/0x180
>> [ 4.987185] ? __do_sys_newfstat+0x4c/0x80
>> [ 4.987187] ? __x64_sys_newfstat+0x15/0x20
>> [ 4.987188] ? x64_sys_call+0x204a/0x26a0
>> [ 4.987189] ? do_syscall_64+0xb8/0x530
>> [ 4.987191] ? __x64_sys_newfstat+0x15/0x20
>> [ 4.987193] ? x64_sys_call+0x204a/0x26a0
>> [ 4.987194] ? do_syscall_64+0xb8/0x530
>> [ 4.987195] ? irqentry_exit_to_user_mode+0x2e/0x320
>> [ 4.987196] ? irqentry_exit+0x43/0x50
>> [ 4.987197] ? exc_page_fault+0x90/0x1b0
>> [ 4.987199] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> [ 4.987200] RIP: 0033:0x739d339f774c
>> [ 4.987201] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
>> [ 4.987201] RSP: 002b:00007ffd8ca10660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
>> [ 4.987202] RAX: ffffffffffffffda RBX: 0000615423195870 RCX: 0000739d339f774c
>> [ 4.987203] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
>> [ 4.987203] RBP: 00007ffd8ca10670 R08: 0000000615423196 R09: 0000000000000007
>> [ 4.987204] R10: 0000615423196bc0 R11: 0000000000000293 R12: 0000739d3374df88
>> [ 4.987204] R13: 0000000000000013 R14: 0000615423209840 R15: 0000615423194130
>> [ 4.987206] </TASK>
>> [ 4.987206] ---[ end trace 0000000000000000 ]---
>> [ 4.987226] ------------[ cut here ]------------
>> [ 4.987227] WARNING: CPU: 2 PID: 493 at drivers/gpu/drm/drm_mode_config.c:571 drm_mode_config_cleanup+0x34f/0x360
>> [ 4.987229] Modules linked in: qrtr bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep kvm_amd snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi kvm snd_seq btusb snd_seq_device snd_timer btmtk btrtl irqbypass polyval_clmulni btbcm snd ghash_clmulni_intel btintel aesni_intel bluetooth joydev input_leds ee1004 soundcore ccp rapl nouveau mxm_wmi drm_gpuvm gpu_sched drm_ttm_helper ttm drm_exec drm_display_helper cec rc_core i2c_piix4 video i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid igb nvme_core r8169 i2c_algo_bit nvme_keyring ahci realtek dca nvme_auth libahci hkdf wmi
>> [ 4.987252] CPU: 2 UID: 0 PID: 493 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
>> [ 4.987254] Tainted: [W]=WARN
>> [ 4.987255] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
>> [ 4.987255] RIP: 0010:drm_mode_config_cleanup+0x34f/0x360
>> [ 4.987257] Code: 70 60 48 c7 c7 d7 90 73 89 e8 3d bb 00 00 48 8d 7d 88 e8 c4 32 fe ff 48 85 c0 75 e2 48 8d 7d 88 e8 d6 31 fe ff e9 7b fd ff ff <0f> 0b e9 79 fe ff ff 0f 0b eb 8e e8 01 a4 65 00 90 90 90 90 90 90
>> [ 4.987257] RSP: 0018:ffffcdec80873a10 EFLAGS: 00010297
>> [ 4.987258] RAX: ffff8af053f78e48 RBX: ffff8af045e46368 RCX: 0000000000000000
>> [ 4.987259] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8af045e46368
>> [ 4.987259] RBP: ffffcdec80873a90 R08: 0000000000000000 R09: 0000000000000000
>> [ 4.987260] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8af045e46000
>> [ 4.987260] R13: ffff8af045e46390 R14: ffff8af045e46230 R15: dead000000000100
>> [ 4.987261] FS: 0000739d3374e000(0000) GS:ffff8aff93d73000(0000) knlGS:0000000000000000
>> [ 4.987262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 4.987262] CR2: 0000739d2f268000 CR3: 0000000113bd6000 CR4: 0000000000f50ef0
>> [ 4.987263] PKRU: 55555554
>> [ 4.987263] Call Trace:
>> [ 4.987264] <TASK>
>> [ 4.987264] ? drm_managed_release+0xc2/0x160
>> [ 4.987266] drm_mode_config_init_release+0xe/0x20
>> [ 4.987267] drm_managed_release+0x8f/0x160
>> [ 4.987268] drm_minor_release+0x5f/0x90
>> [ 4.987269] drm_release+0xda/0x140
>> [ 4.987271] __fput+0xed/0x2d0
>> [ 4.987272] fput_close_sync+0x3d/0xa0
>> [ 4.987273] __x64_sys_close+0x3e/0x90
>> [ 4.987275] x64_sys_call+0x1b5e/0x26a0
>> [ 4.987276] do_syscall_64+0x80/0x530
>> [ 4.987278] ? x64_sys_call+0x1144/0x26a0
>> [ 4.987279] ? do_syscall_64+0xb8/0x530
>> [ 4.987281] ? from_kgid_munged+0x17/0x30
>> [ 4.987282] ? cp_new_stat+0x141/0x180
>> [ 4.987284] ? __do_sys_newfstat+0x4c/0x80
>> [ 4.987286] ? __x64_sys_newfstat+0x15/0x20
>> [ 4.987287] ? x64_sys_call+0x204a/0x26a0
>> [ 4.987289] ? do_syscall_64+0xb8/0x530
>> [ 4.987290] ? __x64_sys_newfstat+0x15/0x20
>> [ 4.987291] ? x64_sys_call+0x204a/0x26a0
>> [ 4.987293] ? do_syscall_64+0xb8/0x530
>> [ 4.987294] ? irqentry_exit_to_user_mode+0x2e/0x320
>> [ 4.987295] ? irqentry_exit+0x43/0x50
>> [ 4.987296] ? exc_page_fault+0x90/0x1b0
>> [ 4.987298] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> [ 4.987298] RIP: 0033:0x739d339f774c
>> [ 4.987299] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
>> [ 4.987300] RSP: 002b:00007ffd8ca10660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
>> [ 4.987301] RAX: ffffffffffffffda RBX: 0000615423195870 RCX: 0000739d339f774c
>> [ 4.987302] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
>> [ 4.987302] RBP: 00007ffd8ca10670 R08: 0000000615423196 R09: 0000000000000007
>> [ 4.987303] R10: 0000615423196bc0 R11: 0000000000000293 R12: 0000739d3374df88
>> [ 4.987303] R13: 0000000000000013 R14: 0000615423209840 R15: 0000615423194130
>> [ 4.987304] </TASK>
>> [ 4.987305] ---[ end trace 0000000000000000 ]---
>> ...
>> [ 5.124594] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
>> ...
>> [ 14.891109] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
>> [ 14.891114] fbcon: Taking over console
>> [ 14.923125] Console: switching to colour frame buffer device 240x67
>> [ 15.349010] workqueue: drm_fb_helper_damage_work hogged CPU for >10000us 4 times, consider switching to WQ_UNBOUND
>> [ 16.124537] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
>> [ 17.855855] nouveau 0000:2b:00.0: drm: Failure to read SCDC_TMDS_CONFIG: -6
>
^ permalink raw reply [flat|nested] 33+ messages in thread
* ✓ Xe.CI.BAT: success for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev4)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (9 preceding siblings ...)
2026-03-25 20:37 ` ✓ CI.KUnit: success " Patchwork
@ 2026-03-25 21:10 ` Patchwork
2026-03-26 6:48 ` ✗ Xe.CI.FULL: failure " Patchwork
` (4 subsequent siblings)
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-25 21:10 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
[-- Attachment #1: Type: text/plain, Size: 2368 bytes --]
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev4)
URL : https://patchwork.freedesktop.org/series/162134/
State : success
== Summary ==
CI Bug Log - changes from xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611_BAT -> xe-pw-162134v4_BAT
====================================================
Summary
-------
**SUCCESS**
No regressions found.
Participating hosts (14 -> 14)
------------------------------
No changes in participating hosts
Known issues
------------
Here are the changes found in xe-pw-162134v4_BAT that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@kms_flip@basic-flip-vs-wf_vblank@c-edp1:
- bat-adlp-7: [PASS][1] -> [DMESG-WARN][2] ([Intel XE#7483])
[1]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@c-edp1.html
[2]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v4/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@c-edp1.html
#### Possible fixes ####
* igt@kms_flip@basic-flip-vs-wf_vblank@d-edp1:
- bat-adlp-7: [DMESG-WARN][3] ([Intel XE#7483]) -> [PASS][4]
[3]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@d-edp1.html
[4]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v4/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@d-edp1.html
* igt@xe_waitfence@engine:
- bat-dg2-oem2: [FAIL][5] ([Intel XE#6519]) -> [PASS][6]
[5]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611/bat-dg2-oem2/igt@xe_waitfence@engine.html
[6]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v4/bat-dg2-oem2/igt@xe_waitfence@engine.html
[Intel XE#6519]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6519
[Intel XE#7483]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7483
Build changes
-------------
* Linux: xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611 -> xe-pw-162134v4
IGT_8827: 8827
xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611: ec0484d20b9f962d04a62ff1feb03676c3ce7611
xe-pw-162134v4: 162134v4
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v4/index.html
[-- Attachment #2: Type: text/html, Size: 3065 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH v2 1/1] drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
2026-03-25 17:26 ` Guenter Roeck
` (2 preceding siblings ...)
2026-03-25 18:28 ` Maarten Lankhorst
@ 2026-03-25 21:11 ` Simona Vetter
2026-03-26 8:22 ` [PATCH] Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Maarten Lankhorst
3 siblings, 1 reply; 33+ messages in thread
From: Simona Vetter @ 2026-03-25 21:11 UTC (permalink / raw)
To: Guenter Roeck
Cc: Maarten Lankhorst, dri-devel, intel-xe, Thomas Hellström
On Wed, Mar 25, 2026 at 10:26:40AM -0700, Guenter Roeck wrote:
> Hi,
>
> On Fri, Mar 13, 2026 at 04:17:27PM +0100, Maarten Lankhorst wrote:
> > When trying to do a rather aggressive test of igt's "xe_module_load
> > --r reload" with a full desktop environment and game running I noticed
> > a few OOPSes when dereferencing freed pointers, related to
> > framebuffers and property blobs after the compositor exits.
> >
> > Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
> > and immediately put the references from struct drm_file objects during
> > drm_dev_unplug().
> >
>
> With this patch in v6.18.20, I get the warning backtraces below.
> The backtraces are gone with the patch reverted.
Yeah, this needs to be reverted, reasoning below. Maarten, can you please
take care of that and feed the revert through the usual channels? I don't
think it's critical enough that we need to fast-track this into drm.git
directly.
Quoting the patch here again:
> drivers/gpu/drm/drm_file.c | 5 ++++-
> drivers/gpu/drm/drm_mode_config.c | 9 ++++++---
> 2 files changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
> index ec820686b3021..f52141f842a1f 100644
> --- a/drivers/gpu/drm/drm_file.c
> +++ b/drivers/gpu/drm/drm_file.c
> @@ -233,6 +233,7 @@ static void drm_events_release(struct drm_file *file_priv)
> void drm_file_free(struct drm_file *file)
> {
> struct drm_device *dev;
> + int idx;
>
> if (!file)
> return;
> @@ -249,9 +250,11 @@ void drm_file_free(struct drm_file *file)
>
> drm_events_release(file);
>
> - if (drm_core_check_feature(dev, DRIVER_MODESET)) {
> + if (drm_core_check_feature(dev, DRIVER_MODESET) &&
> + drm_dev_enter(dev, &idx)) {
This is misplaced for two reasons:
- Even if we'd want to guarantee that we hold a drm_dev_enter/exit
reference during framebuffer teardown, we'd need to do this
_consistently over all callsites. Not ad-hoc in just one place that a
testcase hits. This also means kerneldoc updates of the relevant hooks
and at least a bunch of acks from other driver people to document the
consensus.
- More importantly, this is driver responsibilities in general unless we
have extremely good reasons to the contrary. Which means this must be
placed in xe.
> drm_fb_release(file);
> drm_property_destroy_user_blobs(dev, file);
> + drm_dev_exit(idx);
> }
>
> if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
> diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c
> index 84ae8a23a3678..e349418978f79 100644
> --- a/drivers/gpu/drm/drm_mode_config.c
> +++ b/drivers/gpu/drm/drm_mode_config.c
> @@ -583,10 +583,13 @@ void drm_mode_config_cleanup(struct drm_device *dev)
> */
> WARN_ON(!list_empty(&dev->mode_config.fb_list));
> list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
> - struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
> + if (list_empty(&fb->filp_head) || drm_framebuffer_read_refcount(fb) > 1) {
> + struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
This is also wrong:
- Firstly, it's a completely independent bug, we do not smash two bugfixes
into one patch.
- Secondly, it's again a driver bug: drm_mode_cleanup must be called when
the last drm_device reference disappears (hence the existence of
drmm_mode_config_init), not when the driver gets unbound. The fact that
this shows up in a callchain from a devres cleanup means the intel
driver gets this wrong (like almost everyone else because historically
we didn't know better).
If we don't follow this rule, then we get races with this code here
running concurrently with drm_file fb cleanups, which just does not
work. Review pointed that out, but then shrugged it off with a confused
explanation:
https://lore.kernel.org/all/e61e64c796ccfb17ae673331a3df4b877bf42d82.camel@linux.intel.com/
Yes this also means a lot of the other drm_device teardown that drivers
do happens way too early. There is a massive can of worms here of a
magnitude that most likely is much, much bigger than what you can
backport to stable kernels. Hotunplug is _hard_.
Anyway, with the above as justification, on the revert:
Acked-by: Simona Vetter <simona.vetter@ffwll.ch>
And I Reported-by credits to Guenter.
Cheers, Sima
>
> - drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
> - drm_framebuffer_print_info(&p, 1, fb);
> + drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
> + drm_framebuffer_print_info(&p, 1, fb);
> + }
> + list_del_init(&fb->filp_head);
> drm_framebuffer_free(&fb->base.refcount);
> }
>
> Guenter
>
> ---
> [ 0.000000] Linux version 6.18.20-spi+ (groeck@server.roeck-us.net) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #1 SMP PREEMPT_DYNAMIC Wed Mar 25 08:22:19 PDT 2026
> [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.18.20-spi+ root=UUID=ce436484-f920-47a8-a8c4-c17ff3a877e8 ro quiet splash amdgpu.gpu_recovery=1 amdgpu.ppfeaturemask=0xfff73fff vt.handoff=7
> ...
> [ 4.254064] nouveau 0000:2b:00.0: NVIDIA GK208B (b060b0b1)
> ...
> [ 5.440862] ------------[ cut here ]------------
> [ 5.440864] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:537 drm_mode_config_cleanup+0x313/0x360
> [ 5.440868] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.440902] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Not tainted 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.440903] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.440904] RIP: 0010:drm_mode_config_cleanup+0x313/0x360
> [ 5.440906] Code: 8b 45 d0 65 48 2b 05 84 22 0b 02 75 64 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 48 8d 75 88 4c 89 e7 e8 1f 12 fe ff eb 10 48 8b 70 60 48 c7
> [ 5.440907] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010202
> [ 5.440908] RAX: ffff89bcc2268258 RBX: ffff89bcc2268290 RCX: 0000000000000000
> [ 5.440909] RDX: ffff89bcc2269308 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.440909] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
> [ 5.440910] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
> [ 5.440910] R13: ffff89bcc2268298 R14: ffff89bcc5c3f480 R15: dead000000000100
> [ 5.440911] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.440912] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.440912] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.440913] PKRU: 55555554
> [ 5.440914] Call Trace:
> [ 5.440914] <TASK>
> [ 5.440916] ? drm_managed_release+0xc2/0x160
> [ 5.440918] drm_mode_config_init_release+0xe/0x20
> [ 5.440919] drm_managed_release+0x8f/0x160
> [ 5.440920] drm_minor_release+0x5f/0x90
> [ 5.440921] drm_release+0xda/0x140
> [ 5.440923] __fput+0xed/0x2d0
> [ 5.440925] fput_close_sync+0x3d/0xa0
> [ 5.440927] __x64_sys_close+0x3e/0x90
> [ 5.440928] x64_sys_call+0x1b5e/0x26a0
> [ 5.440930] do_syscall_64+0x80/0x570
> [ 5.440934] ? x64_sys_call+0x1144/0x26a0
> [ 5.440935] ? do_syscall_64+0xb8/0x570
> [ 5.440937] ? __vm_munmap+0xdb/0x190
> [ 5.440939] ? __x64_sys_munmap+0x1b/0x30
> [ 5.440941] ? x64_sys_call+0x1be5/0x26a0
> [ 5.440942] ? do_syscall_64+0xb8/0x570
> [ 5.440943] ? irqentry_exit+0x43/0x50
> [ 5.440944] ? exc_page_fault+0x90/0x1b0
> [ 5.440946] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.440947] RIP: 0033:0x713c256fa74c
> [ 5.440948] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.440949] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.440950] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.440951] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.440951] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.440952] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.440952] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.440953] </TASK>
> [ 5.440954] ---[ end trace 0000000000000000 ]---
> [ 5.440955] [drm:drm_mode_config_cleanup] *ERROR* connector Unknown-1 leaked!
> [ 5.440971] ------------[ cut here ]------------
> [ 5.440971] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_mode_config.c:571 drm_mode_config_cleanup+0x34f/0x360
> [ 5.440973] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.440995] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.440997] Tainted: [W]=WARN
> [ 5.440997] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.440998] RIP: 0010:drm_mode_config_cleanup+0x34f/0x360
> [ 5.440999] Code: 70 60 48 c7 c7 a7 90 93 ba e8 3d bb 00 00 48 8d 7d 88 e8 c4 32 fe ff 48 85 c0 75 e2 48 8d 7d 88 e8 d6 31 fe ff e9 7b fd ff ff <0f> 0b e9 79 fe ff ff 0f 0b eb 8e e8 01 a4 65 00 90 90 90 90 90 90
> [ 5.441000] RSP: 0018:ffffcf1442017bb0 EFLAGS: 00010293
> [ 5.441001] RAX: ffff89bcd7c61bc8 RBX: ffff89bcc2268368 RCX: 0000000000000000
> [ 5.441001] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff89bcc2268368
> [ 5.441002] RBP: ffffcf1442017c30 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441002] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2268000
> [ 5.441002] R13: ffff89bcc2268390 R14: ffff89bcc2268230 R15: dead000000000100
> [ 5.441003] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441004] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441005] PKRU: 55555554
> [ 5.441005] Call Trace:
> [ 5.441006] <TASK>
> [ 5.441006] ? drm_managed_release+0xc2/0x160
> [ 5.441008] drm_mode_config_init_release+0xe/0x20
> [ 5.441009] drm_managed_release+0x8f/0x160
> [ 5.441010] drm_minor_release+0x5f/0x90
> [ 5.441011] drm_release+0xda/0x140
> [ 5.441012] __fput+0xed/0x2d0
> [ 5.441013] fput_close_sync+0x3d/0xa0
> [ 5.441014] __x64_sys_close+0x3e/0x90
> [ 5.441015] x64_sys_call+0x1b5e/0x26a0
> [ 5.441017] do_syscall_64+0x80/0x570
> [ 5.441018] ? x64_sys_call+0x1144/0x26a0
> [ 5.441019] ? do_syscall_64+0xb8/0x570
> [ 5.441021] ? __vm_munmap+0xdb/0x190
> [ 5.441023] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441024] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441025] ? do_syscall_64+0xb8/0x570
> [ 5.441026] ? irqentry_exit+0x43/0x50
> [ 5.441027] ? exc_page_fault+0x90/0x1b0
> [ 5.441029] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441029] RIP: 0033:0x713c256fa74c
> [ 5.441030] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441031] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441031] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441032] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441032] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441033] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441033] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441035] </TASK>
> [ 5.441035] ---[ end trace 0000000000000000 ]---
> [ 5.441036] ------------[ cut here ]------------
> [ 5.441036] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->vmap_use_count))
> [ 5.441041] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:170 drm_gem_shmem_free+0x111/0x1a0
> [ 5.441043] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.441066] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.441067] Tainted: [W]=WARN
> [ 5.441067] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.441068] RIP: 0010:drm_gem_shmem_free+0x111/0x1a0
> [ 5.441069] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 68 4f 02 00 48 c7 c1 e8 03 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 8f 09 46 ff <0f> 0b e9 4b ff ff ff 48 8b 7b 08 48 85 ff 74 04 48 8b 7f 08 4c 8b
> [ 5.441070] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
> [ 5.441070] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
> [ 5.441071] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.441071] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441072] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
> [ 5.441072] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
> [ 5.441073] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441073] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441074] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441075] PKRU: 55555554
> [ 5.441075] Call Trace:
> [ 5.441075] <TASK>
> [ 5.441076] drm_gem_shmem_object_free+0x9/0x20
> [ 5.441077] drm_gem_object_handle_put_unlocked+0x12c/0x140
> [ 5.441079] drm_framebuffer_cleanup+0x60/0xe0
> [ 5.441080] drm_gem_fb_destroy+0x79/0xc0
> [ 5.441081] drm_framebuffer_free+0x43/0xa0
> [ 5.441083] drm_mode_config_cleanup+0x29c/0x360
> [ 5.441084] ? drm_mode_config_cleanup+0x1f2/0x360
> [ 5.441085] ? drm_managed_release+0xc2/0x160
> [ 5.441086] drm_mode_config_init_release+0xe/0x20
> [ 5.441087] drm_managed_release+0x8f/0x160
> [ 5.441088] drm_minor_release+0x5f/0x90
> [ 5.441089] drm_release+0xda/0x140
> [ 5.441090] __fput+0xed/0x2d0
> [ 5.441091] fput_close_sync+0x3d/0xa0
> [ 5.441092] __x64_sys_close+0x3e/0x90
> [ 5.441094] x64_sys_call+0x1b5e/0x26a0
> [ 5.441095] do_syscall_64+0x80/0x570
> [ 5.441096] ? x64_sys_call+0x1144/0x26a0
> [ 5.441097] ? do_syscall_64+0xb8/0x570
> [ 5.441099] ? __vm_munmap+0xdb/0x190
> [ 5.441101] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441102] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441103] ? do_syscall_64+0xb8/0x570
> [ 5.441104] ? irqentry_exit+0x43/0x50
> [ 5.441105] ? exc_page_fault+0x90/0x1b0
> [ 5.441106] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441107] RIP: 0033:0x713c256fa74c
> [ 5.441108] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441109] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441109] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441110] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441111] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441111] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441112] </TASK>
> [ 5.441113] ---[ end trace 0000000000000000 ]---
> [ 5.441151] ------------[ cut here ]------------
> [ 5.441152] platform simple-framebuffer.0: [drm] drm_WARN_ON(refcount_read(&shmem->pages_pin_count))
> [ 5.441155] WARNING: CPU: 5 PID: 502 at drivers/gpu/drm/drm_gem_shmem_helper.c:182 drm_gem_shmem_free+0x18d/0x1a0
> [ 5.441157] Modules linked in: qrtr cmac algif_hash algif_skcipher af_alg bnep sunrpc binfmt_misc nls_iso8859_1 amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_nvhdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec btusb btmtk snd_hda_core btrtl btbcm snd_intel_dspcfg btintel snd_intel_sdw_acpi snd_hwdep edac_mce_amd nouveau bluetooth snd_pcm kvm_amd snd_seq_midi mxm_wmi snd_seq_midi_event drm_gpuvm joydev input_leds snd_rawmidi ee1004 gpu_sched kvm snd_seq snd_seq_device irqbypass polyval_clmulni snd_timer ghash_clmulni_intel aesni_intel drm_ttm_helper snd rapl ttm drm_exec drm_display_helper cec rc_core video i2c_piix4 ccp soundcore i2c_smbus wmi_bmof k10temp bfq gpio_amdpt mac_hid sch_fq_codel nct6683 msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic nvme usbhid hid nvme_core igb r8169 nvme_keyring i2c_algo_bit nvme_auth ahci realtek dca hkdf libahci wmi
> [ 5.441179] CPU: 5 UID: 0 PID: 502 Comm: plymouthd Tainted: G W 6.18.20-spi+ #1 PREEMPT(full)
> [ 5.441180] Tainted: [W]=WARN
> [ 5.441180] Hardware name: Micro-Star International Co., Ltd. MS-7C94/MAG B550M MORTAR MAX WIFI (MS-7C94), BIOS 1.G0 08/22/2023
> [ 5.441181] RIP: 0010:drm_gem_shmem_free+0x18d/0x1a0
> [ 5.441182] Code: 4c 8b 67 50 4d 85 e4 75 03 4c 8b 27 e8 ec 4e 02 00 48 c7 c1 58 04 8a ba 4c 89 e2 48 c7 c7 66 7b 93 ba 48 89 c6 e8 13 09 46 ff <0f> 0b e9 35 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90
> [ 5.441182] RSP: 0018:ffffcf1442017ad0 EFLAGS: 00010246
> [ 5.441183] RAX: 0000000000000000 RBX: ffff89bcc8704400 RCX: 0000000000000000
> [ 5.441184] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 5.441184] RBP: ffffcf1442017ae0 R08: 0000000000000000 R09: 0000000000000000
> [ 5.441184] R10: 0000000000000000 R11: 0000000000000000 R12: ffff89bcc2bec900
> [ 5.441185] R13: ffff89bcc2268000 R14: 0000000000000000 R15: ffff89bcc2268228
> [ 5.441186] FS: 0000713c25451000(0000) GS:ffff89cbe2cf3000(0000) knlGS:0000000000000000
> [ 5.441186] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5.441187] CR2: 0000713c1bfff000 CR3: 00000001179c3000 CR4: 0000000000f50ef0
> [ 5.441187] PKRU: 55555554
> [ 5.441188] Call Trace:
> [ 5.441188] <TASK>
> [ 5.441188] drm_gem_shmem_object_free+0x9/0x20
> [ 5.441189] drm_gem_object_handle_put_unlocked+0x12c/0x140
> [ 5.441191] drm_framebuffer_cleanup+0x60/0xe0
> [ 5.441192] drm_gem_fb_destroy+0x79/0xc0
> [ 5.441193] drm_framebuffer_free+0x43/0xa0
> [ 5.441194] drm_mode_config_cleanup+0x29c/0x360
> [ 5.441195] ? drm_mode_config_cleanup+0x1f2/0x360
> [ 5.441196] ? drm_managed_release+0xc2/0x160
> [ 5.441197] drm_mode_config_init_release+0xe/0x20
> [ 5.441198] drm_managed_release+0x8f/0x160
> [ 5.441199] drm_minor_release+0x5f/0x90
> [ 5.441200] drm_release+0xda/0x140
> [ 5.441201] __fput+0xed/0x2d0
> [ 5.441202] fput_close_sync+0x3d/0xa0
> [ 5.441204] __x64_sys_close+0x3e/0x90
> [ 5.441205] x64_sys_call+0x1b5e/0x26a0
> [ 5.441206] do_syscall_64+0x80/0x570
> [ 5.441208] ? x64_sys_call+0x1144/0x26a0
> [ 5.441209] ? do_syscall_64+0xb8/0x570
> [ 5.441210] ? __vm_munmap+0xdb/0x190
> [ 5.441212] ? __x64_sys_munmap+0x1b/0x30
> [ 5.441213] ? x64_sys_call+0x1be5/0x26a0
> [ 5.441214] ? do_syscall_64+0xb8/0x570
> [ 5.441216] ? irqentry_exit+0x43/0x50
> [ 5.441216] ? exc_page_fault+0x90/0x1b0
> [ 5.441218] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 5.441219] RIP: 0033:0x713c256fa74c
> [ 5.441219] Code: 0f 05 48 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d fc e8 10 1e f8 ff 8b 7d fc 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2c 89 d7 89 45 fc e8 72 1e f8 ff 8b 45 fc c9
> [ 5.441234] RSP: 002b:00007ffc9c194100 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 5.441236] RAX: ffffffffffffffda RBX: 000055df73527870 RCX: 0000713c256fa74c
> [ 5.441237] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
> [ 5.441238] RBP: 00007ffc9c194110 R08: 000000055df73528 R09: 0000000000000007
> [ 5.441238] R10: 000055df73528bc0 R11: 0000000000000293 R12: 0000713c25450f88
> [ 5.441239] R13: 0000000000000013 R14: 000055df7356f6b0 R15: 000055df73526130
> [ 5.441241] </TASK>
> [ 5.441241] ---[ end trace 0000000000000000 ]---
--
Simona Vetter
Software Engineer
http://blog.ffwll.ch
^ permalink raw reply [flat|nested] 33+ messages in thread
* ✗ Xe.CI.FULL: failure for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev4)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (10 preceding siblings ...)
2026-03-25 21:10 ` ✓ Xe.CI.BAT: " Patchwork
@ 2026-03-26 6:48 ` Patchwork
2026-03-26 8:27 ` ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev5) Patchwork
` (3 subsequent siblings)
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-26 6:48 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
[-- Attachment #1: Type: text/plain, Size: 3651 bytes --]
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev4)
URL : https://patchwork.freedesktop.org/series/162134/
State : failure
== Summary ==
CI Bug Log - changes from xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611_FULL -> xe-pw-162134v4_FULL
====================================================
Summary
-------
**FAILURE**
Serious unknown changes coming with xe-pw-162134v4_FULL absolutely need to be
verified manually.
If you think the reported changes have nothing to do with the changes
introduced in xe-pw-162134v4_FULL, please notify your bug team (I915-ci-infra@lists.freedesktop.org) to allow them
to document this new failure mode, which will reduce false positives in CI.
Participating hosts (2 -> 2)
------------------------------
No changes in participating hosts
Possible new issues
-------------------
Here are the unknown changes that may have been introduced in xe-pw-162134v4_FULL:
### IGT changes ###
#### Possible regressions ####
* igt@core_hotunplug@hotreplug-lateclose:
- shard-lnl: [PASS][1] -> [ABORT][2] +6 other tests abort
[1]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611/shard-lnl-6/igt@core_hotunplug@hotreplug-lateclose.html
[2]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v4/shard-lnl-2/igt@core_hotunplug@hotreplug-lateclose.html
Known issues
------------
Here are the changes found in xe-pw-162134v4_FULL that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@xe_exec_system_allocator@pat-index-madvise-pat-idx-uc-multi-vma:
- shard-lnl: [PASS][3] -> [FAIL][4] ([Intel XE#5625])
[3]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611/shard-lnl-8/igt@xe_exec_system_allocator@pat-index-madvise-pat-idx-uc-multi-vma.html
[4]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v4/shard-lnl-5/igt@xe_exec_system_allocator@pat-index-madvise-pat-idx-uc-multi-vma.html
#### Possible fixes ####
* igt@kms_flip@flip-vs-expired-vblank-interruptible:
- shard-lnl: [FAIL][5] ([Intel XE#301] / [Intel XE#3149]) -> [PASS][6] +1 other test pass
[5]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611/shard-lnl-7/igt@kms_flip@flip-vs-expired-vblank-interruptible.html
[6]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v4/shard-lnl-2/igt@kms_flip@flip-vs-expired-vblank-interruptible.html
* igt@kms_pm_dc@deep-pkgc:
- shard-lnl: [FAIL][7] ([Intel XE#2029] / [Intel XE#7395]) -> [PASS][8]
[7]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611/shard-lnl-6/igt@kms_pm_dc@deep-pkgc.html
[8]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v4/shard-lnl-3/igt@kms_pm_dc@deep-pkgc.html
[Intel XE#2029]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2029
[Intel XE#301]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/301
[Intel XE#3149]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/3149
[Intel XE#5625]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/5625
[Intel XE#7395]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7395
Build changes
-------------
* Linux: xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611 -> xe-pw-162134v4
IGT_8827: 8827
xe-4785-ec0484d20b9f962d04a62ff1feb03676c3ce7611: ec0484d20b9f962d04a62ff1feb03676c3ce7611
xe-pw-162134v4: 162134v4
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v4/index.html
[-- Attachment #2: Type: text/html, Size: 4300 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread
* [PATCH] Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"
2026-03-25 21:11 ` Simona Vetter
@ 2026-03-26 8:22 ` Maarten Lankhorst
2026-03-26 11:24 ` Guenter Roeck
0 siblings, 1 reply; 33+ messages in thread
From: Maarten Lankhorst @ 2026-03-26 8:22 UTC (permalink / raw)
To: dri-devel
Cc: intel-xe, Maarten Lankhorst, Thomas Hellström, Guenter Roeck,
Simona Vetter
This reverts commit 6bee098b91417654703e17eb5c1822c6dfd0c01d.
Den 2026-03-25 kl. 22:11, skrev Simona Vetter:
> On Wed, Mar 25, 2026 at 10:26:40AM -0700, Guenter Roeck wrote:
>> Hi,
>>
>> On Fri, Mar 13, 2026 at 04:17:27PM +0100, Maarten Lankhorst wrote:
>>> When trying to do a rather aggressive test of igt's "xe_module_load
>>> --r reload" with a full desktop environment and game running I noticed
>>> a few OOPSes when dereferencing freed pointers, related to
>>> framebuffers and property blobs after the compositor exits.
>>>
>>> Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
>>> and immediately put the references from struct drm_file objects during
>>> drm_dev_unplug().
>>>
>>
>> With this patch in v6.18.20, I get the warning backtraces below.
>> The backtraces are gone with the patch reverted.
>
> Yeah, this needs to be reverted, reasoning below. Maarten, can you please
> take care of that and feed the revert through the usual channels? I don't
> think it's critical enough that we need to fast-track this into drm.git
> directly.
>
> Quoting the patch here again:
>
>> drivers/gpu/drm/drm_file.c | 5 ++++-
>> drivers/gpu/drm/drm_mode_config.c | 9 ++++++---
>> 2 files changed, 10 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
>> index ec820686b3021..f52141f842a1f 100644
>> --- a/drivers/gpu/drm/drm_file.c
>> +++ b/drivers/gpu/drm/drm_file.c
>> @@ -233,6 +233,7 @@ static void drm_events_release(struct drm_file *file_priv)
>> void drm_file_free(struct drm_file *file)
>> {
>> struct drm_device *dev;
>> + int idx;
>>
>> if (!file)
>> return;
>> @@ -249,9 +250,11 @@ void drm_file_free(struct drm_file *file)
>>
>> drm_events_release(file);
>>
>> - if (drm_core_check_feature(dev, DRIVER_MODESET)) {
>> + if (drm_core_check_feature(dev, DRIVER_MODESET) &&
>> + drm_dev_enter(dev, &idx)) {
>
> This is misplaced for two reasons:
>
> - Even if we'd want to guarantee that we hold a drm_dev_enter/exit
> reference during framebuffer teardown, we'd need to do this
> _consistently over all callsites. Not ad-hoc in just one place that a
> testcase hits. This also means kerneldoc updates of the relevant hooks
> and at least a bunch of acks from other driver people to document the
> consensus.
>
> - More importantly, this is driver responsibilities in general unless we
> have extremely good reasons to the contrary. Which means this must be
> placed in xe.
>
>> drm_fb_release(file);
>> drm_property_destroy_user_blobs(dev, file);
>> + drm_dev_exit(idx);
>> }
>>
>> if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
>> diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c
>> index 84ae8a23a3678..e349418978f79 100644
>> --- a/drivers/gpu/drm/drm_mode_config.c
>> +++ b/drivers/gpu/drm/drm_mode_config.c
>> @@ -583,10 +583,13 @@ void drm_mode_config_cleanup(struct drm_device *dev)
>> */
>> WARN_ON(!list_empty(&dev->mode_config.fb_list));
>> list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
>> - struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
>> + if (list_empty(&fb->filp_head) || drm_framebuffer_read_refcount(fb) > 1) {
>> + struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
>
> This is also wrong:
>
> - Firstly, it's a completely independent bug, we do not smash two bugfixes
> into one patch.
>
> - Secondly, it's again a driver bug: drm_mode_cleanup must be called when
> the last drm_device reference disappears (hence the existence of
> drmm_mode_config_init), not when the driver gets unbound. The fact that
> this shows up in a callchain from a devres cleanup means the intel
> driver gets this wrong (like almost everyone else because historically
> we didn't know better).
>
> If we don't follow this rule, then we get races with this code here
> running concurrently with drm_file fb cleanups, which just does not
> work. Review pointed that out, but then shrugged it off with a confused
> explanation:
>
> https://lore.kernel.org/all/e61e64c796ccfb17ae673331a3df4b877bf42d82.camel@linux.intel.com/
>
> Yes this also means a lot of the other drm_device teardown that drivers
> do happens way too early. There is a massive can of worms here of a
> magnitude that most likely is much, much bigger than what you can
> backport to stable kernels. Hotunplug is _hard_.
Back to the drawing board, and fixing it in the intel display driver
instead.
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reported-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Simona Vetter <simona.vetter@ffwll.ch>
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Fixes: 6bee098b9141 ("drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug")
---
drivers/gpu/drm/drm_file.c | 5 +----
drivers/gpu/drm/drm_mode_config.c | 9 +++------
2 files changed, 4 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index f52141f842a1f..ec820686b3021 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -233,7 +233,6 @@ static void drm_events_release(struct drm_file *file_priv)
void drm_file_free(struct drm_file *file)
{
struct drm_device *dev;
- int idx;
if (!file)
return;
@@ -250,11 +249,9 @@ void drm_file_free(struct drm_file *file)
drm_events_release(file);
- if (drm_core_check_feature(dev, DRIVER_MODESET) &&
- drm_dev_enter(dev, &idx)) {
+ if (drm_core_check_feature(dev, DRIVER_MODESET)) {
drm_fb_release(file);
drm_property_destroy_user_blobs(dev, file);
- drm_dev_exit(idx);
}
if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c
index 802bc4608abf5..d12db9b0bab81 100644
--- a/drivers/gpu/drm/drm_mode_config.c
+++ b/drivers/gpu/drm/drm_mode_config.c
@@ -577,13 +577,10 @@ void drm_mode_config_cleanup(struct drm_device *dev)
*/
WARN_ON(!list_empty(&dev->mode_config.fb_list));
list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
- if (list_empty(&fb->filp_head) || drm_framebuffer_read_refcount(fb) > 1) {
- struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
+ struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
- drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
- drm_framebuffer_print_info(&p, 1, fb);
- }
- list_del_init(&fb->filp_head);
+ drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
+ drm_framebuffer_print_info(&p, 1, fb);
drm_framebuffer_free(&fb->base.refcount);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 33+ messages in thread
* ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev5)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (11 preceding siblings ...)
2026-03-26 6:48 ` ✗ Xe.CI.FULL: failure " Patchwork
@ 2026-03-26 8:27 ` Patchwork
2026-03-26 8:28 ` ✓ CI.KUnit: success " Patchwork
` (2 subsequent siblings)
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-26 8:27 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev5)
URL : https://patchwork.freedesktop.org/series/162134/
State : warning
== Summary ==
+ KERNEL=/kernel
+ git clone https://gitlab.freedesktop.org/drm/maintainer-tools mt
Cloning into 'mt'...
warning: redirecting to https://gitlab.freedesktop.org/drm/maintainer-tools.git/
+ git -C mt rev-list -n1 origin/master
1f57ba1afceae32108bd24770069f764d940a0e4
+ cd /kernel
+ git config --global --add safe.directory /kernel
+ git log -n1
commit 73681c3564e3cee535999de6d1545ef9b59b2da4
Author: Maarten Lankhorst <dev@lankhorst.se>
Date: Thu Mar 26 09:22:18 2026 +0100
Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"
This reverts commit 6bee098b91417654703e17eb5c1822c6dfd0c01d.
Den 2026-03-25 kl. 22:11, skrev Simona Vetter:
> On Wed, Mar 25, 2026 at 10:26:40AM -0700, Guenter Roeck wrote:
>> Hi,
>>
>> On Fri, Mar 13, 2026 at 04:17:27PM +0100, Maarten Lankhorst wrote:
>>> When trying to do a rather aggressive test of igt's "xe_module_load
>>> --r reload" with a full desktop environment and game running I noticed
>>> a few OOPSes when dereferencing freed pointers, related to
>>> framebuffers and property blobs after the compositor exits.
>>>
>>> Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
>>> and immediately put the references from struct drm_file objects during
>>> drm_dev_unplug().
>>>
>>
>> With this patch in v6.18.20, I get the warning backtraces below.
>> The backtraces are gone with the patch reverted.
>
> Yeah, this needs to be reverted, reasoning below. Maarten, can you please
> take care of that and feed the revert through the usual channels? I don't
> think it's critical enough that we need to fast-track this into drm.git
> directly.
>
> Quoting the patch here again:
>
>> drivers/gpu/drm/drm_file.c | 5 ++++-
>> drivers/gpu/drm/drm_mode_config.c | 9 ++++++---
>> 2 files changed, 10 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
>> index ec820686b3021..f52141f842a1f 100644
>> --- a/drivers/gpu/drm/drm_file.c
>> +++ b/drivers/gpu/drm/drm_file.c
>> @@ -233,6 +233,7 @@ static void drm_events_release(struct drm_file *file_priv)
>> void drm_file_free(struct drm_file *file)
>> {
>> struct drm_device *dev;
>> + int idx;
>>
>> if (!file)
>> return;
>> @@ -249,9 +250,11 @@ void drm_file_free(struct drm_file *file)
>>
>> drm_events_release(file);
>>
>> - if (drm_core_check_feature(dev, DRIVER_MODESET)) {
>> + if (drm_core_check_feature(dev, DRIVER_MODESET) &&
>> + drm_dev_enter(dev, &idx)) {
>
> This is misplaced for two reasons:
>
> - Even if we'd want to guarantee that we hold a drm_dev_enter/exit
> reference during framebuffer teardown, we'd need to do this
> _consistently over all callsites. Not ad-hoc in just one place that a
> testcase hits. This also means kerneldoc updates of the relevant hooks
> and at least a bunch of acks from other driver people to document the
> consensus.
>
> - More importantly, this is driver responsibilities in general unless we
> have extremely good reasons to the contrary. Which means this must be
> placed in xe.
>
>> drm_fb_release(file);
>> drm_property_destroy_user_blobs(dev, file);
>> + drm_dev_exit(idx);
>> }
>>
>> if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))
>> diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c
>> index 84ae8a23a3678..e349418978f79 100644
>> --- a/drivers/gpu/drm/drm_mode_config.c
>> +++ b/drivers/gpu/drm/drm_mode_config.c
>> @@ -583,10 +583,13 @@ void drm_mode_config_cleanup(struct drm_device *dev)
>> */
>> WARN_ON(!list_empty(&dev->mode_config.fb_list));
>> list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
>> - struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
>> + if (list_empty(&fb->filp_head) || drm_framebuffer_read_refcount(fb) > 1) {
>> + struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
>
> This is also wrong:
>
> - Firstly, it's a completely independent bug, we do not smash two bugfixes
> into one patch.
>
> - Secondly, it's again a driver bug: drm_mode_cleanup must be called when
> the last drm_device reference disappears (hence the existence of
> drmm_mode_config_init), not when the driver gets unbound. The fact that
> this shows up in a callchain from a devres cleanup means the intel
> driver gets this wrong (like almost everyone else because historically
> we didn't know better).
>
> If we don't follow this rule, then we get races with this code here
> running concurrently with drm_file fb cleanups, which just does not
> work. Review pointed that out, but then shrugged it off with a confused
> explanation:
>
> https://lore.kernel.org/all/e61e64c796ccfb17ae673331a3df4b877bf42d82.camel@linux.intel.com/
>
> Yes this also means a lot of the other drm_device teardown that drivers
> do happens way too early. There is a massive can of worms here of a
> magnitude that most likely is much, much bigger than what you can
> backport to stable kernels. Hotunplug is _hard_.
Back to the drawing board, and fixing it in the intel display driver
instead.
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reported-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Simona Vetter <simona.vetter@ffwll.ch>
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Fixes: 6bee098b9141 ("drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug")
+ /mt/dim checkpatch ddf93a5c967d452d7c3ab937818c20b95498842d drm-intel
73681c3564e3 Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"
-:45: WARNING:COMMIT_LOG_LONG_LINE: Prefer a maximum 75 chars per line (possible unwrapped commit description?)
#45:
>> @@ -233,6 +233,7 @@ static void drm_events_release(struct drm_file *file_priv)
-:120: WARNING:BAD_REPORTED_BY_LINK: Reported-by: should be immediately followed by Closes: with a URL to the report
#120:
Reported-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Simona Vetter <simona.vetter@ffwll.ch>
total: 0 errors, 2 warnings, 0 checks, 35 lines checked
^ permalink raw reply [flat|nested] 33+ messages in thread
* ✓ CI.KUnit: success for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev5)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (12 preceding siblings ...)
2026-03-26 8:27 ` ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev5) Patchwork
@ 2026-03-26 8:28 ` Patchwork
2026-03-26 9:03 ` ✓ Xe.CI.BAT: " Patchwork
2026-03-26 20:53 ` ✓ Xe.CI.FULL: " Patchwork
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-26 8:28 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev5)
URL : https://patchwork.freedesktop.org/series/162134/
State : success
== Summary ==
+ trap cleanup EXIT
+ /kernel/tools/testing/kunit/kunit.py run --kunitconfig /kernel/drivers/gpu/drm/xe/.kunitconfig
[08:27:40] Configuring KUnit Kernel ...
Generating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[08:27:44] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=48
[08:28:15] Starting KUnit Kernel (1/1)...
[08:28:15] ============================================================
Running tests with:
$ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[08:28:15] ================== guc_buf (11 subtests) ===================
[08:28:15] [PASSED] test_smallest
[08:28:15] [PASSED] test_largest
[08:28:15] [PASSED] test_granular
[08:28:15] [PASSED] test_unique
[08:28:15] [PASSED] test_overlap
[08:28:15] [PASSED] test_reusable
[08:28:15] [PASSED] test_too_big
[08:28:15] [PASSED] test_flush
[08:28:15] [PASSED] test_lookup
[08:28:15] [PASSED] test_data
[08:28:15] [PASSED] test_class
[08:28:15] ===================== [PASSED] guc_buf =====================
[08:28:15] =================== guc_dbm (7 subtests) ===================
[08:28:15] [PASSED] test_empty
[08:28:15] [PASSED] test_default
[08:28:15] ======================== test_size ========================
[08:28:15] [PASSED] 4
[08:28:15] [PASSED] 8
[08:28:15] [PASSED] 32
[08:28:15] [PASSED] 256
[08:28:15] ==================== [PASSED] test_size ====================
[08:28:15] ======================= test_reuse ========================
[08:28:15] [PASSED] 4
[08:28:15] [PASSED] 8
[08:28:15] [PASSED] 32
[08:28:15] [PASSED] 256
[08:28:15] =================== [PASSED] test_reuse ====================
[08:28:15] =================== test_range_overlap ====================
[08:28:15] [PASSED] 4
[08:28:15] [PASSED] 8
[08:28:15] [PASSED] 32
[08:28:15] [PASSED] 256
[08:28:15] =============== [PASSED] test_range_overlap ================
[08:28:15] =================== test_range_compact ====================
[08:28:15] [PASSED] 4
[08:28:15] [PASSED] 8
[08:28:15] [PASSED] 32
[08:28:15] [PASSED] 256
[08:28:15] =============== [PASSED] test_range_compact ================
[08:28:15] ==================== test_range_spare =====================
[08:28:15] [PASSED] 4
[08:28:15] [PASSED] 8
[08:28:15] [PASSED] 32
[08:28:15] [PASSED] 256
[08:28:15] ================ [PASSED] test_range_spare =================
[08:28:15] ===================== [PASSED] guc_dbm =====================
[08:28:15] =================== guc_idm (6 subtests) ===================
[08:28:15] [PASSED] bad_init
[08:28:15] [PASSED] no_init
[08:28:15] [PASSED] init_fini
[08:28:15] [PASSED] check_used
[08:28:15] [PASSED] check_quota
[08:28:15] [PASSED] check_all
[08:28:15] ===================== [PASSED] guc_idm =====================
[08:28:15] ================== no_relay (3 subtests) ===================
[08:28:15] [PASSED] xe_drops_guc2pf_if_not_ready
[08:28:15] [PASSED] xe_drops_guc2vf_if_not_ready
[08:28:15] [PASSED] xe_rejects_send_if_not_ready
[08:28:15] ==================== [PASSED] no_relay =====================
[08:28:15] ================== pf_relay (14 subtests) ==================
[08:28:15] [PASSED] pf_rejects_guc2pf_too_short
[08:28:15] [PASSED] pf_rejects_guc2pf_too_long
[08:28:15] [PASSED] pf_rejects_guc2pf_no_payload
[08:28:15] [PASSED] pf_fails_no_payload
[08:28:15] [PASSED] pf_fails_bad_origin
[08:28:15] [PASSED] pf_fails_bad_type
[08:28:15] [PASSED] pf_txn_reports_error
[08:28:15] [PASSED] pf_txn_sends_pf2guc
[08:28:15] [PASSED] pf_sends_pf2guc
[08:28:15] [SKIPPED] pf_loopback_nop
[08:28:15] [SKIPPED] pf_loopback_echo
[08:28:15] [SKIPPED] pf_loopback_fail
[08:28:15] [SKIPPED] pf_loopback_busy
[08:28:15] [SKIPPED] pf_loopback_retry
[08:28:15] ==================== [PASSED] pf_relay =====================
[08:28:15] ================== vf_relay (3 subtests) ===================
[08:28:15] [PASSED] vf_rejects_guc2vf_too_short
[08:28:15] [PASSED] vf_rejects_guc2vf_too_long
[08:28:15] [PASSED] vf_rejects_guc2vf_no_payload
[08:28:15] ==================== [PASSED] vf_relay =====================
[08:28:15] ================ pf_gt_config (9 subtests) =================
[08:28:15] [PASSED] fair_contexts_1vf
[08:28:15] [PASSED] fair_doorbells_1vf
[08:28:15] [PASSED] fair_ggtt_1vf
[08:28:15] ====================== fair_vram_1vf ======================
[08:28:15] [PASSED] 3.50 GiB
[08:28:15] [PASSED] 11.5 GiB
[08:28:15] [PASSED] 15.5 GiB
[08:28:15] [PASSED] 31.5 GiB
[08:28:15] [PASSED] 63.5 GiB
[08:28:15] [PASSED] 1.91 GiB
[08:28:15] ================== [PASSED] fair_vram_1vf ==================
[08:28:15] ================ fair_vram_1vf_admin_only =================
[08:28:15] [PASSED] 3.50 GiB
[08:28:15] [PASSED] 11.5 GiB
[08:28:15] [PASSED] 15.5 GiB
[08:28:15] [PASSED] 31.5 GiB
[08:28:15] [PASSED] 63.5 GiB
[08:28:15] [PASSED] 1.91 GiB
[08:28:15] ============ [PASSED] fair_vram_1vf_admin_only =============
[08:28:15] ====================== fair_contexts ======================
[08:28:15] [PASSED] 1 VF
[08:28:15] [PASSED] 2 VFs
[08:28:15] [PASSED] 3 VFs
[08:28:15] [PASSED] 4 VFs
[08:28:15] [PASSED] 5 VFs
[08:28:15] [PASSED] 6 VFs
[08:28:15] [PASSED] 7 VFs
[08:28:15] [PASSED] 8 VFs
[08:28:15] [PASSED] 9 VFs
[08:28:15] [PASSED] 10 VFs
[08:28:15] [PASSED] 11 VFs
[08:28:15] [PASSED] 12 VFs
[08:28:15] [PASSED] 13 VFs
[08:28:15] [PASSED] 14 VFs
[08:28:15] [PASSED] 15 VFs
[08:28:15] [PASSED] 16 VFs
[08:28:15] [PASSED] 17 VFs
[08:28:15] [PASSED] 18 VFs
[08:28:15] [PASSED] 19 VFs
[08:28:15] [PASSED] 20 VFs
[08:28:15] [PASSED] 21 VFs
[08:28:15] [PASSED] 22 VFs
[08:28:15] [PASSED] 23 VFs
[08:28:15] [PASSED] 24 VFs
[08:28:15] [PASSED] 25 VFs
[08:28:15] [PASSED] 26 VFs
[08:28:15] [PASSED] 27 VFs
[08:28:15] [PASSED] 28 VFs
[08:28:15] [PASSED] 29 VFs
[08:28:15] [PASSED] 30 VFs
[08:28:15] [PASSED] 31 VFs
[08:28:15] [PASSED] 32 VFs
[08:28:15] [PASSED] 33 VFs
[08:28:15] [PASSED] 34 VFs
[08:28:15] [PASSED] 35 VFs
[08:28:15] [PASSED] 36 VFs
[08:28:15] [PASSED] 37 VFs
[08:28:15] [PASSED] 38 VFs
[08:28:15] [PASSED] 39 VFs
[08:28:15] [PASSED] 40 VFs
[08:28:15] [PASSED] 41 VFs
[08:28:15] [PASSED] 42 VFs
[08:28:15] [PASSED] 43 VFs
[08:28:15] [PASSED] 44 VFs
[08:28:15] [PASSED] 45 VFs
[08:28:15] [PASSED] 46 VFs
[08:28:15] [PASSED] 47 VFs
[08:28:15] [PASSED] 48 VFs
[08:28:15] [PASSED] 49 VFs
[08:28:15] [PASSED] 50 VFs
[08:28:15] [PASSED] 51 VFs
[08:28:15] [PASSED] 52 VFs
[08:28:15] [PASSED] 53 VFs
[08:28:15] [PASSED] 54 VFs
[08:28:15] [PASSED] 55 VFs
[08:28:15] [PASSED] 56 VFs
[08:28:15] [PASSED] 57 VFs
[08:28:15] [PASSED] 58 VFs
[08:28:15] [PASSED] 59 VFs
[08:28:15] [PASSED] 60 VFs
[08:28:15] [PASSED] 61 VFs
[08:28:15] [PASSED] 62 VFs
[08:28:15] [PASSED] 63 VFs
[08:28:15] ================== [PASSED] fair_contexts ==================
[08:28:15] ===================== fair_doorbells ======================
[08:28:15] [PASSED] 1 VF
[08:28:15] [PASSED] 2 VFs
[08:28:15] [PASSED] 3 VFs
[08:28:15] [PASSED] 4 VFs
[08:28:15] [PASSED] 5 VFs
[08:28:15] [PASSED] 6 VFs
[08:28:15] [PASSED] 7 VFs
[08:28:15] [PASSED] 8 VFs
[08:28:15] [PASSED] 9 VFs
[08:28:15] [PASSED] 10 VFs
[08:28:15] [PASSED] 11 VFs
[08:28:15] [PASSED] 12 VFs
[08:28:15] [PASSED] 13 VFs
[08:28:15] [PASSED] 14 VFs
[08:28:15] [PASSED] 15 VFs
[08:28:15] [PASSED] 16 VFs
[08:28:15] [PASSED] 17 VFs
[08:28:15] [PASSED] 18 VFs
[08:28:15] [PASSED] 19 VFs
[08:28:15] [PASSED] 20 VFs
[08:28:15] [PASSED] 21 VFs
[08:28:15] [PASSED] 22 VFs
[08:28:15] [PASSED] 23 VFs
[08:28:15] [PASSED] 24 VFs
[08:28:15] [PASSED] 25 VFs
[08:28:15] [PASSED] 26 VFs
[08:28:15] [PASSED] 27 VFs
[08:28:15] [PASSED] 28 VFs
[08:28:15] [PASSED] 29 VFs
[08:28:15] [PASSED] 30 VFs
[08:28:15] [PASSED] 31 VFs
[08:28:15] [PASSED] 32 VFs
[08:28:15] [PASSED] 33 VFs
[08:28:15] [PASSED] 34 VFs
[08:28:15] [PASSED] 35 VFs
[08:28:15] [PASSED] 36 VFs
[08:28:15] [PASSED] 37 VFs
[08:28:15] [PASSED] 38 VFs
[08:28:15] [PASSED] 39 VFs
[08:28:15] [PASSED] 40 VFs
[08:28:15] [PASSED] 41 VFs
[08:28:15] [PASSED] 42 VFs
[08:28:15] [PASSED] 43 VFs
[08:28:15] [PASSED] 44 VFs
[08:28:15] [PASSED] 45 VFs
[08:28:15] [PASSED] 46 VFs
[08:28:15] [PASSED] 47 VFs
[08:28:15] [PASSED] 48 VFs
[08:28:15] [PASSED] 49 VFs
[08:28:15] [PASSED] 50 VFs
[08:28:15] [PASSED] 51 VFs
[08:28:15] [PASSED] 52 VFs
[08:28:15] [PASSED] 53 VFs
[08:28:15] [PASSED] 54 VFs
[08:28:15] [PASSED] 55 VFs
[08:28:15] [PASSED] 56 VFs
[08:28:15] [PASSED] 57 VFs
[08:28:15] [PASSED] 58 VFs
[08:28:15] [PASSED] 59 VFs
[08:28:15] [PASSED] 60 VFs
[08:28:15] [PASSED] 61 VFs
[08:28:15] [PASSED] 62 VFs
[08:28:15] [PASSED] 63 VFs
[08:28:15] ================= [PASSED] fair_doorbells ==================
[08:28:15] ======================== fair_ggtt ========================
[08:28:15] [PASSED] 1 VF
[08:28:15] [PASSED] 2 VFs
[08:28:15] [PASSED] 3 VFs
[08:28:15] [PASSED] 4 VFs
[08:28:15] [PASSED] 5 VFs
[08:28:15] [PASSED] 6 VFs
[08:28:15] [PASSED] 7 VFs
[08:28:15] [PASSED] 8 VFs
[08:28:15] [PASSED] 9 VFs
[08:28:15] [PASSED] 10 VFs
[08:28:15] [PASSED] 11 VFs
[08:28:15] [PASSED] 12 VFs
[08:28:15] [PASSED] 13 VFs
[08:28:15] [PASSED] 14 VFs
[08:28:15] [PASSED] 15 VFs
[08:28:15] [PASSED] 16 VFs
[08:28:15] [PASSED] 17 VFs
[08:28:15] [PASSED] 18 VFs
[08:28:15] [PASSED] 19 VFs
[08:28:15] [PASSED] 20 VFs
[08:28:15] [PASSED] 21 VFs
[08:28:15] [PASSED] 22 VFs
[08:28:15] [PASSED] 23 VFs
[08:28:15] [PASSED] 24 VFs
[08:28:15] [PASSED] 25 VFs
[08:28:15] [PASSED] 26 VFs
[08:28:15] [PASSED] 27 VFs
[08:28:15] [PASSED] 28 VFs
[08:28:15] [PASSED] 29 VFs
[08:28:15] [PASSED] 30 VFs
[08:28:15] [PASSED] 31 VFs
[08:28:15] [PASSED] 32 VFs
[08:28:15] [PASSED] 33 VFs
[08:28:15] [PASSED] 34 VFs
[08:28:15] [PASSED] 35 VFs
[08:28:15] [PASSED] 36 VFs
[08:28:15] [PASSED] 37 VFs
[08:28:15] [PASSED] 38 VFs
[08:28:15] [PASSED] 39 VFs
[08:28:15] [PASSED] 40 VFs
[08:28:15] [PASSED] 41 VFs
[08:28:15] [PASSED] 42 VFs
[08:28:15] [PASSED] 43 VFs
[08:28:15] [PASSED] 44 VFs
[08:28:15] [PASSED] 45 VFs
[08:28:15] [PASSED] 46 VFs
[08:28:15] [PASSED] 47 VFs
[08:28:15] [PASSED] 48 VFs
[08:28:15] [PASSED] 49 VFs
[08:28:15] [PASSED] 50 VFs
[08:28:15] [PASSED] 51 VFs
[08:28:15] [PASSED] 52 VFs
[08:28:15] [PASSED] 53 VFs
[08:28:15] [PASSED] 54 VFs
[08:28:15] [PASSED] 55 VFs
[08:28:15] [PASSED] 56 VFs
[08:28:15] [PASSED] 57 VFs
[08:28:15] [PASSED] 58 VFs
[08:28:15] [PASSED] 59 VFs
[08:28:15] [PASSED] 60 VFs
[08:28:15] [PASSED] 61 VFs
[08:28:15] [PASSED] 62 VFs
[08:28:15] [PASSED] 63 VFs
[08:28:15] ==================== [PASSED] fair_ggtt ====================
[08:28:15] ======================== fair_vram ========================
[08:28:15] [PASSED] 1 VF
[08:28:15] [PASSED] 2 VFs
[08:28:15] [PASSED] 3 VFs
[08:28:15] [PASSED] 4 VFs
[08:28:15] [PASSED] 5 VFs
[08:28:15] [PASSED] 6 VFs
[08:28:15] [PASSED] 7 VFs
[08:28:15] [PASSED] 8 VFs
[08:28:15] [PASSED] 9 VFs
[08:28:15] [PASSED] 10 VFs
[08:28:15] [PASSED] 11 VFs
[08:28:15] [PASSED] 12 VFs
[08:28:15] [PASSED] 13 VFs
[08:28:15] [PASSED] 14 VFs
[08:28:15] [PASSED] 15 VFs
[08:28:15] [PASSED] 16 VFs
[08:28:15] [PASSED] 17 VFs
[08:28:15] [PASSED] 18 VFs
[08:28:15] [PASSED] 19 VFs
[08:28:15] [PASSED] 20 VFs
[08:28:15] [PASSED] 21 VFs
[08:28:15] [PASSED] 22 VFs
[08:28:15] [PASSED] 23 VFs
[08:28:15] [PASSED] 24 VFs
[08:28:15] [PASSED] 25 VFs
[08:28:15] [PASSED] 26 VFs
[08:28:15] [PASSED] 27 VFs
[08:28:15] [PASSED] 28 VFs
[08:28:15] [PASSED] 29 VFs
[08:28:15] [PASSED] 30 VFs
[08:28:15] [PASSED] 31 VFs
[08:28:15] [PASSED] 32 VFs
[08:28:15] [PASSED] 33 VFs
[08:28:15] [PASSED] 34 VFs
[08:28:15] [PASSED] 35 VFs
[08:28:15] [PASSED] 36 VFs
[08:28:15] [PASSED] 37 VFs
[08:28:15] [PASSED] 38 VFs
[08:28:15] [PASSED] 39 VFs
[08:28:15] [PASSED] 40 VFs
[08:28:15] [PASSED] 41 VFs
[08:28:15] [PASSED] 42 VFs
[08:28:15] [PASSED] 43 VFs
[08:28:15] [PASSED] 44 VFs
[08:28:15] [PASSED] 45 VFs
[08:28:15] [PASSED] 46 VFs
[08:28:15] [PASSED] 47 VFs
[08:28:15] [PASSED] 48 VFs
[08:28:15] [PASSED] 49 VFs
[08:28:15] [PASSED] 50 VFs
[08:28:15] [PASSED] 51 VFs
[08:28:15] [PASSED] 52 VFs
[08:28:15] [PASSED] 53 VFs
[08:28:15] [PASSED] 54 VFs
[08:28:15] [PASSED] 55 VFs
[08:28:15] [PASSED] 56 VFs
[08:28:15] [PASSED] 57 VFs
[08:28:15] [PASSED] 58 VFs
[08:28:15] [PASSED] 59 VFs
[08:28:15] [PASSED] 60 VFs
[08:28:15] [PASSED] 61 VFs
[08:28:15] [PASSED] 62 VFs
[08:28:15] [PASSED] 63 VFs
[08:28:15] ==================== [PASSED] fair_vram ====================
[08:28:15] ================== [PASSED] pf_gt_config ===================
[08:28:15] ===================== lmtt (1 subtest) =====================
[08:28:15] ======================== test_ops =========================
[08:28:15] [PASSED] 2-level
[08:28:15] [PASSED] multi-level
[08:28:15] ==================== [PASSED] test_ops =====================
[08:28:15] ====================== [PASSED] lmtt =======================
[08:28:15] ================= pf_service (11 subtests) =================
[08:28:15] [PASSED] pf_negotiate_any
[08:28:15] [PASSED] pf_negotiate_base_match
[08:28:15] [PASSED] pf_negotiate_base_newer
[08:28:15] [PASSED] pf_negotiate_base_next
[08:28:15] [SKIPPED] pf_negotiate_base_older
[08:28:15] [PASSED] pf_negotiate_base_prev
[08:28:15] [PASSED] pf_negotiate_latest_match
[08:28:15] [PASSED] pf_negotiate_latest_newer
[08:28:15] [PASSED] pf_negotiate_latest_next
[08:28:15] [SKIPPED] pf_negotiate_latest_older
[08:28:15] [SKIPPED] pf_negotiate_latest_prev
[08:28:15] =================== [PASSED] pf_service ====================
[08:28:15] ================= xe_guc_g2g (2 subtests) ==================
[08:28:15] ============== xe_live_guc_g2g_kunit_default ==============
[08:28:15] ========= [SKIPPED] xe_live_guc_g2g_kunit_default ==========
[08:28:15] ============== xe_live_guc_g2g_kunit_allmem ===============
[08:28:15] ========== [SKIPPED] xe_live_guc_g2g_kunit_allmem ==========
[08:28:15] =================== [SKIPPED] xe_guc_g2g ===================
[08:28:15] =================== xe_mocs (2 subtests) ===================
[08:28:15] ================ xe_live_mocs_kernel_kunit ================
[08:28:15] =========== [SKIPPED] xe_live_mocs_kernel_kunit ============
[08:28:15] ================ xe_live_mocs_reset_kunit =================
[08:28:15] ============ [SKIPPED] xe_live_mocs_reset_kunit ============
[08:28:15] ==================== [SKIPPED] xe_mocs =====================
[08:28:15] ================= xe_migrate (2 subtests) ==================
[08:28:15] ================= xe_migrate_sanity_kunit =================
[08:28:15] ============ [SKIPPED] xe_migrate_sanity_kunit =============
[08:28:15] ================== xe_validate_ccs_kunit ==================
[08:28:15] ============= [SKIPPED] xe_validate_ccs_kunit ==============
[08:28:15] =================== [SKIPPED] xe_migrate ===================
[08:28:15] ================== xe_dma_buf (1 subtest) ==================
[08:28:15] ==================== xe_dma_buf_kunit =====================
[08:28:15] ================ [SKIPPED] xe_dma_buf_kunit ================
[08:28:15] =================== [SKIPPED] xe_dma_buf ===================
[08:28:15] ================= xe_bo_shrink (1 subtest) =================
[08:28:15] =================== xe_bo_shrink_kunit ====================
[08:28:15] =============== [SKIPPED] xe_bo_shrink_kunit ===============
[08:28:15] ================== [SKIPPED] xe_bo_shrink ==================
[08:28:15] ==================== xe_bo (2 subtests) ====================
[08:28:15] ================== xe_ccs_migrate_kunit ===================
[08:28:15] ============== [SKIPPED] xe_ccs_migrate_kunit ==============
[08:28:15] ==================== xe_bo_evict_kunit ====================
[08:28:15] =============== [SKIPPED] xe_bo_evict_kunit ================
[08:28:15] ===================== [SKIPPED] xe_bo ======================
[08:28:15] ==================== args (13 subtests) ====================
[08:28:15] [PASSED] count_args_test
[08:28:15] [PASSED] call_args_example
[08:28:15] [PASSED] call_args_test
[08:28:15] [PASSED] drop_first_arg_example
[08:28:15] [PASSED] drop_first_arg_test
[08:28:15] [PASSED] first_arg_example
[08:28:15] [PASSED] first_arg_test
[08:28:15] [PASSED] last_arg_example
[08:28:15] [PASSED] last_arg_test
[08:28:15] [PASSED] pick_arg_example
[08:28:15] [PASSED] if_args_example
[08:28:15] [PASSED] if_args_test
[08:28:15] [PASSED] sep_comma_example
[08:28:15] ====================== [PASSED] args =======================
[08:28:15] =================== xe_pci (3 subtests) ====================
[08:28:15] ==================== check_graphics_ip ====================
[08:28:15] [PASSED] 12.00 Xe_LP
[08:28:15] [PASSED] 12.10 Xe_LP+
[08:28:15] [PASSED] 12.55 Xe_HPG
[08:28:15] [PASSED] 12.60 Xe_HPC
[08:28:15] [PASSED] 12.70 Xe_LPG
[08:28:15] [PASSED] 12.71 Xe_LPG
[08:28:15] [PASSED] 12.74 Xe_LPG+
[08:28:15] [PASSED] 20.01 Xe2_HPG
[08:28:15] [PASSED] 20.02 Xe2_HPG
[08:28:15] [PASSED] 20.04 Xe2_LPG
[08:28:15] [PASSED] 30.00 Xe3_LPG
[08:28:15] [PASSED] 30.01 Xe3_LPG
[08:28:15] [PASSED] 30.03 Xe3_LPG
[08:28:15] [PASSED] 30.04 Xe3_LPG
[08:28:15] [PASSED] 30.05 Xe3_LPG
[08:28:15] [PASSED] 35.10 Xe3p_LPG
[08:28:15] [PASSED] 35.11 Xe3p_XPC
[08:28:15] ================ [PASSED] check_graphics_ip ================
[08:28:15] ===================== check_media_ip ======================
[08:28:15] [PASSED] 12.00 Xe_M
[08:28:15] [PASSED] 12.55 Xe_HPM
[08:28:15] [PASSED] 13.00 Xe_LPM+
[08:28:15] [PASSED] 13.01 Xe2_HPM
[08:28:15] [PASSED] 20.00 Xe2_LPM
[08:28:15] [PASSED] 30.00 Xe3_LPM
[08:28:15] [PASSED] 30.02 Xe3_LPM
[08:28:15] [PASSED] 35.00 Xe3p_LPM
[08:28:15] [PASSED] 35.03 Xe3p_HPM
[08:28:15] ================= [PASSED] check_media_ip ==================
[08:28:15] =================== check_platform_desc ===================
[08:28:15] [PASSED] 0x9A60 (TIGERLAKE)
[08:28:15] [PASSED] 0x9A68 (TIGERLAKE)
[08:28:15] [PASSED] 0x9A70 (TIGERLAKE)
[08:28:15] [PASSED] 0x9A40 (TIGERLAKE)
[08:28:15] [PASSED] 0x9A49 (TIGERLAKE)
[08:28:15] [PASSED] 0x9A59 (TIGERLAKE)
[08:28:15] [PASSED] 0x9A78 (TIGERLAKE)
[08:28:15] [PASSED] 0x9AC0 (TIGERLAKE)
[08:28:15] [PASSED] 0x9AC9 (TIGERLAKE)
[08:28:15] [PASSED] 0x9AD9 (TIGERLAKE)
[08:28:15] [PASSED] 0x9AF8 (TIGERLAKE)
[08:28:15] [PASSED] 0x4C80 (ROCKETLAKE)
[08:28:15] [PASSED] 0x4C8A (ROCKETLAKE)
[08:28:15] [PASSED] 0x4C8B (ROCKETLAKE)
[08:28:15] [PASSED] 0x4C8C (ROCKETLAKE)
[08:28:15] [PASSED] 0x4C90 (ROCKETLAKE)
[08:28:15] [PASSED] 0x4C9A (ROCKETLAKE)
[08:28:15] [PASSED] 0x4680 (ALDERLAKE_S)
[08:28:15] [PASSED] 0x4682 (ALDERLAKE_S)
[08:28:15] [PASSED] 0x4688 (ALDERLAKE_S)
[08:28:15] [PASSED] 0x468A (ALDERLAKE_S)
[08:28:15] [PASSED] 0x468B (ALDERLAKE_S)
[08:28:15] [PASSED] 0x4690 (ALDERLAKE_S)
[08:28:15] [PASSED] 0x4692 (ALDERLAKE_S)
[08:28:15] [PASSED] 0x4693 (ALDERLAKE_S)
[08:28:15] [PASSED] 0x46A0 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46A1 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46A2 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46A3 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46A6 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46A8 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46AA (ALDERLAKE_P)
[08:28:15] [PASSED] 0x462A (ALDERLAKE_P)
[08:28:15] [PASSED] 0x4626 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x4628 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46B0 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46B1 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46B2 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46B3 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46C0 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46C1 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46C2 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46C3 (ALDERLAKE_P)
[08:28:15] [PASSED] 0x46D0 (ALDERLAKE_N)
[08:28:15] [PASSED] 0x46D1 (ALDERLAKE_N)
[08:28:15] [PASSED] 0x46D2 (ALDERLAKE_N)
[08:28:15] [PASSED] 0x46D3 (ALDERLAKE_N)
[08:28:15] [PASSED] 0x46D4 (ALDERLAKE_N)
[08:28:15] [PASSED] 0xA721 (ALDERLAKE_P)
[08:28:15] [PASSED] 0xA7A1 (ALDERLAKE_P)
[08:28:15] [PASSED] 0xA7A9 (ALDERLAKE_P)
[08:28:15] [PASSED] 0xA7AC (ALDERLAKE_P)
[08:28:15] [PASSED] 0xA7AD (ALDERLAKE_P)
[08:28:15] [PASSED] 0xA720 (ALDERLAKE_P)
[08:28:15] [PASSED] 0xA7A0 (ALDERLAKE_P)
[08:28:15] [PASSED] 0xA7A8 (ALDERLAKE_P)
[08:28:15] [PASSED] 0xA7AA (ALDERLAKE_P)
[08:28:15] [PASSED] 0xA7AB (ALDERLAKE_P)
[08:28:15] [PASSED] 0xA780 (ALDERLAKE_S)
[08:28:15] [PASSED] 0xA781 (ALDERLAKE_S)
[08:28:15] [PASSED] 0xA782 (ALDERLAKE_S)
[08:28:15] [PASSED] 0xA783 (ALDERLAKE_S)
[08:28:15] [PASSED] 0xA788 (ALDERLAKE_S)
[08:28:15] [PASSED] 0xA789 (ALDERLAKE_S)
[08:28:15] [PASSED] 0xA78A (ALDERLAKE_S)
[08:28:15] [PASSED] 0xA78B (ALDERLAKE_S)
[08:28:15] [PASSED] 0x4905 (DG1)
[08:28:15] [PASSED] 0x4906 (DG1)
[08:28:15] [PASSED] 0x4907 (DG1)
[08:28:15] [PASSED] 0x4908 (DG1)
[08:28:15] [PASSED] 0x4909 (DG1)
[08:28:15] [PASSED] 0x56C0 (DG2)
[08:28:15] [PASSED] 0x56C2 (DG2)
[08:28:15] [PASSED] 0x56C1 (DG2)
[08:28:15] [PASSED] 0x7D51 (METEORLAKE)
[08:28:15] [PASSED] 0x7DD1 (METEORLAKE)
[08:28:15] [PASSED] 0x7D41 (METEORLAKE)
[08:28:15] [PASSED] 0x7D67 (METEORLAKE)
[08:28:15] [PASSED] 0xB640 (METEORLAKE)
[08:28:15] [PASSED] 0x56A0 (DG2)
[08:28:15] [PASSED] 0x56A1 (DG2)
[08:28:15] [PASSED] 0x56A2 (DG2)
[08:28:15] [PASSED] 0x56BE (DG2)
[08:28:15] [PASSED] 0x56BF (DG2)
[08:28:15] [PASSED] 0x5690 (DG2)
[08:28:15] [PASSED] 0x5691 (DG2)
[08:28:15] [PASSED] 0x5692 (DG2)
[08:28:15] [PASSED] 0x56A5 (DG2)
[08:28:15] [PASSED] 0x56A6 (DG2)
[08:28:15] [PASSED] 0x56B0 (DG2)
[08:28:15] [PASSED] 0x56B1 (DG2)
[08:28:15] [PASSED] 0x56BA (DG2)
[08:28:15] [PASSED] 0x56BB (DG2)
[08:28:15] [PASSED] 0x56BC (DG2)
[08:28:15] [PASSED] 0x56BD (DG2)
[08:28:15] [PASSED] 0x5693 (DG2)
[08:28:15] [PASSED] 0x5694 (DG2)
[08:28:15] [PASSED] 0x5695 (DG2)
[08:28:15] [PASSED] 0x56A3 (DG2)
[08:28:15] [PASSED] 0x56A4 (DG2)
[08:28:15] [PASSED] 0x56B2 (DG2)
[08:28:15] [PASSED] 0x56B3 (DG2)
[08:28:15] [PASSED] 0x5696 (DG2)
[08:28:15] [PASSED] 0x5697 (DG2)
[08:28:15] [PASSED] 0xB69 (PVC)
[08:28:15] [PASSED] 0xB6E (PVC)
[08:28:15] [PASSED] 0xBD4 (PVC)
[08:28:15] [PASSED] 0xBD5 (PVC)
[08:28:15] [PASSED] 0xBD6 (PVC)
[08:28:15] [PASSED] 0xBD7 (PVC)
[08:28:15] [PASSED] 0xBD8 (PVC)
[08:28:15] [PASSED] 0xBD9 (PVC)
[08:28:15] [PASSED] 0xBDA (PVC)
[08:28:15] [PASSED] 0xBDB (PVC)
[08:28:15] [PASSED] 0xBE0 (PVC)
[08:28:15] [PASSED] 0xBE1 (PVC)
[08:28:15] [PASSED] 0xBE5 (PVC)
[08:28:15] [PASSED] 0x7D40 (METEORLAKE)
[08:28:15] [PASSED] 0x7D45 (METEORLAKE)
[08:28:15] [PASSED] 0x7D55 (METEORLAKE)
[08:28:15] [PASSED] 0x7D60 (METEORLAKE)
[08:28:15] [PASSED] 0x7DD5 (METEORLAKE)
[08:28:15] [PASSED] 0x6420 (LUNARLAKE)
[08:28:15] [PASSED] 0x64A0 (LUNARLAKE)
[08:28:15] [PASSED] 0x64B0 (LUNARLAKE)
[08:28:15] [PASSED] 0xE202 (BATTLEMAGE)
[08:28:15] [PASSED] 0xE209 (BATTLEMAGE)
[08:28:15] [PASSED] 0xE20B (BATTLEMAGE)
[08:28:15] [PASSED] 0xE20C (BATTLEMAGE)
[08:28:15] [PASSED] 0xE20D (BATTLEMAGE)
[08:28:15] [PASSED] 0xE210 (BATTLEMAGE)
[08:28:15] [PASSED] 0xE211 (BATTLEMAGE)
[08:28:15] [PASSED] 0xE212 (BATTLEMAGE)
[08:28:15] [PASSED] 0xE216 (BATTLEMAGE)
[08:28:15] [PASSED] 0xE220 (BATTLEMAGE)
[08:28:15] [PASSED] 0xE221 (BATTLEMAGE)
[08:28:15] [PASSED] 0xE222 (BATTLEMAGE)
[08:28:15] [PASSED] 0xE223 (BATTLEMAGE)
[08:28:15] [PASSED] 0xB080 (PANTHERLAKE)
[08:28:15] [PASSED] 0xB081 (PANTHERLAKE)
[08:28:15] [PASSED] 0xB082 (PANTHERLAKE)
[08:28:15] [PASSED] 0xB083 (PANTHERLAKE)
[08:28:15] [PASSED] 0xB084 (PANTHERLAKE)
[08:28:15] [PASSED] 0xB085 (PANTHERLAKE)
[08:28:15] [PASSED] 0xB086 (PANTHERLAKE)
[08:28:15] [PASSED] 0xB087 (PANTHERLAKE)
[08:28:15] [PASSED] 0xB08F (PANTHERLAKE)
[08:28:15] [PASSED] 0xB090 (PANTHERLAKE)
[08:28:15] [PASSED] 0xB0A0 (PANTHERLAKE)
[08:28:15] [PASSED] 0xB0B0 (PANTHERLAKE)
[08:28:15] [PASSED] 0xFD80 (PANTHERLAKE)
[08:28:15] [PASSED] 0xFD81 (PANTHERLAKE)
[08:28:15] [PASSED] 0xD740 (NOVALAKE_S)
[08:28:15] [PASSED] 0xD741 (NOVALAKE_S)
[08:28:15] [PASSED] 0xD742 (NOVALAKE_S)
[08:28:15] [PASSED] 0xD743 (NOVALAKE_S)
[08:28:15] [PASSED] 0xD744 (NOVALAKE_S)
[08:28:15] [PASSED] 0xD745 (NOVALAKE_S)
[08:28:15] [PASSED] 0x674C (CRESCENTISLAND)
[08:28:15] [PASSED] 0xD750 (NOVALAKE_P)
[08:28:15] [PASSED] 0xD751 (NOVALAKE_P)
[08:28:15] [PASSED] 0xD752 (NOVALAKE_P)
[08:28:15] [PASSED] 0xD753 (NOVALAKE_P)
[08:28:15] [PASSED] 0xD754 (NOVALAKE_P)
[08:28:15] [PASSED] 0xD755 (NOVALAKE_P)
[08:28:15] [PASSED] 0xD756 (NOVALAKE_P)
[08:28:15] [PASSED] 0xD757 (NOVALAKE_P)
[08:28:15] [PASSED] 0xD75F (NOVALAKE_P)
[08:28:15] =============== [PASSED] check_platform_desc ===============
[08:28:15] ===================== [PASSED] xe_pci ======================
[08:28:15] =================== xe_rtp (2 subtests) ====================
[08:28:15] =============== xe_rtp_process_to_sr_tests ================
[08:28:15] [PASSED] coalesce-same-reg
[08:28:15] [PASSED] no-match-no-add
[08:28:15] [PASSED] match-or
[08:28:15] [PASSED] match-or-xfail
[08:28:15] [PASSED] no-match-no-add-multiple-rules
[08:28:15] [PASSED] two-regs-two-entries
[08:28:15] [PASSED] clr-one-set-other
[08:28:15] [PASSED] set-field
[08:28:15] [PASSED] conflict-duplicate
stty: 'standard input': Inappropriate ioctl for device
[08:28:15] [PASSED] conflict-not-disjoint
[08:28:15] [PASSED] conflict-reg-type
[08:28:15] =========== [PASSED] xe_rtp_process_to_sr_tests ============
[08:28:15] ================== xe_rtp_process_tests ===================
[08:28:15] [PASSED] active1
[08:28:15] [PASSED] active2
[08:28:15] [PASSED] active-inactive
[08:28:15] [PASSED] inactive-active
[08:28:15] [PASSED] inactive-1st_or_active-inactive
[08:28:15] [PASSED] inactive-2nd_or_active-inactive
[08:28:15] [PASSED] inactive-last_or_active-inactive
[08:28:15] [PASSED] inactive-no_or_active-inactive
[08:28:15] ============== [PASSED] xe_rtp_process_tests ===============
[08:28:15] ===================== [PASSED] xe_rtp ======================
[08:28:15] ==================== xe_wa (1 subtest) =====================
[08:28:15] ======================== xe_wa_gt =========================
[08:28:15] [PASSED] TIGERLAKE B0
[08:28:15] [PASSED] DG1 A0
[08:28:15] [PASSED] DG1 B0
[08:28:15] [PASSED] ALDERLAKE_S A0
[08:28:15] [PASSED] ALDERLAKE_S B0
[08:28:15] [PASSED] ALDERLAKE_S C0
[08:28:15] [PASSED] ALDERLAKE_S D0
[08:28:15] [PASSED] ALDERLAKE_P A0
[08:28:15] [PASSED] ALDERLAKE_P B0
[08:28:15] [PASSED] ALDERLAKE_P C0
[08:28:15] [PASSED] ALDERLAKE_S RPLS D0
[08:28:15] [PASSED] ALDERLAKE_P RPLU E0
[08:28:15] [PASSED] DG2 G10 C0
[08:28:15] [PASSED] DG2 G11 B1
[08:28:15] [PASSED] DG2 G12 A1
[08:28:15] [PASSED] METEORLAKE 12.70(Xe_LPG) A0 13.00(Xe_LPM+) A0
[08:28:15] [PASSED] METEORLAKE 12.71(Xe_LPG) A0 13.00(Xe_LPM+) A0
[08:28:15] [PASSED] METEORLAKE 12.74(Xe_LPG+) A0 13.00(Xe_LPM+) A0
[08:28:15] [PASSED] LUNARLAKE 20.04(Xe2_LPG) A0 20.00(Xe2_LPM) A0
[08:28:15] [PASSED] LUNARLAKE 20.04(Xe2_LPG) B0 20.00(Xe2_LPM) A0
[08:28:15] [PASSED] BATTLEMAGE 20.01(Xe2_HPG) A0 13.01(Xe2_HPM) A1
[08:28:15] [PASSED] PANTHERLAKE 30.00(Xe3_LPG) A0 30.00(Xe3_LPM) A0
[08:28:15] ==================== [PASSED] xe_wa_gt =====================
[08:28:15] ====================== [PASSED] xe_wa ======================
[08:28:15] ============================================================
[08:28:15] Testing complete. Ran 597 tests: passed: 579, skipped: 18
[08:28:15] Elapsed time: 35.569s total, 4.212s configuring, 30.739s building, 0.612s running
+ /kernel/tools/testing/kunit/kunit.py run --kunitconfig /kernel/drivers/gpu/drm/tests/.kunitconfig
[08:28:15] Configuring KUnit Kernel ...
Regenerating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[08:28:17] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=48
[08:28:41] Starting KUnit Kernel (1/1)...
[08:28:41] ============================================================
Running tests with:
$ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[08:28:42] ============ drm_test_pick_cmdline (2 subtests) ============
[08:28:42] [PASSED] drm_test_pick_cmdline_res_1920_1080_60
[08:28:42] =============== drm_test_pick_cmdline_named ===============
[08:28:42] [PASSED] NTSC
[08:28:42] [PASSED] NTSC-J
[08:28:42] [PASSED] PAL
[08:28:42] [PASSED] PAL-M
[08:28:42] =========== [PASSED] drm_test_pick_cmdline_named ===========
[08:28:42] ============== [PASSED] drm_test_pick_cmdline ==============
[08:28:42] == drm_test_atomic_get_connector_for_encoder (1 subtest) ===
[08:28:42] [PASSED] drm_test_drm_atomic_get_connector_for_encoder
[08:28:42] ==== [PASSED] drm_test_atomic_get_connector_for_encoder ====
[08:28:42] =========== drm_validate_clone_mode (2 subtests) ===========
[08:28:42] ============== drm_test_check_in_clone_mode ===============
[08:28:42] [PASSED] in_clone_mode
[08:28:42] [PASSED] not_in_clone_mode
[08:28:42] ========== [PASSED] drm_test_check_in_clone_mode ===========
[08:28:42] =============== drm_test_check_valid_clones ===============
[08:28:42] [PASSED] not_in_clone_mode
[08:28:42] [PASSED] valid_clone
[08:28:42] [PASSED] invalid_clone
[08:28:42] =========== [PASSED] drm_test_check_valid_clones ===========
[08:28:42] ============= [PASSED] drm_validate_clone_mode =============
[08:28:42] ============= drm_validate_modeset (1 subtest) =============
[08:28:42] [PASSED] drm_test_check_connector_changed_modeset
[08:28:42] ============== [PASSED] drm_validate_modeset ===============
[08:28:42] ====== drm_test_bridge_get_current_state (2 subtests) ======
[08:28:42] [PASSED] drm_test_drm_bridge_get_current_state_atomic
[08:28:42] [PASSED] drm_test_drm_bridge_get_current_state_legacy
[08:28:42] ======== [PASSED] drm_test_bridge_get_current_state ========
[08:28:42] ====== drm_test_bridge_helper_reset_crtc (3 subtests) ======
[08:28:42] [PASSED] drm_test_drm_bridge_helper_reset_crtc_atomic
[08:28:42] [PASSED] drm_test_drm_bridge_helper_reset_crtc_atomic_disabled
[08:28:42] [PASSED] drm_test_drm_bridge_helper_reset_crtc_legacy
[08:28:42] ======== [PASSED] drm_test_bridge_helper_reset_crtc ========
[08:28:42] ============== drm_bridge_alloc (2 subtests) ===============
[08:28:42] [PASSED] drm_test_drm_bridge_alloc_basic
[08:28:42] [PASSED] drm_test_drm_bridge_alloc_get_put
[08:28:42] ================ [PASSED] drm_bridge_alloc =================
[08:28:42] ============= drm_cmdline_parser (40 subtests) =============
[08:28:42] [PASSED] drm_test_cmdline_force_d_only
[08:28:42] [PASSED] drm_test_cmdline_force_D_only_dvi
[08:28:42] [PASSED] drm_test_cmdline_force_D_only_hdmi
[08:28:42] [PASSED] drm_test_cmdline_force_D_only_not_digital
[08:28:42] [PASSED] drm_test_cmdline_force_e_only
[08:28:42] [PASSED] drm_test_cmdline_res
[08:28:42] [PASSED] drm_test_cmdline_res_vesa
[08:28:42] [PASSED] drm_test_cmdline_res_vesa_rblank
[08:28:42] [PASSED] drm_test_cmdline_res_rblank
[08:28:42] [PASSED] drm_test_cmdline_res_bpp
[08:28:42] [PASSED] drm_test_cmdline_res_refresh
[08:28:42] [PASSED] drm_test_cmdline_res_bpp_refresh
[08:28:42] [PASSED] drm_test_cmdline_res_bpp_refresh_interlaced
[08:28:42] [PASSED] drm_test_cmdline_res_bpp_refresh_margins
[08:28:42] [PASSED] drm_test_cmdline_res_bpp_refresh_force_off
[08:28:42] [PASSED] drm_test_cmdline_res_bpp_refresh_force_on
[08:28:42] [PASSED] drm_test_cmdline_res_bpp_refresh_force_on_analog
[08:28:42] [PASSED] drm_test_cmdline_res_bpp_refresh_force_on_digital
[08:28:42] [PASSED] drm_test_cmdline_res_bpp_refresh_interlaced_margins_force_on
[08:28:42] [PASSED] drm_test_cmdline_res_margins_force_on
[08:28:42] [PASSED] drm_test_cmdline_res_vesa_margins
[08:28:42] [PASSED] drm_test_cmdline_name
[08:28:42] [PASSED] drm_test_cmdline_name_bpp
[08:28:42] [PASSED] drm_test_cmdline_name_option
[08:28:42] [PASSED] drm_test_cmdline_name_bpp_option
[08:28:42] [PASSED] drm_test_cmdline_rotate_0
[08:28:42] [PASSED] drm_test_cmdline_rotate_90
[08:28:42] [PASSED] drm_test_cmdline_rotate_180
[08:28:42] [PASSED] drm_test_cmdline_rotate_270
[08:28:42] [PASSED] drm_test_cmdline_hmirror
[08:28:42] [PASSED] drm_test_cmdline_vmirror
[08:28:42] [PASSED] drm_test_cmdline_margin_options
[08:28:42] [PASSED] drm_test_cmdline_multiple_options
[08:28:42] [PASSED] drm_test_cmdline_bpp_extra_and_option
[08:28:42] [PASSED] drm_test_cmdline_extra_and_option
[08:28:42] [PASSED] drm_test_cmdline_freestanding_options
[08:28:42] [PASSED] drm_test_cmdline_freestanding_force_e_and_options
[08:28:42] [PASSED] drm_test_cmdline_panel_orientation
[08:28:42] ================ drm_test_cmdline_invalid =================
[08:28:42] [PASSED] margin_only
[08:28:42] [PASSED] interlace_only
[08:28:42] [PASSED] res_missing_x
[08:28:42] [PASSED] res_missing_y
[08:28:42] [PASSED] res_bad_y
[08:28:42] [PASSED] res_missing_y_bpp
[08:28:42] [PASSED] res_bad_bpp
[08:28:42] [PASSED] res_bad_refresh
[08:28:42] [PASSED] res_bpp_refresh_force_on_off
[08:28:42] [PASSED] res_invalid_mode
[08:28:42] [PASSED] res_bpp_wrong_place_mode
[08:28:42] [PASSED] name_bpp_refresh
[08:28:42] [PASSED] name_refresh
[08:28:42] [PASSED] name_refresh_wrong_mode
[08:28:42] [PASSED] name_refresh_invalid_mode
[08:28:42] [PASSED] rotate_multiple
[08:28:42] [PASSED] rotate_invalid_val
[08:28:42] [PASSED] rotate_truncated
[08:28:42] [PASSED] invalid_option
[08:28:42] [PASSED] invalid_tv_option
[08:28:42] [PASSED] truncated_tv_option
[08:28:42] ============ [PASSED] drm_test_cmdline_invalid =============
[08:28:42] =============== drm_test_cmdline_tv_options ===============
[08:28:42] [PASSED] NTSC
[08:28:42] [PASSED] NTSC_443
[08:28:42] [PASSED] NTSC_J
[08:28:42] [PASSED] PAL
[08:28:42] [PASSED] PAL_M
[08:28:42] [PASSED] PAL_N
[08:28:42] [PASSED] SECAM
[08:28:42] [PASSED] MONO_525
[08:28:42] [PASSED] MONO_625
[08:28:42] =========== [PASSED] drm_test_cmdline_tv_options ===========
[08:28:42] =============== [PASSED] drm_cmdline_parser ================
[08:28:42] ========== drmm_connector_hdmi_init (20 subtests) ==========
[08:28:42] [PASSED] drm_test_connector_hdmi_init_valid
[08:28:42] [PASSED] drm_test_connector_hdmi_init_bpc_8
[08:28:42] [PASSED] drm_test_connector_hdmi_init_bpc_10
[08:28:42] [PASSED] drm_test_connector_hdmi_init_bpc_12
[08:28:42] [PASSED] drm_test_connector_hdmi_init_bpc_invalid
[08:28:42] [PASSED] drm_test_connector_hdmi_init_bpc_null
[08:28:42] [PASSED] drm_test_connector_hdmi_init_formats_empty
[08:28:42] [PASSED] drm_test_connector_hdmi_init_formats_no_rgb
[08:28:42] === drm_test_connector_hdmi_init_formats_yuv420_allowed ===
[08:28:42] [PASSED] supported_formats=0x9 yuv420_allowed=1
[08:28:42] [PASSED] supported_formats=0x9 yuv420_allowed=0
[08:28:42] [PASSED] supported_formats=0x5 yuv420_allowed=1
[08:28:42] [PASSED] supported_formats=0x5 yuv420_allowed=0
[08:28:42] === [PASSED] drm_test_connector_hdmi_init_formats_yuv420_allowed ===
[08:28:42] [PASSED] drm_test_connector_hdmi_init_null_ddc
[08:28:42] [PASSED] drm_test_connector_hdmi_init_null_product
[08:28:42] [PASSED] drm_test_connector_hdmi_init_null_vendor
[08:28:42] [PASSED] drm_test_connector_hdmi_init_product_length_exact
[08:28:42] [PASSED] drm_test_connector_hdmi_init_product_length_too_long
[08:28:42] [PASSED] drm_test_connector_hdmi_init_product_valid
[08:28:42] [PASSED] drm_test_connector_hdmi_init_vendor_length_exact
[08:28:42] [PASSED] drm_test_connector_hdmi_init_vendor_length_too_long
[08:28:42] [PASSED] drm_test_connector_hdmi_init_vendor_valid
[08:28:42] ========= drm_test_connector_hdmi_init_type_valid =========
[08:28:42] [PASSED] HDMI-A
[08:28:42] [PASSED] HDMI-B
[08:28:42] ===== [PASSED] drm_test_connector_hdmi_init_type_valid =====
[08:28:42] ======== drm_test_connector_hdmi_init_type_invalid ========
[08:28:42] [PASSED] Unknown
[08:28:42] [PASSED] VGA
[08:28:42] [PASSED] DVI-I
[08:28:42] [PASSED] DVI-D
[08:28:42] [PASSED] DVI-A
[08:28:42] [PASSED] Composite
[08:28:42] [PASSED] SVIDEO
[08:28:42] [PASSED] LVDS
[08:28:42] [PASSED] Component
[08:28:42] [PASSED] DIN
[08:28:42] [PASSED] DP
[08:28:42] [PASSED] TV
[08:28:42] [PASSED] eDP
[08:28:42] [PASSED] Virtual
[08:28:42] [PASSED] DSI
[08:28:42] [PASSED] DPI
[08:28:42] [PASSED] Writeback
[08:28:42] [PASSED] SPI
[08:28:42] [PASSED] USB
[08:28:42] ==== [PASSED] drm_test_connector_hdmi_init_type_invalid ====
[08:28:42] ============ [PASSED] drmm_connector_hdmi_init =============
[08:28:42] ============= drmm_connector_init (3 subtests) =============
[08:28:42] [PASSED] drm_test_drmm_connector_init
[08:28:42] [PASSED] drm_test_drmm_connector_init_null_ddc
[08:28:42] ========= drm_test_drmm_connector_init_type_valid =========
[08:28:42] [PASSED] Unknown
[08:28:42] [PASSED] VGA
[08:28:42] [PASSED] DVI-I
[08:28:42] [PASSED] DVI-D
[08:28:42] [PASSED] DVI-A
[08:28:42] [PASSED] Composite
[08:28:42] [PASSED] SVIDEO
[08:28:42] [PASSED] LVDS
[08:28:42] [PASSED] Component
[08:28:42] [PASSED] DIN
[08:28:42] [PASSED] DP
[08:28:42] [PASSED] HDMI-A
[08:28:42] [PASSED] HDMI-B
[08:28:42] [PASSED] TV
[08:28:42] [PASSED] eDP
[08:28:42] [PASSED] Virtual
[08:28:42] [PASSED] DSI
[08:28:42] [PASSED] DPI
[08:28:42] [PASSED] Writeback
[08:28:42] [PASSED] SPI
[08:28:42] [PASSED] USB
[08:28:42] ===== [PASSED] drm_test_drmm_connector_init_type_valid =====
[08:28:42] =============== [PASSED] drmm_connector_init ===============
[08:28:42] ========= drm_connector_dynamic_init (6 subtests) ==========
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_init
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_init_null_ddc
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_init_not_added
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_init_properties
[08:28:42] ===== drm_test_drm_connector_dynamic_init_type_valid ======
[08:28:42] [PASSED] Unknown
[08:28:42] [PASSED] VGA
[08:28:42] [PASSED] DVI-I
[08:28:42] [PASSED] DVI-D
[08:28:42] [PASSED] DVI-A
[08:28:42] [PASSED] Composite
[08:28:42] [PASSED] SVIDEO
[08:28:42] [PASSED] LVDS
[08:28:42] [PASSED] Component
[08:28:42] [PASSED] DIN
[08:28:42] [PASSED] DP
[08:28:42] [PASSED] HDMI-A
[08:28:42] [PASSED] HDMI-B
[08:28:42] [PASSED] TV
[08:28:42] [PASSED] eDP
[08:28:42] [PASSED] Virtual
[08:28:42] [PASSED] DSI
[08:28:42] [PASSED] DPI
[08:28:42] [PASSED] Writeback
[08:28:42] [PASSED] SPI
[08:28:42] [PASSED] USB
[08:28:42] = [PASSED] drm_test_drm_connector_dynamic_init_type_valid ==
[08:28:42] ======== drm_test_drm_connector_dynamic_init_name =========
[08:28:42] [PASSED] Unknown
[08:28:42] [PASSED] VGA
[08:28:42] [PASSED] DVI-I
[08:28:42] [PASSED] DVI-D
[08:28:42] [PASSED] DVI-A
[08:28:42] [PASSED] Composite
[08:28:42] [PASSED] SVIDEO
[08:28:42] [PASSED] LVDS
[08:28:42] [PASSED] Component
[08:28:42] [PASSED] DIN
[08:28:42] [PASSED] DP
[08:28:42] [PASSED] HDMI-A
[08:28:42] [PASSED] HDMI-B
[08:28:42] [PASSED] TV
[08:28:42] [PASSED] eDP
[08:28:42] [PASSED] Virtual
[08:28:42] [PASSED] DSI
[08:28:42] [PASSED] DPI
[08:28:42] [PASSED] Writeback
[08:28:42] [PASSED] SPI
[08:28:42] [PASSED] USB
[08:28:42] ==== [PASSED] drm_test_drm_connector_dynamic_init_name =====
[08:28:42] =========== [PASSED] drm_connector_dynamic_init ============
[08:28:42] ==== drm_connector_dynamic_register_early (4 subtests) =====
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_register_early_on_list
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_register_early_defer
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_register_early_no_init
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_register_early_no_mode_object
[08:28:42] ====== [PASSED] drm_connector_dynamic_register_early =======
[08:28:42] ======= drm_connector_dynamic_register (7 subtests) ========
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_register_on_list
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_register_no_defer
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_register_no_init
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_register_mode_object
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_register_sysfs
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_register_sysfs_name
[08:28:42] [PASSED] drm_test_drm_connector_dynamic_register_debugfs
[08:28:42] ========= [PASSED] drm_connector_dynamic_register ==========
[08:28:42] = drm_connector_attach_broadcast_rgb_property (2 subtests) =
[08:28:42] [PASSED] drm_test_drm_connector_attach_broadcast_rgb_property
[08:28:42] [PASSED] drm_test_drm_connector_attach_broadcast_rgb_property_hdmi_connector
[08:28:42] === [PASSED] drm_connector_attach_broadcast_rgb_property ===
[08:28:42] ========== drm_get_tv_mode_from_name (2 subtests) ==========
[08:28:42] ========== drm_test_get_tv_mode_from_name_valid ===========
[08:28:42] [PASSED] NTSC
[08:28:42] [PASSED] NTSC-443
[08:28:42] [PASSED] NTSC-J
[08:28:42] [PASSED] PAL
[08:28:42] [PASSED] PAL-M
[08:28:42] [PASSED] PAL-N
[08:28:42] [PASSED] SECAM
[08:28:42] [PASSED] Mono
[08:28:42] ====== [PASSED] drm_test_get_tv_mode_from_name_valid =======
[08:28:42] [PASSED] drm_test_get_tv_mode_from_name_truncated
[08:28:42] ============ [PASSED] drm_get_tv_mode_from_name ============
[08:28:42] = drm_test_connector_hdmi_compute_mode_clock (12 subtests) =
[08:28:42] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb
[08:28:42] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_10bpc
[08:28:42] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_10bpc_vic_1
[08:28:42] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_12bpc
[08:28:42] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_12bpc_vic_1
[08:28:42] [PASSED] drm_test_drm_hdmi_compute_mode_clock_rgb_double
[08:28:42] = drm_test_connector_hdmi_compute_mode_clock_yuv420_valid =
[08:28:42] [PASSED] VIC 96
[08:28:42] [PASSED] VIC 97
[08:28:42] [PASSED] VIC 101
[08:28:42] [PASSED] VIC 102
[08:28:42] [PASSED] VIC 106
[08:28:42] [PASSED] VIC 107
[08:28:42] === [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv420_valid ===
[08:28:42] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv420_10_bpc
[08:28:42] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv420_12_bpc
[08:28:42] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv422_8_bpc
[08:28:42] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv422_10_bpc
[08:28:42] [PASSED] drm_test_connector_hdmi_compute_mode_clock_yuv422_12_bpc
[08:28:42] === [PASSED] drm_test_connector_hdmi_compute_mode_clock ====
[08:28:42] == drm_hdmi_connector_get_broadcast_rgb_name (2 subtests) ==
[08:28:42] === drm_test_drm_hdmi_connector_get_broadcast_rgb_name ====
[08:28:42] [PASSED] Automatic
[08:28:42] [PASSED] Full
[08:28:42] [PASSED] Limited 16:235
[08:28:42] === [PASSED] drm_test_drm_hdmi_connector_get_broadcast_rgb_name ===
[08:28:42] [PASSED] drm_test_drm_hdmi_connector_get_broadcast_rgb_name_invalid
[08:28:42] ==== [PASSED] drm_hdmi_connector_get_broadcast_rgb_name ====
[08:28:42] == drm_hdmi_connector_get_output_format_name (2 subtests) ==
[08:28:42] === drm_test_drm_hdmi_connector_get_output_format_name ====
[08:28:42] [PASSED] RGB
[08:28:42] [PASSED] YUV 4:2:0
[08:28:42] [PASSED] YUV 4:2:2
[08:28:42] [PASSED] YUV 4:4:4
[08:28:42] === [PASSED] drm_test_drm_hdmi_connector_get_output_format_name ===
[08:28:42] [PASSED] drm_test_drm_hdmi_connector_get_output_format_name_invalid
[08:28:42] ==== [PASSED] drm_hdmi_connector_get_output_format_name ====
[08:28:42] ============= drm_damage_helper (21 subtests) ==============
[08:28:42] [PASSED] drm_test_damage_iter_no_damage
[08:28:42] [PASSED] drm_test_damage_iter_no_damage_fractional_src
[08:28:42] [PASSED] drm_test_damage_iter_no_damage_src_moved
[08:28:42] [PASSED] drm_test_damage_iter_no_damage_fractional_src_moved
[08:28:42] [PASSED] drm_test_damage_iter_no_damage_not_visible
[08:28:42] [PASSED] drm_test_damage_iter_no_damage_no_crtc
[08:28:42] [PASSED] drm_test_damage_iter_no_damage_no_fb
[08:28:42] [PASSED] drm_test_damage_iter_simple_damage
[08:28:42] [PASSED] drm_test_damage_iter_single_damage
[08:28:42] [PASSED] drm_test_damage_iter_single_damage_intersect_src
[08:28:42] [PASSED] drm_test_damage_iter_single_damage_outside_src
[08:28:42] [PASSED] drm_test_damage_iter_single_damage_fractional_src
[08:28:42] [PASSED] drm_test_damage_iter_single_damage_intersect_fractional_src
[08:28:42] [PASSED] drm_test_damage_iter_single_damage_outside_fractional_src
[08:28:42] [PASSED] drm_test_damage_iter_single_damage_src_moved
[08:28:42] [PASSED] drm_test_damage_iter_single_damage_fractional_src_moved
[08:28:42] [PASSED] drm_test_damage_iter_damage
[08:28:42] [PASSED] drm_test_damage_iter_damage_one_intersect
[08:28:42] [PASSED] drm_test_damage_iter_damage_one_outside
[08:28:42] [PASSED] drm_test_damage_iter_damage_src_moved
[08:28:42] [PASSED] drm_test_damage_iter_damage_not_visible
[08:28:42] ================ [PASSED] drm_damage_helper ================
[08:28:42] ============== drm_dp_mst_helper (3 subtests) ==============
[08:28:42] ============== drm_test_dp_mst_calc_pbn_mode ==============
[08:28:42] [PASSED] Clock 154000 BPP 30 DSC disabled
[08:28:42] [PASSED] Clock 234000 BPP 30 DSC disabled
[08:28:42] [PASSED] Clock 297000 BPP 24 DSC disabled
[08:28:42] [PASSED] Clock 332880 BPP 24 DSC enabled
[08:28:42] [PASSED] Clock 324540 BPP 24 DSC enabled
[08:28:42] ========== [PASSED] drm_test_dp_mst_calc_pbn_mode ==========
[08:28:42] ============== drm_test_dp_mst_calc_pbn_div ===============
[08:28:42] [PASSED] Link rate 2000000 lane count 4
[08:28:42] [PASSED] Link rate 2000000 lane count 2
[08:28:42] [PASSED] Link rate 2000000 lane count 1
[08:28:42] [PASSED] Link rate 1350000 lane count 4
[08:28:42] [PASSED] Link rate 1350000 lane count 2
[08:28:42] [PASSED] Link rate 1350000 lane count 1
[08:28:42] [PASSED] Link rate 1000000 lane count 4
[08:28:42] [PASSED] Link rate 1000000 lane count 2
[08:28:42] [PASSED] Link rate 1000000 lane count 1
[08:28:42] [PASSED] Link rate 810000 lane count 4
[08:28:42] [PASSED] Link rate 810000 lane count 2
[08:28:42] [PASSED] Link rate 810000 lane count 1
[08:28:42] [PASSED] Link rate 540000 lane count 4
[08:28:42] [PASSED] Link rate 540000 lane count 2
[08:28:42] [PASSED] Link rate 540000 lane count 1
[08:28:42] [PASSED] Link rate 270000 lane count 4
[08:28:42] [PASSED] Link rate 270000 lane count 2
[08:28:42] [PASSED] Link rate 270000 lane count 1
[08:28:42] [PASSED] Link rate 162000 lane count 4
[08:28:42] [PASSED] Link rate 162000 lane count 2
[08:28:42] [PASSED] Link rate 162000 lane count 1
[08:28:42] ========== [PASSED] drm_test_dp_mst_calc_pbn_div ===========
[08:28:42] ========= drm_test_dp_mst_sideband_msg_req_decode =========
[08:28:42] [PASSED] DP_ENUM_PATH_RESOURCES with port number
[08:28:42] [PASSED] DP_POWER_UP_PHY with port number
[08:28:42] [PASSED] DP_POWER_DOWN_PHY with port number
[08:28:42] [PASSED] DP_ALLOCATE_PAYLOAD with SDP stream sinks
[08:28:42] [PASSED] DP_ALLOCATE_PAYLOAD with port number
[08:28:42] [PASSED] DP_ALLOCATE_PAYLOAD with VCPI
[08:28:42] [PASSED] DP_ALLOCATE_PAYLOAD with PBN
[08:28:42] [PASSED] DP_QUERY_PAYLOAD with port number
[08:28:42] [PASSED] DP_QUERY_PAYLOAD with VCPI
[08:28:42] [PASSED] DP_REMOTE_DPCD_READ with port number
[08:28:42] [PASSED] DP_REMOTE_DPCD_READ with DPCD address
[08:28:42] [PASSED] DP_REMOTE_DPCD_READ with max number of bytes
[08:28:42] [PASSED] DP_REMOTE_DPCD_WRITE with port number
[08:28:42] [PASSED] DP_REMOTE_DPCD_WRITE with DPCD address
[08:28:42] [PASSED] DP_REMOTE_DPCD_WRITE with data array
[08:28:42] [PASSED] DP_REMOTE_I2C_READ with port number
[08:28:42] [PASSED] DP_REMOTE_I2C_READ with I2C device ID
[08:28:42] [PASSED] DP_REMOTE_I2C_READ with transactions array
[08:28:42] [PASSED] DP_REMOTE_I2C_WRITE with port number
[08:28:42] [PASSED] DP_REMOTE_I2C_WRITE with I2C device ID
[08:28:42] [PASSED] DP_REMOTE_I2C_WRITE with data array
[08:28:42] [PASSED] DP_QUERY_STREAM_ENC_STATUS with stream ID
[08:28:42] [PASSED] DP_QUERY_STREAM_ENC_STATUS with client ID
[08:28:42] [PASSED] DP_QUERY_STREAM_ENC_STATUS with stream event
[08:28:42] [PASSED] DP_QUERY_STREAM_ENC_STATUS with valid stream event
[08:28:42] [PASSED] DP_QUERY_STREAM_ENC_STATUS with stream behavior
[08:28:42] [PASSED] DP_QUERY_STREAM_ENC_STATUS with a valid stream behavior
[08:28:42] ===== [PASSED] drm_test_dp_mst_sideband_msg_req_decode =====
[08:28:42] ================ [PASSED] drm_dp_mst_helper ================
[08:28:42] ================== drm_exec (7 subtests) ===================
[08:28:42] [PASSED] sanitycheck
[08:28:42] [PASSED] test_lock
[08:28:42] [PASSED] test_lock_unlock
[08:28:42] [PASSED] test_duplicates
[08:28:42] [PASSED] test_prepare
[08:28:42] [PASSED] test_prepare_array
[08:28:42] [PASSED] test_multiple_loops
[08:28:42] ==================== [PASSED] drm_exec =====================
[08:28:42] =========== drm_format_helper_test (17 subtests) ===========
[08:28:42] ============== drm_test_fb_xrgb8888_to_gray8 ==============
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ========== [PASSED] drm_test_fb_xrgb8888_to_gray8 ==========
[08:28:42] ============= drm_test_fb_xrgb8888_to_rgb332 ==============
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ========= [PASSED] drm_test_fb_xrgb8888_to_rgb332 ==========
[08:28:42] ============= drm_test_fb_xrgb8888_to_rgb565 ==============
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ========= [PASSED] drm_test_fb_xrgb8888_to_rgb565 ==========
[08:28:42] ============ drm_test_fb_xrgb8888_to_xrgb1555 =============
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ======== [PASSED] drm_test_fb_xrgb8888_to_xrgb1555 =========
[08:28:42] ============ drm_test_fb_xrgb8888_to_argb1555 =============
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ======== [PASSED] drm_test_fb_xrgb8888_to_argb1555 =========
[08:28:42] ============ drm_test_fb_xrgb8888_to_rgba5551 =============
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ======== [PASSED] drm_test_fb_xrgb8888_to_rgba5551 =========
[08:28:42] ============= drm_test_fb_xrgb8888_to_rgb888 ==============
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ========= [PASSED] drm_test_fb_xrgb8888_to_rgb888 ==========
[08:28:42] ============= drm_test_fb_xrgb8888_to_bgr888 ==============
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ========= [PASSED] drm_test_fb_xrgb8888_to_bgr888 ==========
[08:28:42] ============ drm_test_fb_xrgb8888_to_argb8888 =============
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ======== [PASSED] drm_test_fb_xrgb8888_to_argb8888 =========
[08:28:42] =========== drm_test_fb_xrgb8888_to_xrgb2101010 ===========
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ======= [PASSED] drm_test_fb_xrgb8888_to_xrgb2101010 =======
[08:28:42] =========== drm_test_fb_xrgb8888_to_argb2101010 ===========
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ======= [PASSED] drm_test_fb_xrgb8888_to_argb2101010 =======
[08:28:42] ============== drm_test_fb_xrgb8888_to_mono ===============
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ========== [PASSED] drm_test_fb_xrgb8888_to_mono ===========
[08:28:42] ==================== drm_test_fb_swab =====================
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ================ [PASSED] drm_test_fb_swab =================
[08:28:42] ============ drm_test_fb_xrgb8888_to_xbgr8888 =============
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ======== [PASSED] drm_test_fb_xrgb8888_to_xbgr8888 =========
[08:28:42] ============ drm_test_fb_xrgb8888_to_abgr8888 =============
[08:28:42] [PASSED] single_pixel_source_buffer
[08:28:42] [PASSED] single_pixel_clip_rectangle
[08:28:42] [PASSED] well_known_colors
[08:28:42] [PASSED] destination_pitch
[08:28:42] ======== [PASSED] drm_test_fb_xrgb8888_to_abgr8888 =========
[08:28:42] ================= drm_test_fb_clip_offset =================
[08:28:42] [PASSED] pass through
[08:28:42] [PASSED] horizontal offset
[08:28:42] [PASSED] vertical offset
[08:28:42] [PASSED] horizontal and vertical offset
[08:28:42] [PASSED] horizontal offset (custom pitch)
[08:28:42] [PASSED] vertical offset (custom pitch)
[08:28:42] [PASSED] horizontal and vertical offset (custom pitch)
[08:28:42] ============= [PASSED] drm_test_fb_clip_offset =============
[08:28:42] =================== drm_test_fb_memcpy ====================
[08:28:42] [PASSED] single_pixel_source_buffer: XR24 little-endian (0x34325258)
[08:28:42] [PASSED] single_pixel_source_buffer: XRA8 little-endian (0x38415258)
[08:28:42] [PASSED] single_pixel_source_buffer: YU24 little-endian (0x34325559)
[08:28:42] [PASSED] single_pixel_clip_rectangle: XB24 little-endian (0x34324258)
[08:28:42] [PASSED] single_pixel_clip_rectangle: XRA8 little-endian (0x38415258)
[08:28:42] [PASSED] single_pixel_clip_rectangle: YU24 little-endian (0x34325559)
[08:28:42] [PASSED] well_known_colors: XB24 little-endian (0x34324258)
[08:28:42] [PASSED] well_known_colors: XRA8 little-endian (0x38415258)
[08:28:42] [PASSED] well_known_colors: YU24 little-endian (0x34325559)
[08:28:42] [PASSED] destination_pitch: XB24 little-endian (0x34324258)
[08:28:42] [PASSED] destination_pitch: XRA8 little-endian (0x38415258)
[08:28:42] [PASSED] destination_pitch: YU24 little-endian (0x34325559)
[08:28:42] =============== [PASSED] drm_test_fb_memcpy ================
[08:28:42] ============= [PASSED] drm_format_helper_test ==============
[08:28:42] ================= drm_format (18 subtests) =================
[08:28:42] [PASSED] drm_test_format_block_width_invalid
[08:28:42] [PASSED] drm_test_format_block_width_one_plane
[08:28:42] [PASSED] drm_test_format_block_width_two_plane
[08:28:42] [PASSED] drm_test_format_block_width_three_plane
[08:28:42] [PASSED] drm_test_format_block_width_tiled
[08:28:42] [PASSED] drm_test_format_block_height_invalid
[08:28:42] [PASSED] drm_test_format_block_height_one_plane
[08:28:42] [PASSED] drm_test_format_block_height_two_plane
[08:28:42] [PASSED] drm_test_format_block_height_three_plane
[08:28:42] [PASSED] drm_test_format_block_height_tiled
[08:28:42] [PASSED] drm_test_format_min_pitch_invalid
[08:28:42] [PASSED] drm_test_format_min_pitch_one_plane_8bpp
[08:28:42] [PASSED] drm_test_format_min_pitch_one_plane_16bpp
[08:28:42] [PASSED] drm_test_format_min_pitch_one_plane_24bpp
[08:28:42] [PASSED] drm_test_format_min_pitch_one_plane_32bpp
[08:28:42] [PASSED] drm_test_format_min_pitch_two_plane
[08:28:42] [PASSED] drm_test_format_min_pitch_three_plane_8bpp
[08:28:42] [PASSED] drm_test_format_min_pitch_tiled
[08:28:42] =================== [PASSED] drm_format ====================
[08:28:42] ============== drm_framebuffer (10 subtests) ===============
[08:28:42] ========== drm_test_framebuffer_check_src_coords ==========
[08:28:42] [PASSED] Success: source fits into fb
[08:28:42] [PASSED] Fail: overflowing fb with x-axis coordinate
[08:28:42] [PASSED] Fail: overflowing fb with y-axis coordinate
[08:28:42] [PASSED] Fail: overflowing fb with source width
[08:28:42] [PASSED] Fail: overflowing fb with source height
[08:28:42] ====== [PASSED] drm_test_framebuffer_check_src_coords ======
[08:28:42] [PASSED] drm_test_framebuffer_cleanup
[08:28:42] =============== drm_test_framebuffer_create ===============
[08:28:42] [PASSED] ABGR8888 normal sizes
[08:28:42] [PASSED] ABGR8888 max sizes
[08:28:42] [PASSED] ABGR8888 pitch greater than min required
[08:28:42] [PASSED] ABGR8888 pitch less than min required
[08:28:42] [PASSED] ABGR8888 Invalid width
[08:28:42] [PASSED] ABGR8888 Invalid buffer handle
[08:28:42] [PASSED] No pixel format
[08:28:42] [PASSED] ABGR8888 Width 0
[08:28:42] [PASSED] ABGR8888 Height 0
[08:28:42] [PASSED] ABGR8888 Out of bound height * pitch combination
[08:28:42] [PASSED] ABGR8888 Large buffer offset
[08:28:42] [PASSED] ABGR8888 Buffer offset for inexistent plane
[08:28:42] [PASSED] ABGR8888 Invalid flag
[08:28:42] [PASSED] ABGR8888 Set DRM_MODE_FB_MODIFIERS without modifiers
[08:28:42] [PASSED] ABGR8888 Valid buffer modifier
[08:28:42] [PASSED] ABGR8888 Invalid buffer modifier(DRM_FORMAT_MOD_SAMSUNG_64_32_TILE)
[08:28:42] [PASSED] ABGR8888 Extra pitches without DRM_MODE_FB_MODIFIERS
[08:28:42] [PASSED] ABGR8888 Extra pitches with DRM_MODE_FB_MODIFIERS
[08:28:42] [PASSED] NV12 Normal sizes
[08:28:42] [PASSED] NV12 Max sizes
[08:28:42] [PASSED] NV12 Invalid pitch
[08:28:42] [PASSED] NV12 Invalid modifier/missing DRM_MODE_FB_MODIFIERS flag
[08:28:42] [PASSED] NV12 different modifier per-plane
[08:28:42] [PASSED] NV12 with DRM_FORMAT_MOD_SAMSUNG_64_32_TILE
[08:28:42] [PASSED] NV12 Valid modifiers without DRM_MODE_FB_MODIFIERS
[08:28:42] [PASSED] NV12 Modifier for inexistent plane
[08:28:42] [PASSED] NV12 Handle for inexistent plane
[08:28:42] [PASSED] NV12 Handle for inexistent plane without DRM_MODE_FB_MODIFIERS
[08:28:42] [PASSED] YVU420 DRM_MODE_FB_MODIFIERS set without modifier
[08:28:42] [PASSED] YVU420 Normal sizes
[08:28:42] [PASSED] YVU420 Max sizes
[08:28:42] [PASSED] YVU420 Invalid pitch
[08:28:42] [PASSED] YVU420 Different pitches
[08:28:42] [PASSED] YVU420 Different buffer offsets/pitches
[08:28:42] [PASSED] YVU420 Modifier set just for plane 0, without DRM_MODE_FB_MODIFIERS
[08:28:42] [PASSED] YVU420 Modifier set just for planes 0, 1, without DRM_MODE_FB_MODIFIERS
[08:28:42] [PASSED] YVU420 Modifier set just for plane 0, 1, with DRM_MODE_FB_MODIFIERS
[08:28:42] [PASSED] YVU420 Valid modifier
[08:28:42] [PASSED] YVU420 Different modifiers per plane
[08:28:42] [PASSED] YVU420 Modifier for inexistent plane
[08:28:42] [PASSED] YUV420_10BIT Invalid modifier(DRM_FORMAT_MOD_LINEAR)
[08:28:42] [PASSED] X0L2 Normal sizes
[08:28:42] [PASSED] X0L2 Max sizes
[08:28:42] [PASSED] X0L2 Invalid pitch
[08:28:42] [PASSED] X0L2 Pitch greater than minimum required
[08:28:42] [PASSED] X0L2 Handle for inexistent plane
[08:28:42] [PASSED] X0L2 Offset for inexistent plane, without DRM_MODE_FB_MODIFIERS set
[08:28:42] [PASSED] X0L2 Modifier without DRM_MODE_FB_MODIFIERS set
[08:28:42] [PASSED] X0L2 Valid modifier
[08:28:42] [PASSED] X0L2 Modifier for inexistent plane
[08:28:42] =========== [PASSED] drm_test_framebuffer_create ===========
[08:28:42] [PASSED] drm_test_framebuffer_free
[08:28:42] [PASSED] drm_test_framebuffer_init
[08:28:42] [PASSED] drm_test_framebuffer_init_bad_format
[08:28:42] [PASSED] drm_test_framebuffer_init_dev_mismatch
[08:28:42] [PASSED] drm_test_framebuffer_lookup
[08:28:42] [PASSED] drm_test_framebuffer_lookup_inexistent
[08:28:42] [PASSED] drm_test_framebuffer_modifiers_not_supported
[08:28:42] ================= [PASSED] drm_framebuffer =================
[08:28:42] ================ drm_gem_shmem (8 subtests) ================
[08:28:42] [PASSED] drm_gem_shmem_test_obj_create
[08:28:42] [PASSED] drm_gem_shmem_test_obj_create_private
[08:28:42] [PASSED] drm_gem_shmem_test_pin_pages
[08:28:42] [PASSED] drm_gem_shmem_test_vmap
[08:28:42] [PASSED] drm_gem_shmem_test_get_sg_table
[08:28:42] [PASSED] drm_gem_shmem_test_get_pages_sgt
[08:28:42] [PASSED] drm_gem_shmem_test_madvise
[08:28:42] [PASSED] drm_gem_shmem_test_purge
[08:28:42] ================== [PASSED] drm_gem_shmem ==================
[08:28:42] === drm_atomic_helper_connector_hdmi_check (27 subtests) ===
[08:28:42] [PASSED] drm_test_check_broadcast_rgb_auto_cea_mode
[08:28:42] [PASSED] drm_test_check_broadcast_rgb_auto_cea_mode_vic_1
[08:28:42] [PASSED] drm_test_check_broadcast_rgb_full_cea_mode
[08:28:42] [PASSED] drm_test_check_broadcast_rgb_full_cea_mode_vic_1
[08:28:42] [PASSED] drm_test_check_broadcast_rgb_limited_cea_mode
[08:28:42] [PASSED] drm_test_check_broadcast_rgb_limited_cea_mode_vic_1
[08:28:42] ====== drm_test_check_broadcast_rgb_cea_mode_yuv420 =======
[08:28:42] [PASSED] Automatic
[08:28:42] [PASSED] Full
[08:28:42] [PASSED] Limited 16:235
[08:28:42] == [PASSED] drm_test_check_broadcast_rgb_cea_mode_yuv420 ===
[08:28:42] [PASSED] drm_test_check_broadcast_rgb_crtc_mode_changed
[08:28:42] [PASSED] drm_test_check_broadcast_rgb_crtc_mode_not_changed
[08:28:42] [PASSED] drm_test_check_disable_connector
[08:28:42] [PASSED] drm_test_check_hdmi_funcs_reject_rate
[08:28:42] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_rgb
[08:28:42] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_yuv420
[08:28:42] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_ignore_yuv422
[08:28:42] [PASSED] drm_test_check_max_tmds_rate_bpc_fallback_ignore_yuv420
[08:28:42] [PASSED] drm_test_check_driver_unsupported_fallback_yuv420
[08:28:42] [PASSED] drm_test_check_output_bpc_crtc_mode_changed
[08:28:42] [PASSED] drm_test_check_output_bpc_crtc_mode_not_changed
[08:28:42] [PASSED] drm_test_check_output_bpc_dvi
[08:28:42] [PASSED] drm_test_check_output_bpc_format_vic_1
[08:28:42] [PASSED] drm_test_check_output_bpc_format_display_8bpc_only
[08:28:42] [PASSED] drm_test_check_output_bpc_format_display_rgb_only
[08:28:42] [PASSED] drm_test_check_output_bpc_format_driver_8bpc_only
[08:28:42] [PASSED] drm_test_check_output_bpc_format_driver_rgb_only
[08:28:42] [PASSED] drm_test_check_tmds_char_rate_rgb_8bpc
[08:28:42] [PASSED] drm_test_check_tmds_char_rate_rgb_10bpc
[08:28:42] [PASSED] drm_test_check_tmds_char_rate_rgb_12bpc
[08:28:42] ===== [PASSED] drm_atomic_helper_connector_hdmi_check ======
[08:28:42] === drm_atomic_helper_connector_hdmi_reset (6 subtests) ====
[08:28:42] [PASSED] drm_test_check_broadcast_rgb_value
[08:28:42] [PASSED] drm_test_check_bpc_8_value
[08:28:42] [PASSED] drm_test_check_bpc_10_value
[08:28:42] [PASSED] drm_test_check_bpc_12_value
[08:28:42] [PASSED] drm_test_check_format_value
[08:28:42] [PASSED] drm_test_check_tmds_char_value
[08:28:42] ===== [PASSED] drm_atomic_helper_connector_hdmi_reset ======
[08:28:42] = drm_atomic_helper_connector_hdmi_mode_valid (4 subtests) =
[08:28:42] [PASSED] drm_test_check_mode_valid
[08:28:42] [PASSED] drm_test_check_mode_valid_reject
[08:28:42] [PASSED] drm_test_check_mode_valid_reject_rate
[08:28:42] [PASSED] drm_test_check_mode_valid_reject_max_clock
[08:28:42] === [PASSED] drm_atomic_helper_connector_hdmi_mode_valid ===
[08:28:42] = drm_atomic_helper_connector_hdmi_infoframes (5 subtests) =
[08:28:42] [PASSED] drm_test_check_infoframes
[08:28:42] [PASSED] drm_test_check_reject_avi_infoframe
[08:28:42] [PASSED] drm_test_check_reject_hdr_infoframe_bpc_8
[08:28:42] [PASSED] drm_test_check_reject_hdr_infoframe_bpc_10
[08:28:42] [PASSED] drm_test_check_reject_audio_infoframe
[08:28:42] === [PASSED] drm_atomic_helper_connector_hdmi_infoframes ===
[08:28:42] ================= drm_managed (2 subtests) =================
[08:28:42] [PASSED] drm_test_managed_release_action
[08:28:42] [PASSED] drm_test_managed_run_action
[08:28:42] =================== [PASSED] drm_managed ===================
[08:28:42] =================== drm_mm (6 subtests) ====================
[08:28:42] [PASSED] drm_test_mm_init
[08:28:42] [PASSED] drm_test_mm_debug
[08:28:42] [PASSED] drm_test_mm_align32
[08:28:42] [PASSED] drm_test_mm_align64
[08:28:42] [PASSED] drm_test_mm_lowest
[08:28:42] [PASSED] drm_test_mm_highest
[08:28:42] ===================== [PASSED] drm_mm ======================
[08:28:42] ============= drm_modes_analog_tv (5 subtests) =============
[08:28:42] [PASSED] drm_test_modes_analog_tv_mono_576i
[08:28:42] [PASSED] drm_test_modes_analog_tv_ntsc_480i
[08:28:42] [PASSED] drm_test_modes_analog_tv_ntsc_480i_inlined
[08:28:42] [PASSED] drm_test_modes_analog_tv_pal_576i
[08:28:42] [PASSED] drm_test_modes_analog_tv_pal_576i_inlined
[08:28:42] =============== [PASSED] drm_modes_analog_tv ===============
[08:28:42] ============== drm_plane_helper (2 subtests) ===============
[08:28:42] =============== drm_test_check_plane_state ================
[08:28:42] [PASSED] clipping_simple
[08:28:42] [PASSED] clipping_rotate_reflect
[08:28:42] [PASSED] positioning_simple
[08:28:42] [PASSED] upscaling
[08:28:42] [PASSED] downscaling
[08:28:42] [PASSED] rounding1
[08:28:42] [PASSED] rounding2
[08:28:42] [PASSED] rounding3
[08:28:42] [PASSED] rounding4
[08:28:42] =========== [PASSED] drm_test_check_plane_state ============
[08:28:42] =========== drm_test_check_invalid_plane_state ============
[08:28:42] [PASSED] positioning_invalid
[08:28:42] [PASSED] upscaling_invalid
[08:28:42] [PASSED] downscaling_invalid
[08:28:42] ======= [PASSED] drm_test_check_invalid_plane_state ========
[08:28:42] ================ [PASSED] drm_plane_helper =================
[08:28:42] ====== drm_connector_helper_tv_get_modes (1 subtest) =======
[08:28:42] ====== drm_test_connector_helper_tv_get_modes_check =======
[08:28:42] [PASSED] None
[08:28:42] [PASSED] PAL
[08:28:42] [PASSED] NTSC
[08:28:42] [PASSED] Both, NTSC Default
[08:28:42] [PASSED] Both, PAL Default
[08:28:42] [PASSED] Both, NTSC Default, with PAL on command-line
[08:28:42] [PASSED] Both, PAL Default, with NTSC on command-line
[08:28:42] == [PASSED] drm_test_connector_helper_tv_get_modes_check ===
[08:28:42] ======== [PASSED] drm_connector_helper_tv_get_modes ========
[08:28:42] ================== drm_rect (9 subtests) ===================
[08:28:42] [PASSED] drm_test_rect_clip_scaled_div_by_zero
[08:28:42] [PASSED] drm_test_rect_clip_scaled_not_clipped
[08:28:42] [PASSED] drm_test_rect_clip_scaled_clipped
[08:28:42] [PASSED] drm_test_rect_clip_scaled_signed_vs_unsigned
[08:28:42] ================= drm_test_rect_intersect =================
[08:28:42] [PASSED] top-left x bottom-right: 2x2+1+1 x 2x2+0+0
[08:28:42] [PASSED] top-right x bottom-left: 2x2+0+0 x 2x2+1-1
[08:28:42] [PASSED] bottom-left x top-right: 2x2+1-1 x 2x2+0+0
[08:28:42] [PASSED] bottom-right x top-left: 2x2+0+0 x 2x2+1+1
[08:28:42] [PASSED] right x left: 2x1+0+0 x 3x1+1+0
[08:28:42] [PASSED] left x right: 3x1+1+0 x 2x1+0+0
[08:28:42] [PASSED] up x bottom: 1x2+0+0 x 1x3+0-1
[08:28:42] [PASSED] bottom x up: 1x3+0-1 x 1x2+0+0
[08:28:42] [PASSED] touching corner: 1x1+0+0 x 2x2+1+1
[08:28:42] [PASSED] touching side: 1x1+0+0 x 1x1+1+0
[08:28:42] [PASSED] equal rects: 2x2+0+0 x 2x2+0+0
[08:28:42] [PASSED] inside another: 2x2+0+0 x 1x1+1+1
[08:28:42] [PASSED] far away: 1x1+0+0 x 1x1+3+6
[08:28:42] [PASSED] points intersecting: 0x0+5+10 x 0x0+5+10
[08:28:42] [PASSED] points not intersecting: 0x0+0+0 x 0x0+5+10
[08:28:42] ============= [PASSED] drm_test_rect_intersect =============
[08:28:42] ================ drm_test_rect_calc_hscale ================
[08:28:42] [PASSED] normal use
[08:28:42] [PASSED] out of max range
[08:28:42] [PASSED] out of min range
[08:28:42] [PASSED] zero dst
[08:28:42] [PASSED] negative src
[08:28:42] [PASSED] negative dst
[08:28:42] ============ [PASSED] drm_test_rect_calc_hscale ============
[08:28:42] ================ drm_test_rect_calc_vscale ================
[08:28:42] [PASSED] normal use
[08:28:42] [PASSED] out of max range
[08:28:42] [PASSED] out of min range
[08:28:42] [PASSED] zero dst
[08:28:42] [PASSED] negative src
[08:28:42] [PASSED] negative dst
stty: 'standard input': Inappropriate ioctl for device
[08:28:42] ============ [PASSED] drm_test_rect_calc_vscale ============
[08:28:42] ================== drm_test_rect_rotate ===================
[08:28:42] [PASSED] reflect-x
[08:28:42] [PASSED] reflect-y
[08:28:42] [PASSED] rotate-0
[08:28:42] [PASSED] rotate-90
[08:28:42] [PASSED] rotate-180
[08:28:42] [PASSED] rotate-270
[08:28:42] ============== [PASSED] drm_test_rect_rotate ===============
[08:28:42] ================ drm_test_rect_rotate_inv =================
[08:28:42] [PASSED] reflect-x
[08:28:42] [PASSED] reflect-y
[08:28:42] [PASSED] rotate-0
[08:28:42] [PASSED] rotate-90
[08:28:42] [PASSED] rotate-180
[08:28:42] [PASSED] rotate-270
[08:28:42] ============ [PASSED] drm_test_rect_rotate_inv =============
[08:28:42] ==================== [PASSED] drm_rect =====================
[08:28:42] ============ drm_sysfb_modeset_test (1 subtest) ============
[08:28:42] ============ drm_test_sysfb_build_fourcc_list =============
[08:28:42] [PASSED] no native formats
[08:28:42] [PASSED] XRGB8888 as native format
[08:28:42] [PASSED] remove duplicates
[08:28:42] [PASSED] convert alpha formats
[08:28:42] [PASSED] random formats
[08:28:42] ======== [PASSED] drm_test_sysfb_build_fourcc_list =========
[08:28:42] ============= [PASSED] drm_sysfb_modeset_test ==============
[08:28:42] ================== drm_fixp (2 subtests) ===================
[08:28:42] [PASSED] drm_test_int2fixp
[08:28:42] [PASSED] drm_test_sm2fixp
[08:28:42] ==================== [PASSED] drm_fixp =====================
[08:28:42] ============================================================
[08:28:42] Testing complete. Ran 621 tests: passed: 621
[08:28:42] Elapsed time: 26.185s total, 1.734s configuring, 24.279s building, 0.138s running
+ /kernel/tools/testing/kunit/kunit.py run --kunitconfig /kernel/drivers/gpu/drm/ttm/tests/.kunitconfig
[08:28:42] Configuring KUnit Kernel ...
Regenerating .config ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
[08:28:43] Building KUnit Kernel ...
Populating config with:
$ make ARCH=um O=.kunit olddefconfig
Building with:
$ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=48
[08:28:53] Starting KUnit Kernel (1/1)...
[08:28:53] ============================================================
Running tests with:
$ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
[08:28:53] ================= ttm_device (5 subtests) ==================
[08:28:53] [PASSED] ttm_device_init_basic
[08:28:53] [PASSED] ttm_device_init_multiple
[08:28:53] [PASSED] ttm_device_fini_basic
[08:28:53] [PASSED] ttm_device_init_no_vma_man
[08:28:53] ================== ttm_device_init_pools ==================
[08:28:53] [PASSED] No DMA allocations, no DMA32 required
[08:28:53] [PASSED] DMA allocations, DMA32 required
[08:28:53] [PASSED] No DMA allocations, DMA32 required
[08:28:53] [PASSED] DMA allocations, no DMA32 required
[08:28:53] ============== [PASSED] ttm_device_init_pools ==============
[08:28:53] =================== [PASSED] ttm_device ====================
[08:28:53] ================== ttm_pool (8 subtests) ===================
[08:28:53] ================== ttm_pool_alloc_basic ===================
[08:28:53] [PASSED] One page
[08:28:53] [PASSED] More than one page
[08:28:53] [PASSED] Above the allocation limit
[08:28:53] [PASSED] One page, with coherent DMA mappings enabled
[08:28:53] [PASSED] Above the allocation limit, with coherent DMA mappings enabled
[08:28:53] ============== [PASSED] ttm_pool_alloc_basic ===============
[08:28:53] ============== ttm_pool_alloc_basic_dma_addr ==============
[08:28:53] [PASSED] One page
[08:28:53] [PASSED] More than one page
[08:28:53] [PASSED] Above the allocation limit
[08:28:53] [PASSED] One page, with coherent DMA mappings enabled
[08:28:53] [PASSED] Above the allocation limit, with coherent DMA mappings enabled
[08:28:53] ========== [PASSED] ttm_pool_alloc_basic_dma_addr ==========
[08:28:53] [PASSED] ttm_pool_alloc_order_caching_match
[08:28:53] [PASSED] ttm_pool_alloc_caching_mismatch
[08:28:53] [PASSED] ttm_pool_alloc_order_mismatch
[08:28:53] [PASSED] ttm_pool_free_dma_alloc
[08:28:53] [PASSED] ttm_pool_free_no_dma_alloc
[08:28:53] [PASSED] ttm_pool_fini_basic
[08:28:53] ==================== [PASSED] ttm_pool =====================
[08:28:53] ================ ttm_resource (8 subtests) =================
[08:28:53] ================= ttm_resource_init_basic =================
[08:28:53] [PASSED] Init resource in TTM_PL_SYSTEM
[08:28:53] [PASSED] Init resource in TTM_PL_VRAM
[08:28:53] [PASSED] Init resource in a private placement
[08:28:53] [PASSED] Init resource in TTM_PL_SYSTEM, set placement flags
[08:28:53] ============= [PASSED] ttm_resource_init_basic =============
[08:28:53] [PASSED] ttm_resource_init_pinned
[08:28:53] [PASSED] ttm_resource_fini_basic
[08:28:53] [PASSED] ttm_resource_manager_init_basic
[08:28:53] [PASSED] ttm_resource_manager_usage_basic
[08:28:53] [PASSED] ttm_resource_manager_set_used_basic
[08:28:53] [PASSED] ttm_sys_man_alloc_basic
[08:28:53] [PASSED] ttm_sys_man_free_basic
[08:28:53] ================== [PASSED] ttm_resource ===================
[08:28:53] =================== ttm_tt (15 subtests) ===================
[08:28:53] ==================== ttm_tt_init_basic ====================
[08:28:53] [PASSED] Page-aligned size
[08:28:53] [PASSED] Extra pages requested
[08:28:53] ================ [PASSED] ttm_tt_init_basic ================
[08:28:53] [PASSED] ttm_tt_init_misaligned
[08:28:53] [PASSED] ttm_tt_fini_basic
[08:28:53] [PASSED] ttm_tt_fini_sg
[08:28:53] [PASSED] ttm_tt_fini_shmem
[08:28:53] [PASSED] ttm_tt_create_basic
[08:28:53] [PASSED] ttm_tt_create_invalid_bo_type
[08:28:53] [PASSED] ttm_tt_create_ttm_exists
[08:28:53] [PASSED] ttm_tt_create_failed
[08:28:53] [PASSED] ttm_tt_destroy_basic
[08:28:53] [PASSED] ttm_tt_populate_null_ttm
[08:28:53] [PASSED] ttm_tt_populate_populated_ttm
[08:28:53] [PASSED] ttm_tt_unpopulate_basic
[08:28:53] [PASSED] ttm_tt_unpopulate_empty_ttm
[08:28:53] [PASSED] ttm_tt_swapin_basic
[08:28:53] ===================== [PASSED] ttm_tt ======================
[08:28:53] =================== ttm_bo (14 subtests) ===================
[08:28:53] =========== ttm_bo_reserve_optimistic_no_ticket ===========
[08:28:53] [PASSED] Cannot be interrupted and sleeps
[08:28:53] [PASSED] Cannot be interrupted, locks straight away
[08:28:53] [PASSED] Can be interrupted, sleeps
[08:28:53] ======= [PASSED] ttm_bo_reserve_optimistic_no_ticket =======
[08:28:53] [PASSED] ttm_bo_reserve_locked_no_sleep
[08:28:53] [PASSED] ttm_bo_reserve_no_wait_ticket
[08:28:53] [PASSED] ttm_bo_reserve_double_resv
[08:28:53] [PASSED] ttm_bo_reserve_interrupted
[08:28:53] [PASSED] ttm_bo_reserve_deadlock
[08:28:53] [PASSED] ttm_bo_unreserve_basic
[08:28:53] [PASSED] ttm_bo_unreserve_pinned
[08:28:53] [PASSED] ttm_bo_unreserve_bulk
[08:28:53] [PASSED] ttm_bo_fini_basic
[08:28:53] [PASSED] ttm_bo_fini_shared_resv
[08:28:53] [PASSED] ttm_bo_pin_basic
[08:28:53] [PASSED] ttm_bo_pin_unpin_resource
[08:28:53] [PASSED] ttm_bo_multiple_pin_one_unpin
[08:28:53] ===================== [PASSED] ttm_bo ======================
[08:28:53] ============== ttm_bo_validate (22 subtests) ===============
[08:28:53] ============== ttm_bo_init_reserved_sys_man ===============
[08:28:53] [PASSED] Buffer object for userspace
[08:28:53] [PASSED] Kernel buffer object
[08:28:53] [PASSED] Shared buffer object
[08:28:53] ========== [PASSED] ttm_bo_init_reserved_sys_man ===========
[08:28:53] ============== ttm_bo_init_reserved_mock_man ==============
[08:28:53] [PASSED] Buffer object for userspace
[08:28:53] [PASSED] Kernel buffer object
[08:28:53] [PASSED] Shared buffer object
[08:28:53] ========== [PASSED] ttm_bo_init_reserved_mock_man ==========
[08:28:53] [PASSED] ttm_bo_init_reserved_resv
[08:28:53] ================== ttm_bo_validate_basic ==================
[08:28:53] [PASSED] Buffer object for userspace
[08:28:53] [PASSED] Kernel buffer object
[08:28:53] [PASSED] Shared buffer object
[08:28:53] ============== [PASSED] ttm_bo_validate_basic ==============
[08:28:53] [PASSED] ttm_bo_validate_invalid_placement
[08:28:53] ============= ttm_bo_validate_same_placement ==============
[08:28:53] [PASSED] System manager
[08:28:53] [PASSED] VRAM manager
[08:28:53] ========= [PASSED] ttm_bo_validate_same_placement ==========
[08:28:53] [PASSED] ttm_bo_validate_failed_alloc
[08:28:53] [PASSED] ttm_bo_validate_pinned
[08:28:53] [PASSED] ttm_bo_validate_busy_placement
[08:28:53] ================ ttm_bo_validate_multihop =================
[08:28:53] [PASSED] Buffer object for userspace
[08:28:53] [PASSED] Kernel buffer object
[08:28:53] [PASSED] Shared buffer object
[08:28:53] ============ [PASSED] ttm_bo_validate_multihop =============
[08:28:53] ========== ttm_bo_validate_no_placement_signaled ==========
[08:28:53] [PASSED] Buffer object in system domain, no page vector
[08:28:53] [PASSED] Buffer object in system domain with an existing page vector
[08:28:53] ====== [PASSED] ttm_bo_validate_no_placement_signaled ======
[08:28:53] ======== ttm_bo_validate_no_placement_not_signaled ========
[08:28:53] [PASSED] Buffer object for userspace
[08:28:53] [PASSED] Kernel buffer object
[08:28:53] [PASSED] Shared buffer object
[08:28:53] ==== [PASSED] ttm_bo_validate_no_placement_not_signaled ====
[08:28:53] [PASSED] ttm_bo_validate_move_fence_signaled
[08:28:53] ========= ttm_bo_validate_move_fence_not_signaled =========
[08:28:53] [PASSED] Waits for GPU
[08:28:53] [PASSED] Tries to lock straight away
[08:28:53] ===== [PASSED] ttm_bo_validate_move_fence_not_signaled =====
[08:28:53] [PASSED] ttm_bo_validate_swapout
[08:28:53] [PASSED] ttm_bo_validate_happy_evict
[08:28:53] [PASSED] ttm_bo_validate_all_pinned_evict
[08:28:53] [PASSED] ttm_bo_validate_allowed_only_evict
[08:28:53] [PASSED] ttm_bo_validate_deleted_evict
[08:28:53] [PASSED] ttm_bo_validate_busy_domain_evict
[08:28:53] [PASSED] ttm_bo_validate_evict_gutting
[08:28:53] [PASSED] ttm_bo_validate_recrusive_evict
stty: 'standard input': Inappropriate ioctl for device
[08:28:53] ================= [PASSED] ttm_bo_validate =================
[08:28:53] ============================================================
[08:28:53] Testing complete. Ran 102 tests: passed: 102
[08:28:53] Elapsed time: 11.394s total, 1.748s configuring, 9.431s building, 0.183s running
+ cleanup
++ stat -c %u:%g /kernel
+ chown -R 1003:1003 /kernel
^ permalink raw reply [flat|nested] 33+ messages in thread
* ✓ Xe.CI.BAT: success for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev5)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (13 preceding siblings ...)
2026-03-26 8:28 ` ✓ CI.KUnit: success " Patchwork
@ 2026-03-26 9:03 ` Patchwork
2026-03-26 20:53 ` ✓ Xe.CI.FULL: " Patchwork
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-26 9:03 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
[-- Attachment #1: Type: text/plain, Size: 1947 bytes --]
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev5)
URL : https://patchwork.freedesktop.org/series/162134/
State : success
== Summary ==
CI Bug Log - changes from xe-4790-2056c24cdb8a2943bd25210f62cce6ec3da84fcb_BAT -> xe-pw-162134v5_BAT
====================================================
Summary
-------
**SUCCESS**
No regressions found.
Participating hosts (14 -> 14)
------------------------------
No changes in participating hosts
Known issues
------------
Here are the changes found in xe-pw-162134v5_BAT that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@kms_flip@basic-flip-vs-wf_vblank@c-edp1:
- bat-adlp-7: [PASS][1] -> [DMESG-WARN][2] ([Intel XE#7483])
[1]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4790-2056c24cdb8a2943bd25210f62cce6ec3da84fcb/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@c-edp1.html
[2]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@c-edp1.html
#### Possible fixes ####
* igt@kms_flip@basic-flip-vs-wf_vblank@d-edp1:
- bat-adlp-7: [DMESG-WARN][3] ([Intel XE#7483]) -> [PASS][4]
[3]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4790-2056c24cdb8a2943bd25210f62cce6ec3da84fcb/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@d-edp1.html
[4]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/bat-adlp-7/igt@kms_flip@basic-flip-vs-wf_vblank@d-edp1.html
[Intel XE#7483]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7483
Build changes
-------------
* Linux: xe-4790-2056c24cdb8a2943bd25210f62cce6ec3da84fcb -> xe-pw-162134v5
IGT_8832: 8832
xe-4790-2056c24cdb8a2943bd25210f62cce6ec3da84fcb: 2056c24cdb8a2943bd25210f62cce6ec3da84fcb
xe-pw-162134v5: 162134v5
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/index.html
[-- Attachment #2: Type: text/html, Size: 2610 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [PATCH] Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"
2026-03-26 8:22 ` [PATCH] Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Maarten Lankhorst
@ 2026-03-26 11:24 ` Guenter Roeck
0 siblings, 0 replies; 33+ messages in thread
From: Guenter Roeck @ 2026-03-26 11:24 UTC (permalink / raw)
To: Maarten Lankhorst, dri-devel
Cc: intel-xe, Thomas Hellström, Simona Vetter
On 3/26/26 01:22, Maarten Lankhorst wrote:
> This reverts commit 6bee098b91417654703e17eb5c1822c6dfd0c01d.
>
[ ... ]
> Back to the drawing board, and fixing it in the intel display driver
> instead.
>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Reported-by: Guenter Roeck <linux@roeck-us.net>
> Acked-by: Simona Vetter <simona.vetter@ffwll.ch>
> Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
> Fixes: 6bee098b9141 ("drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug")
Tested-by: Guenter Roeck <linux@roeck-us.net>
^ permalink raw reply [flat|nested] 33+ messages in thread
* ✓ Xe.CI.FULL: success for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev5)
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
` (14 preceding siblings ...)
2026-03-26 9:03 ` ✓ Xe.CI.BAT: " Patchwork
@ 2026-03-26 20:53 ` Patchwork
15 siblings, 0 replies; 33+ messages in thread
From: Patchwork @ 2026-03-26 20:53 UTC (permalink / raw)
To: Maarten Lankhorst; +Cc: intel-xe
[-- Attachment #1: Type: text/plain, Size: 4618 bytes --]
== Series Details ==
Series: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev5)
URL : https://patchwork.freedesktop.org/series/162134/
State : success
== Summary ==
CI Bug Log - changes from xe-4790-2056c24cdb8a2943bd25210f62cce6ec3da84fcb_FULL -> xe-pw-162134v5_FULL
====================================================
Summary
-------
**SUCCESS**
No regressions found.
Participating hosts (2 -> 2)
------------------------------
No changes in participating hosts
Known issues
------------
Here are the changes found in xe-pw-162134v5_FULL that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@kms_big_fb@linear-16bpp-rotate-270:
- shard-lnl: NOTRUN -> [SKIP][1] ([Intel XE#1407])
[1]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/shard-lnl-6/igt@kms_big_fb@linear-16bpp-rotate-270.html
* igt@kms_flip@2x-flip-vs-absolute-wf_vblank-interruptible:
- shard-lnl: NOTRUN -> [SKIP][2] ([Intel XE#1421])
[2]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/shard-lnl-6/igt@kms_flip@2x-flip-vs-absolute-wf_vblank-interruptible.html
* igt@kms_force_connector_basic@prune-stale-modes:
- shard-lnl: NOTRUN -> [SKIP][3] ([Intel XE#352])
[3]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/shard-lnl-6/igt@kms_force_connector_basic@prune-stale-modes.html
* igt@kms_frontbuffer_tracking@fbcpsr-2p-rte:
- shard-lnl: NOTRUN -> [SKIP][4] ([Intel XE#656])
[4]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/shard-lnl-6/igt@kms_frontbuffer_tracking@fbcpsr-2p-rte.html
* igt@kms_vrr@seamless-rr-switch-virtual@pipe-a-edp-1:
- shard-lnl: [PASS][5] -> [FAIL][6] ([Intel XE#2142]) +1 other test fail
[5]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-4790-2056c24cdb8a2943bd25210f62cce6ec3da84fcb/shard-lnl-5/igt@kms_vrr@seamless-rr-switch-virtual@pipe-a-edp-1.html
[6]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/shard-lnl-6/igt@kms_vrr@seamless-rr-switch-virtual@pipe-a-edp-1.html
* igt@xe_eudebug_online@interrupt-other:
- shard-lnl: NOTRUN -> [SKIP][7] ([Intel XE#7636])
[7]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/shard-lnl-6/igt@xe_eudebug_online@interrupt-other.html
* igt@xe_exec_balancer@many-cm-virtual-userptr:
- shard-lnl: NOTRUN -> [SKIP][8] ([Intel XE#7482]) +1 other test skip
[8]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/shard-lnl-6/igt@xe_exec_balancer@many-cm-virtual-userptr.html
* igt@xe_exec_multi_queue@many-execs-preempt-mode-dyn-priority:
- shard-lnl: NOTRUN -> [SKIP][9] ([Intel XE#6874]) +1 other test skip
[9]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/shard-lnl-6/igt@xe_exec_multi_queue@many-execs-preempt-mode-dyn-priority.html
* igt@xe_mmap@small-bar:
- shard-lnl: NOTRUN -> [SKIP][10] ([Intel XE#512] / [Intel XE#7323] / [Intel XE#7384])
[10]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/shard-lnl-6/igt@xe_mmap@small-bar.html
* igt@xe_multigpu_svm@mgpu-pagefault-prefetch:
- shard-lnl: NOTRUN -> [SKIP][11] ([Intel XE#6964])
[11]: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/shard-lnl-6/igt@xe_multigpu_svm@mgpu-pagefault-prefetch.html
[Intel XE#1407]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/1407
[Intel XE#1421]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/1421
[Intel XE#2142]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2142
[Intel XE#352]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/352
[Intel XE#512]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/512
[Intel XE#656]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/656
[Intel XE#6874]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6874
[Intel XE#6964]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/6964
[Intel XE#7323]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7323
[Intel XE#7384]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7384
[Intel XE#7482]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7482
[Intel XE#7636]: https://gitlab.freedesktop.org/drm/xe/kernel/issues/7636
Build changes
-------------
* Linux: xe-4790-2056c24cdb8a2943bd25210f62cce6ec3da84fcb -> xe-pw-162134v5
IGT_8832: 8832
xe-4790-2056c24cdb8a2943bd25210f62cce6ec3da84fcb: 2056c24cdb8a2943bd25210f62cce6ec3da84fcb
xe-pw-162134v5: 162134v5
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/intel-xe/xe-pw-162134v5/index.html
[-- Attachment #2: Type: text/html, Size: 5393 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread
end of thread, other threads:[~2026-03-26 20:53 UTC | newest]
Thread overview: 33+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-13 15:17 [PATCH v2 0/1] Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug Maarten Lankhorst
2026-03-13 15:17 ` [PATCH v2 1/1] drm: " Maarten Lankhorst
2026-03-17 15:26 ` Thomas Hellström
2026-03-17 15:39 ` Maarten Lankhorst
2026-03-17 15:43 ` Hellstrom, Thomas
2026-03-17 16:59 ` Maarten Lankhorst
2026-03-25 17:26 ` Guenter Roeck
2026-03-25 18:05 ` Maarten Lankhorst
2026-03-25 18:26 ` Guenter Roeck
2026-03-25 18:17 ` Maarten Lankhorst
2026-03-25 18:28 ` Maarten Lankhorst
2026-03-25 18:59 ` Guenter Roeck
2026-03-25 20:12 ` Guenter Roeck
2026-03-25 20:31 ` Maarten Lankhorst
2026-03-25 21:07 ` Guenter Roeck
2026-03-25 21:11 ` Simona Vetter
2026-03-26 8:22 ` [PATCH] Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" Maarten Lankhorst
2026-03-26 11:24 ` Guenter Roeck
2026-03-13 15:29 ` ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev2) Patchwork
2026-03-13 15:30 ` ✓ CI.KUnit: success " Patchwork
2026-03-13 16:09 ` ✓ Xe.CI.BAT: " Patchwork
2026-03-14 19:51 ` ✓ Xe.CI.FULL: " Patchwork
2026-03-25 18:33 ` ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev3) Patchwork
2026-03-25 18:34 ` ✓ CI.KUnit: success " Patchwork
2026-03-25 19:29 ` ✓ Xe.CI.BAT: " Patchwork
2026-03-25 20:35 ` ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev4) Patchwork
2026-03-25 20:37 ` ✓ CI.KUnit: success " Patchwork
2026-03-25 21:10 ` ✓ Xe.CI.BAT: " Patchwork
2026-03-26 6:48 ` ✗ Xe.CI.FULL: failure " Patchwork
2026-03-26 8:27 ` ✗ CI.checkpatch: warning for Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug (rev5) Patchwork
2026-03-26 8:28 ` ✓ CI.KUnit: success " Patchwork
2026-03-26 9:03 ` ✓ Xe.CI.BAT: " Patchwork
2026-03-26 20:53 ` ✓ Xe.CI.FULL: " Patchwork
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox