nouveau: refcount_t splat on 4.15-rc1 on nv50

nouveau: refcount_t splat on 4.15-rc1 on nv50

[Richard Narron]

I get these kernel error messages too on 4.15-rc2 (and rc1) with my
MSI GeForce 210.

The messages appear to be benign as X Window and the X nouveau driver 
seem to work fine.

[    8.069341] fb: switching to nouveaufb from VESA VGA
[    8.089848] Console: switching to colour dummy device 80x25
[    8.089983] nouveau 0000:0f:00.0: NVIDIA GT218 (0a8280b1)
[    8.104713] snd_hda_codec_realtek hdaudioC0D0: ALC262: SKU not ready 
0x411111f0
[    8.105125] snd_hda_codec_realtek hdaudioC0D0: autoconfig for ALC262: 
line_outs=1 (0x15/0x0/0x0/0x0/0x0) type:line
[    8.105128] snd_hda_codec_realtek hdaudioC0D0:    speaker_outs=1 
(0x16/0x0/0x0/0x0/0x0)
[    8.105131] snd_hda_codec_realtek hdaudioC0D0:    hp_outs=1 
(0x1b/0x0/0x0/0x0/0x0)
[    8.105133] snd_hda_codec_realtek hdaudioC0D0:    mono: mono_out=0x0
[    8.105135] snd_hda_codec_realtek hdaudioC0D0:    inputs:
[    8.105138] snd_hda_codec_realtek hdaudioC0D0:      Front Mic=0x19
[    8.105140] snd_hda_codec_realtek hdaudioC0D0:      Rear Mic=0x18
[    8.105142] snd_hda_codec_realtek hdaudioC0D0:      Line=0x1a
[    8.115685] input: HDA Intel Front Mic as 
/devices/pci0000:00/0000:00:1b.0/sound/card0/input6
[    8.115722] input: HDA Intel Rear Mic as 
/devices/pci0000:00/0000:00:1b.0/sound/card0/input7
[    8.115754] input: HDA Intel Line as 
/devices/pci0000:00/0000:00:1b.0/sound/card0/input8
[    8.115785] input: HDA Intel Line Out as 
/devices/pci0000:00/0000:00:1b.0/sound/card0/input9
[    8.115813] input: HDA Intel Front Headphone as 
/devices/pci0000:00/0000:00:1b.0/sound/card0/input10
[    8.208559] nouveau 0000:0f:00.0: bios: version 70.18.a6.00.00
[    8.209028] nouveau 0000:0f:00.0: fb: 1024 MiB DDR3
[    8.209046] ------------[ cut here ]------------
[    8.209048] refcount_t: increment on 0; use-after-free.
[    8.209068] WARNING: CPU: 2 PID: 529 at lib/refcount.c:153 
refcount_inc+0x27/0x30
[    8.209070] Modules linked in: wmi_bmof coretemp snd_hda_codec_realtek 
nouveau(+) intel_powerclamp snd_hda_codec_generic mxm_wmi kvm_intel video 
snd_hda_intel ttm kvm snd_hda_codec tg3 irqbypass drm_kms_helper 
snd_hda_core psmouse drm crc32c_intel snd_hwdep libphy evdev agpgart 
snd_pcm i2c_algo_bit intel_cstate fb_sys_fops firewire_ohci serio_raw 
snd_timer syscopyarea sysfillrect firewire_core ptp sysimgblt lpc_ich snd 
pps_core i2c_core soundcore hwmon uhci_hcd wmi button ehci_pci ehci_hcd 
shpchp acpi_cpufreq loop
[    8.209098] CPU: 2 PID: 529 Comm: udevd Tainted: G          I 
4.15.0-rc2-mine #1
[    8.209101] Hardware name: Hewlett-Packard HP Z400 Workstation/0B4Ch, 
BIOS 786G3 v03.60 02/24/2016
[    8.209104] task: 000000003ca190e9 task.stack: 0000000057d30570
[    8.209106] RIP: 0010:refcount_inc+0x27/0x30
[    8.209108] RSP: 0000:ffffbfc5c02a7630 EFLAGS: 00010282
[    8.209110] RAX: 000000000000002b RBX: ffff9c8be6126c80 RCX: 
ffffffffb1439258
[    8.209112] RDX: 0000000000000001 RSI: 0000000000000092 RDI: 
0000000000000246
[    8.209114] RBP: ffff9c8be6126cd0 R08: 0000000000000328 R09: 
0000000000000000
[    8.209116] R10: ffffffffc0417e72 R11: 0720072007200720 R12: 
0000000000000000
[    8.209118] R13: ffff9c8be50a5460 R14: 0000000000000001 R15: 
ffff9c8be50a5440
[    8.209120] FS:  00007f19ee1517c0(0000) GS:ffff9c8befa80000(0000) 
knlGS:0000000000000000
[    8.209122] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    8.209124] CR2: 00007f19eccdcb18 CR3: 00000001a5818000 CR4: 
00000000000006e0
[    8.209126] Call Trace:
[    8.209182]  nv50_instobj_acquire+0xb1/0xf0 [nouveau]
[    8.209216]  nvkm_instobj_new+0xe2/0x160 [nouveau]
[    8.209245]  nvkm_memory_new+0x31/0x50 [nouveau]
[    8.209278]  nvkm_mmu_ptc_get.part.4+0x1ae/0x230 [nouveau]
[    8.209311]  nvkm_vmm_iter.constprop.13+0x458/0x790 [nouveau]
[    8.209344]  ? nvkm_vmm_map_choose+0xb0/0xb0 [nouveau]
[    8.209348]  ? kvmalloc_node+0x3e/0x70
[    8.209381]  ? nvkm_vmm_ctor+0x1ce/0x250 [nouveau]
[    8.209413]  nvkm_vmm_ptes_get+0x2e/0x80 [nouveau]
[    8.209446]  nvkm_vmm_boot+0x3e/0x80 [nouveau]
[    8.209475]  nv50_bar_oneinit+0xe8/0x310 [nouveau]
[    8.209504]  nvkm_subdev_init+0x4b/0x1f0 [nouveau]
[    8.209538]  nvkm_device_init+0x12c/0x260 [nouveau]
[    8.209573]  nvkm_udevice_init+0x41/0x60 [nouveau]
[    8.209602]  nvkm_object_init+0x3a/0x180 [nouveau]
[    8.209630]  nvkm_ioctl_new+0x19d/0x260 [nouveau]
[    8.209658]  ? nvkm_client_notify+0x30/0x30 [nouveau]
[    8.209692]  ? nvkm_udevice_rd08+0x20/0x20 [nouveau]
[    8.209720]  nvkm_ioctl+0x100/0x240 [nouveau]
[    8.209747]  nvif_object_init+0xbf/0x110 [nouveau]
[    8.209774]  nvif_device_init+0xe/0x30 [nouveau]
[    8.209808]  nouveau_cli_init+0x1bb/0x560 [nouveau]
[    8.209812]  ? kmem_cache_alloc_trace+0x175/0x1e0
[    8.209846]  nouveau_drm_load+0x56/0x900 [nouveau]
[    8.209865]  drm_dev_register+0x12f/0x1c0 [drm]
[    8.209874]  drm_get_pci_dev+0x93/0x170 [drm]
[    8.209877]  ? __pci_set_master+0x42/0x70
[    8.209911]  nouveau_drm_probe+0x1a9/0x230 [nouveau]
[    8.209915]  ? __pm_runtime_resume+0x54/0x70
[    8.209917]  pci_device_probe+0xc8/0x140
[    8.209921]  driver_probe_device+0x246/0x330
[    8.209924]  __driver_attach+0x8a/0x90
[    8.209926]  ? driver_probe_device+0x330/0x330
[    8.209928]  bus_for_each_dev+0x5c/0x90
[    8.209930]  bus_add_driver+0x196/0x220
[    8.209932]  ? 0xffffffffc05f6000
[    8.209934]  driver_register+0x57/0xc0
[    8.209935]  ? 0xffffffffc05f6000
[    8.209938]  do_one_initcall+0x4b/0x190
[    8.209941]  ? _cond_resched+0x15/0x40
[    8.209943]  ? kmem_cache_alloc_trace+0x103/0x1e0
[    8.209947]  ? do_init_module+0x22/0x201
[    8.209949]  do_init_module+0x5b/0x201
[    8.209951]  load_module+0x242b/0x2b20
[    8.209953]  ? __vfs_read+0xd2/0x140
[    8.209956]  ? SYSC_finit_module+0x90/0xb0
[    8.209958]  SYSC_finit_module+0x90/0xb0
[    8.209961]  entry_SYSCALL_64_fastpath+0x1e/0x81
[    8.209963] RIP: 0033:0x7f19ed6365b9
[    8.209965] RSP: 002b:00007ffc34049688 EFLAGS: 00000246 ORIG_RAX: 
0000000000000139
[    8.209967] RAX: ffffffffffffffda RBX: 00000000017cfe70 RCX: 
00007f19ed6365b9
[    8.209969] RDX: 0000000000000000 RSI: 00007f19ed915285 RDI: 
0000000000000015
[    8.209971] RBP: 00007f19ed915285 R08: 0000000000000000 R09: 
0000000000000000
[    8.209973] R10: 0000000000000015 R11: 0000000000000246 R12: 
0000000000000000
[    8.209975] R13: 00000000017c8c40 R14: 0000000000020000 R15: 
0000000000020000
[    8.209978] Code: 00 00 00 00 e8 ab ff ff ff 84 c0 74 02 f3 c3 80 3d a8 
52 eb 00 00 75 f5 48 c7 c7 20 b2 16 b1 c6 05 98 52 eb 00 01 e8 69 20 9f ff 
<0f> ff c3 66 0f 1f 44 00 00 8b 06 83 f8 ff 74 39 31 c9 39 f8 89
[    8.209998] ---[ end trace d58b8c135ffc0c8a ]---
[    8.252893] ------------[ cut here ]------------
[    8.252898] refcount_t: underflow; use-after-free.


Richard Narron
--
_______________________________________________
Nouveau mailing list
Nouveau@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/nouveau

nouveau: refcount_t splat on 4.15-rc1 on nv50

[Adam Borowski]

Hi guys!
I'm getting the following warn on 4.15-rc1, on GTX 560 Ti:

[    9.430433] nouveau 0000:01:00.0: NVIDIA GF114 (0ce000a1)
...
[    9.585172] nouveau 0000:01:00.0: bios: version 70.24.2e.00.02
...
[    9.772204] nouveau 0000:01:00.0: fb: 1024 MiB GDDR5
[    9.777342] ------------[ cut here ]------------
[    9.782106] refcount_t: increment on 0; use-after-free.
[    9.787522] WARNING: CPU: 0 PID: 3 at lib/refcount.c:153 refcount_inc+0x30/0x50
[    9.795060] Modules linked in: sha256_generic cfg80211(+) rfkill snd_usb_audio snd_usbmidi_lib nouveau(+) video ttm
[    9.805756] CPU: 0 PID: 3 Comm: kworker/0:0 Not tainted 4.15.0-rc1-debug-ubsan-00020-gf4707a916107 #1
[    9.815215] Hardware name: System manufacturer System Product Name/M4A77T, BIOS 2401    05/18/2011
[    9.824420] Workqueue: events work_for_cpu_fn
[    9.828915] task: ffff880226110c80 task.stack: ffffc90000c80000
[    9.830647] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[    9.841681] RIP: 0010:refcount_inc+0x30/0x50
[    9.846093] RSP: 0018:ffffc90000c83808 EFLAGS: 00010296
[    9.851458] RAX: 000000000000002b RBX: 0000000000000000 RCX: 0000000000000000
[    9.858763] RDX: 0000000000000001 RSI: 0000000000000082 RDI: ffffffff8378eb8c
[    9.866051] RBP: ffff88021f103fd0 R08: 0000000000000199 R09: ffff8800000bd500
[    9.873330] R10: 0000000000000000 R11: ffffffff82289a80 R12: 0000000000000000
[    9.880621] R13: ffff8802103a69e0 R14: ffff88021f103fe0 R15: ffff88021f103fe0
[    9.887909] FS:  0000000000000000(0000) GS:ffff88022fc00000(0000) knlGS:0000000000000000
[    9.896230] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    9.902117] CR2: 0000560476ba0000 CR3: 0000000225232000 CR4: 00000000000006f0
[    9.909417] Call Trace:
[    9.912106]  nv50_instobj_acquire+0x123/0x1c0 [nouveau]
[    9.917565]  ? nvbios_rd08+0x1b/0x70 [nouveau]
[    9.922239]  nvkm_instobj_new+0x1e3/0x520 [nouveau]
[    9.927353]  ? nvbios_rd08+0x1b/0x70 [nouveau]
[    9.932017]  ? nvbios_pll_parse+0x8d7/0xcf0 [nouveau]
[    9.937218]  ? kmem_cache_alloc+0x1f0/0x2d0
[    9.941624]  nvkm_memory_new+0x4b/0xc0 [nouveau]
[    9.946461]  ? nvkm_longopt+0x17/0x60 [nouveau]
[    9.951208]  gf100_fb_oneinit+0x7b/0x1c0 [nouveau]
[    9.956218]  nvkm_fb_oneinit+0x89/0x2e0 [nouveau]
[    9.961144]  nvkm_subdev_init+0x92/0x600 [nouveau]
[    9.966085]  ? ktime_get+0x64/0x110
[    9.969815]  nvkm_device_init+0x169/0x2a0 [nouveau]
[    9.974922]  nvkm_udevice_init+0x7e/0xf0 [nouveau]
[    9.979924]  nvkm_object_init+0x6a/0x2e0 [nouveau]
[    9.984932]  nvkm_ioctl_new+0x198/0x430 [nouveau]
[    9.989846]  ? nvif_vmm_init+0x340/0x340 [nouveau]
[    9.994864]  ? nvkm_udevice_rd08+0x90/0x90 [nouveau]
[   10.000056]  nvkm_ioctl+0x21e/0x5a0 [nouveau]
[   10.004548]  ? yield_to+0x2b2/0x370
[   10.008257]  nvif_object_init+0xef/0x1b0 [nouveau]
[   10.013281]  nvif_device_init+0x9/0x40 [nouveau]
[   10.018136]  nouveau_cli_init+0x234/0x12f0 [nouveau]
[   10.023253]  ? idr_alloc_cyclic+0x6c/0x110
[   10.027487]  ? _cond_resched+0x1d/0x80
[   10.031366]  ? kmem_cache_alloc+0x1f0/0x2d0
[   10.035790]  nouveau_drm_load+0x71/0xec0 [nouveau]
[   10.040735]  drm_dev_register+0x1b4/0x330
[   10.044872]  ? pci_enable_device_flags+0x155/0x200
[   10.049806]  drm_get_pci_dev+0xde/0x2c0
[   10.053874]  nouveau_drm_probe+0x1b9/0x240 [nouveau]
[   10.058986]  ? __pm_runtime_resume+0x68/0xb0
[   10.063409]  local_pci_probe+0x5e/0xf0
[   10.067300]  work_for_cpu_fn+0x10/0x30
[   10.071183]  process_one_work+0x21a/0x670
[   10.075325]  worker_thread+0x256/0x500
[   10.079208]  ? manage_workers+0x1e0/0x1e0
[   10.083362]  kthread+0x169/0x220
[   10.086730]  ? kthread_create_worker_on_cpu+0x40/0x40
[   10.091933]  ret_from_fork+0x1f/0x30
[   10.095655] Code: ff 84 c0 74 02 5b c3 0f b6 1d 59 b2 a6 01 80 fb 01 77 1c 83 e3 01 75 ed 48 c7 c7 c8 f1 3f 82 c6 05 41 b2 a6 01 01 e8 50 02 8d ff <0f> ff 5b c3 0f b6 f3 48 c7 c7 00 16 c7 82 e8 dd 81 0d 00 eb d3 
[   10.114909] ---[ end trace 08f29138ff4259e6 ]---
[   10.119703] hpet1: lost 21 rtc interrupts
[   10.125534] ------------[ cut here ]------------
[   10.130326] refcount_t: underflow; use-after-free.
[   10.135292] WARNING: CPU: 0 PID: 3 at lib/refcount.c:281 refcount_dec_not_one+0x68/0x90
[   10.143540] Modules linked in: sha256_generic cfg80211 rfkill snd_usb_audio snd_usbmidi_lib nouveau(+) video ttm
[   10.153956] CPU: 0 PID: 3 Comm: kworker/0:0 Tainted: G        W        4.15.0-rc1-debug-ubsan-00020-gf4707a916107 #1
[   10.164719] Hardware name: System manufacturer System Product Name/M4A77T, BIOS 2401    05/18/2011
[   10.173929] Workqueue: events work_for_cpu_fn
[   10.178423] task: ffff880226110c80 task.stack: ffffc90000c80000
[   10.184488] RIP: 0010:refcount_dec_not_one+0x68/0x90
[   10.189580] RSP: 0018:ffffc90000c837f0 EFLAGS: 00010286
[   10.194946] RAX: 0000000000000026 RBX: 0000000000000000 RCX: 0000000000000000
[   10.202232] RDX: 0000000000000001 RSI: 0000000000000092 RDI: ffffffff8378eb8c
[   10.209512] RBP: ffff8802103a69e0 R08: 0000000000000199 R09: ffff8800000b9040
[   10.216801] R10: 0000000000000000 R11: ffffffff82289a80 R12: ffff8802103a69e0
[   10.224090] R13: ffffffffa025dc20 R14: ffff88021f103f80 R15: ffffffffa0368e60
[   10.231362] FS:  0000000000000000(0000) GS:ffff88022fc00000(0000) knlGS:0000000000000000
[   10.239679] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   10.245569] CR2: 0000560476ba0000 CR3: 0000000225232000 CR4: 00000000000006f0
[   10.252862] Call Trace:
[   10.255433]  refcount_dec_and_mutex_lock+0x18/0x70
[   10.260450]  nv50_instobj_release+0x69/0x1a0 [nouveau]
[   10.265834]  nvkm_instobj_new+0x219/0x520 [nouveau]
[   10.270935]  ? nvbios_rd08+0x1b/0x70 [nouveau]
[   10.275598]  ? nvbios_pll_parse+0x8d7/0xcf0 [nouveau]
[   10.280807]  ? kmem_cache_alloc+0x1f0/0x2d0
[   10.285205]  nvkm_memory_new+0x4b/0xc0 [nouveau]
[   10.290042]  ? nvkm_longopt+0x17/0x60 [nouveau]
[   10.294808]  gf100_fb_oneinit+0x7b/0x1c0 [nouveau]
[   10.299818]  nvkm_fb_oneinit+0x89/0x2e0 [nouveau]
[   10.304733]  nvkm_subdev_init+0x92/0x600 [nouveau]
[   10.309667]  ? ktime_get+0x64/0x110
[   10.313394]  nvkm_device_init+0x169/0x2a0 [nouveau]
[   10.318512]  nvkm_udevice_init+0x7e/0xf0 [nouveau]
[   10.323524]  nvkm_object_init+0x6a/0x2e0 [nouveau]
[   10.328539]  nvkm_ioctl_new+0x198/0x430 [nouveau]
[   10.333464]  ? nvif_vmm_init+0x340/0x340 [nouveau]
[   10.338506]  ? nvkm_udevice_rd08+0x90/0x90 [nouveau]
[   10.343691]  nvkm_ioctl+0x21e/0x5a0 [nouveau]
[   10.348190]  ? yield_to+0x2b2/0x370
[   10.351891]  nvif_object_init+0xef/0x1b0 [nouveau]
[   10.356914]  nvif_device_init+0x9/0x40 [nouveau]
[   10.361761]  nouveau_cli_init+0x234/0x12f0 [nouveau]
[   10.366876]  ? idr_alloc_cyclic+0x6c/0x110
[   10.371120]  ? _cond_resched+0x1d/0x80
[   10.375000]  ? kmem_cache_alloc+0x1f0/0x2d0
[   10.379405]  nouveau_drm_load+0x71/0xec0 [nouveau]
[   10.384340]  drm_dev_register+0x1b4/0x330
[   10.388488]  ? pci_enable_device_flags+0x155/0x200
[   10.393411]  drm_get_pci_dev+0xde/0x2c0
[   10.397482]  nouveau_drm_probe+0x1b9/0x240 [nouveau]
[   10.402583]  ? __pm_runtime_resume+0x68/0xb0
[   10.407001]  local_pci_probe+0x5e/0xf0
[   10.410890]  work_for_cpu_fn+0x10/0x30
[   10.414780]  process_one_work+0x21a/0x670
[   10.418925]  worker_thread+0x256/0x500
[   10.422816]  ? manage_workers+0x1e0/0x1e0
[   10.426967]  kthread+0x169/0x220
[   10.430328]  ? kthread_create_worker_on_cpu+0x40/0x40
[   10.435524]  ret_from_fork+0x1f/0x30
[   10.439246] Code: da eb ea 31 c0 eb eb 0f b6 1d ce b0 a6 01 80 fb 01 77 2c 83 e3 01 75 d5 48 c7 c7 f8 f1 3f 82 c6 05 b6 b0 a6 01 01 e8 c8 00 8d ff <0f> ff eb be 31 f6 48 c7 c7 a0 14 c7 82 e8 a6 7d 0d 00 eb 91 0f 
[   10.458480] ---[ end trace 08f29138ff4259e7 ]---

Appears to be benign: no obvious breakage afterwards.

I did not yet bisect -- would you want me to?


Meow!
-- 
< darkling> When all you have is a hammock, every problem looks like a nap.
_______________________________________________
Nouveau mailing list
Nouveau@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/nouveau