From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasha Levin Date: Mon, 07 May 2012 09:42:32 +0000 Subject: fb: BUGs related to deferred IO Message-Id: <1336383752.3638.13.camel@lappy> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: FlorianSchandinat@gmx.de Cc: Dave Jones , linux-fbdev@vger.kernel.org, "linux-kernel@vger.kernel.org" Hi all, During fuzzing using trinity inside a KVM guest, using latest -next kernel, I got the following BUG: [ 601.263570] ------------[ cut here ]------------ [ 601.270562] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8d/0xb0() [ 601.298273] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: stub_timer+0x0/0x20 [ 601.317051] Pid: 23084, comm: trinity Tainted: G W 3.4.0-rc6-next-20120507-sasha-00001-g33621a3-dirty #114 [ 601.353655] Call Trace: [ 601.358430] [] warn_slowpath_common+0x87/0xb0 [ 601.369400] [] warn_slowpath_fmt+0x41/0x50 [ 601.376112] [] debug_print_object+0x8d/0xb0 [ 601.382656] [] ? usleep_range+0x40/0x40 [ 601.389210] [] debug_object_assert_init+0xa0/0x110 [ 601.395856] [] del_timer+0x26/0xd0 [ 601.399472] [] __cancel_work_timer+0x27/0xa0 [ 601.403238] [] cancel_delayed_work_sync+0xd/0x10 [ 601.406969] [] fb_deferred_io_fsync+0x52/0x80 [ 601.410281] [] ? fget_light+0x118/0x3e0 [ 601.413489] [] vfs_fsync_range+0x18/0x30 [ 601.416741] [] vfs_fsync+0x17/0x20 [ 601.419662] [] do_fsync+0x34/0x60 [ 601.422959] [] sys_fdatasync+0xe/0x20 [ 601.425721] [] system_call_fastpath+0x16/0x1b [ 601.449718] ---[ end trace 44593438a59a9537 ]--- [ 601.452359] ------------[ cut here ]------------ [ 601.453315] kernel BUG at kernel/workqueue.c:564! [ 601.453315] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 601.453315] CPU 1 [ 601.453315] Pid: 23084, comm: trinity Tainted: G W 3.4.0-rc6-next-20120507-sasha-00001-g33621a3-dirty #114 [ 601.453315] RIP: 0010:[] [] get_work_gcwq+0x41/0x80 [ 601.453315] RSP: 0018:ffff88000ed3fe58 EFLAGS: 00010213 [ 601.453315] RAX: 0000000000000000 RBX: ffff88007f310e58 RCX: 0000000000000006 [ 601.453315] RDX: 0035b5b5b5b5b5b5 RSI: ffff88000f9088e0 RDI: ffff88007f310e58 [ 602.339668] RBP: ffff88000ed3fe58 R08: 0000000000000001 R09: 0000000000000000 [ 602.339668] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88007f310e58 [ 602.339668] R13: 09286401f3b0af98 R14: 13b8db52e413d33a R15: 02be775f01f67918 [ 602.339668] FS: 00007f65d4b65700(0000) GS:ffff88001b800000(0000) knlGS:0000000000000000 [ 602.339668] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 602.339668] CR2: 0000000000f54800 CR3: 0000000016530000 CR4: 00000000000407e0 [ 602.339668] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 602.339668] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 602.339668] Process trinity (pid: 23084, threadinfo ffff88000ed3e000, task ffff88000f908000) [ 602.339668] Stack: [ 602.339668] ffff88000ed3fe98 ffffffff810d23db 2222222222222222 2222222222222222 [ 602.339668] 2222222222222222 ffff88007f310e58 ffff88007f310ea8 09286401f3b0af98 [ 602.339668] ffff88000ed3fec8 ffffffff810d3ce0 13b8db52e413d33a ffff88001aeccb98 [ 602.339668] Call Trace: [ 602.339668] [] try_to_grab_pending+0x2b/0xe0 [ 602.339668] [] __cancel_work_timer+0x80/0xa0 [ 602.339668] [] cancel_delayed_work_sync+0xd/0x10 [ 602.339668] [] fb_deferred_io_fsync+0x52/0x80 [ 602.339668] [] ? fget_light+0x118/0x3e0 [ 602.339668] [] vfs_fsync_range+0x18/0x30 [ 602.339668] [] vfs_fsync+0x17/0x20 [ 602.339668] [] do_fsync+0x34/0x60 [ 602.339668] [] sys_fdatasync+0xe/0x20 [ 602.339668] [] system_call_fastpath+0x16/0x1b [ 602.339668] Code: 66 2e 0f 1f 84 00 00 00 00 00 48 89 c2 31 c0 48 c1 ea 09 81 fa 01 10 00 00 74 3f 81 fa 00 10 00 00 74 27 39 15 89 ca f1 02 77 09 <0f> 0b 0f 1f 44 00 00 eb fe 48 c7 c0 80 f4 00 00 89 d2 48 03 04 [ 602.339668] RIP [] get_work_gcwq+0x41/0x80 [ 602.339668] RSP [ 602.674604] ---[ end trace 44593438a59a9538 ]--- It would seem that this is the case of trying to use deferred IO on FBs that don't support it. I had a cirrus fbdev in the guest, which from what I can tell doesn't support deferred IO. The first and the 2nd bug lead me to believe that 'fbdefio' was set to garbage.