Re: Hang in 5.17.4+ that appears to be due to Xen

From: Juergen Gross <jgross@suse.com>
To: Demi Marie Obenour <demi@invisiblethingslab.com>,
	Xen developer discussion <xen-devel@lists.xenproject.org>
Cc: "Boris Ostrovski" <boris.ostrovsky@oracle.com>,
	"Marek Marczykowski-Górecki" <marmarek@invisiblethingslab.com>,
	linux-kernel@vger.kernel.org,
	"Jani Nikula" <jani.nikula@linux.intel.com>,
	"Joonas Lahtinen" <joonas.lahtinen@linux.intel.com>,
	"Rodrigo Vivi" <rodrigo.vivi@intel.com>,
	"Tvrtko Ursulin" <tvrtko.ursulin@linux.intel.com>,
	"David Airlie" <airlied@linux.ie>,
	"Daniel Vetter" <daniel@ffwll.ch>,
	"Intel Graphics Development" <intel-gfx@lists.freedesktop.org>,
	"DRI Development" <dri-devel@lists.freedesktop.org>
Subject: Re: Hang in 5.17.4+ that appears to be due to Xen
Date: Mon, 16 May 2022 08:48:17 +0200	[thread overview]
Message-ID: <55436ae1-8255-1898-00df-51261080cd41@suse.com> (raw)
In-Reply-To: <Yn/Tgj1Ehs/BdpHp@itl-email>

[-- Attachment #1.1.1: Type: text/plain, Size: 1484 bytes --]

On 14.05.22 17:55, Demi Marie Obenour wrote:
> In https://github.com/QubesOS/qubes-issues/issues/7481, a user reported
> that Xorg locked up when resizing a VM window.  While I do not have the
> same hardware the user does and thus cannot reproduce the bug, the stack
> trace seems to indicate a deadlock between xen_gntdev and i915.  It
> appears that gnttab_unmap_refs_sync() is waiting for i915 to free the
> pages, while i915 is waiting for the MMU notifier that called
> gnttab_unmap_refs_sync() to return.  Result: deadlock.
> 
> The problem appears to be that a mapped grant in PV mode will stay in
> the “invalidating” state until it is freed.  While MMU notifiers are
> allowed to sleep, it appears that they cannot wait for the page to be
> freed, as is happening here.  That said, I am not very familiar with
> this code, so my diagnosis might be incorrect.

All I can say for now is that your patch seems to be introducing a use after
free issue, as the parameters of the delayed work might get freed now before
the delayed work is being executed.

I don't know why this is happening only with rather recent kernels, as the
last gntdev changes in this area have been made in kernel 4.13.

I'd suggest to look at i915, as quite some work has happened in the code
visible in your stack backtraces rather recently. Maybe it would be possible
to free the pages in i915 before calling the MMU notifier?

Adding the i915 maintainers.

Juergen

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3149 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]