Re: WARNING in drm_modeset_lock_all

Re: WARNING in drm_modeset_lock_all

[Chris Wilson]

Quoting syzbot (2017-10-27 09:09:50)
> Hello,
> 
> syzkaller hit the following crash on  
> 6f20b7a58cb9c0fe00badcdfd65b1f4a8f28dfc6
> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached
> Raw console output is attached.
> 
> 
> 
> 
> ------------[ cut here ]------------
> WARNING: CPU: 2 PID: 11675 at drivers/gpu/drm/drm_modeset_lock.c:92  
> drm_modeset_lock_all+0x1fc/0x2d0 drivers/gpu/drm/drm_modeset_lock.c:92
> Kernel panic - not syncing: panic_on_warn set ...
> 
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Call Trace:
>   __dump_stack lib/dump_stack.c:16 [inline]
>   dump_stack+0x194/0x257 lib/dump_stack.c:52
>   fail_dump lib/fault-inject.c:51 [inline]
>   should_fail+0x8c0/0xa40 lib/fault-inject.c:149
>   should_failslab+0xec/0x120 mm/failslab.c:31
>   slab_pre_alloc_hook mm/slab.h:422 [inline]
>   slab_alloc mm/slab.c:3383 [inline]
>   kmem_cache_alloc_trace+0x4b/0x750 mm/slab.c:3625
>   kmalloc include/linux/slab.h:493 [inline]
>   kzalloc include/linux/slab.h:666 [inline]
>   drm_modeset_lock_all+0x49/0x2d0 drivers/gpu/drm/drm_modeset_lock.c:91
>   drm_mode_obj_get_properties_ioctl+0x87/0x2b0  
> drivers/gpu/drm/drm_mode_object.c:359
>   drm_ioctl_kernel+0x1e7/0x2e0 drivers/gpu/drm/drm_ioctl.c:735
>   drm_ioctl+0x72e/0xa50 drivers/gpu/drm/drm_ioctl.c:831
>   vfs_ioctl fs/ioctl.c:45 [inline]
>   do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685
>   SYSC_ioctl fs/ioctl.c:700 [inline]
>   SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
>   entry_SYSCALL_64_fastpath+0x1f/0xbe

This bug is for the unexpected allocation failure inside
drm_modeset_lock_all() (in this case from should_fail). To properly
document this behaviour, we should probably use

diff --git a/drivers/gpu/drm/drm_modeset_lock.c b/drivers/gpu/drm/drm_modeset_lock.c
index e123497da0ca..963e23db0fe7 100644
--- a/drivers/gpu/drm/drm_modeset_lock.c
+++ b/drivers/gpu/drm/drm_modeset_lock.c
@@ -93,7 +93,7 @@ void drm_modeset_lock_all(struct drm_device *dev)
        struct drm_modeset_acquire_ctx *ctx;
        int ret;
 
-       ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+       ctx = kzalloc(sizeof(*ctx), GFP_KERNEL | __GFP_NOFAIL);
        if (WARN_ON(!ctx))
                return;

Then it will turn up on somebody'ss too-small-to-fail fix list.
-Chris

Re: WARNING in drm_modeset_lock_all

[Daniel Vetter]

On Mon, Oct 30, 2017 at 02:24:32PM +0000, Chris Wilson wrote:
> Quoting syzbot (2017-10-27 09:09:50)
> > Hello,
> > 
> > syzkaller hit the following crash on  
> > 6f20b7a58cb9c0fe00badcdfd65b1f4a8f28dfc6
> > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
> > compiler: gcc (GCC) 7.1.1 20170620
> > .config is attached
> > Raw console output is attached.
> > 
> > 
> > 
> > 
> > ------------[ cut here ]------------
> > WARNING: CPU: 2 PID: 11675 at drivers/gpu/drm/drm_modeset_lock.c:92  
> > drm_modeset_lock_all+0x1fc/0x2d0 drivers/gpu/drm/drm_modeset_lock.c:92
> > Kernel panic - not syncing: panic_on_warn set ...
> > 
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> > Call Trace:
> >   __dump_stack lib/dump_stack.c:16 [inline]
> >   dump_stack+0x194/0x257 lib/dump_stack.c:52
> >   fail_dump lib/fault-inject.c:51 [inline]
> >   should_fail+0x8c0/0xa40 lib/fault-inject.c:149
> >   should_failslab+0xec/0x120 mm/failslab.c:31
> >   slab_pre_alloc_hook mm/slab.h:422 [inline]
> >   slab_alloc mm/slab.c:3383 [inline]
> >   kmem_cache_alloc_trace+0x4b/0x750 mm/slab.c:3625
> >   kmalloc include/linux/slab.h:493 [inline]
> >   kzalloc include/linux/slab.h:666 [inline]
> >   drm_modeset_lock_all+0x49/0x2d0 drivers/gpu/drm/drm_modeset_lock.c:91
> >   drm_mode_obj_get_properties_ioctl+0x87/0x2b0  
> > drivers/gpu/drm/drm_mode_object.c:359
> >   drm_ioctl_kernel+0x1e7/0x2e0 drivers/gpu/drm/drm_ioctl.c:735
> >   drm_ioctl+0x72e/0xa50 drivers/gpu/drm/drm_ioctl.c:831
> >   vfs_ioctl fs/ioctl.c:45 [inline]
> >   do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685
> >   SYSC_ioctl fs/ioctl.c:700 [inline]
> >   SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
> >   entry_SYSCALL_64_fastpath+0x1f/0xbe
> 
> This bug is for the unexpected allocation failure inside
> drm_modeset_lock_all() (in this case from should_fail). To properly
> document this behaviour, we should probably use
> 
> diff --git a/drivers/gpu/drm/drm_modeset_lock.c b/drivers/gpu/drm/drm_modeset_lock.c
> index e123497da0ca..963e23db0fe7 100644
> --- a/drivers/gpu/drm/drm_modeset_lock.c
> +++ b/drivers/gpu/drm/drm_modeset_lock.c
> @@ -93,7 +93,7 @@ void drm_modeset_lock_all(struct drm_device *dev)
>         struct drm_modeset_acquire_ctx *ctx;
>         int ret;
>  
> -       ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
> +       ctx = kzalloc(sizeof(*ctx), GFP_KERNEL | __GFP_NOFAIL);
>         if (WARN_ON(!ctx))
>                 return;
> 
> Then it will turn up on somebody'ss too-small-to-fail fix list.

lgtm. Can you pls submit this as a patch withs sob and everything?

Thanks, Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch

Re: WARNING in drm_modeset_lock_all

[Chris Wilson]

Quoting syzbot (2017-10-27 09:09:50)
> This bug is generated by a dumb bot. It may contain errors.
> See https://goo.gl/tpsmEJ for details.
> Direct all questions to syzkaller@googlegroups.com.
> 
> syzbot will keep track of this bug report.
> Once a fix for this bug is committed, please reply to this email with:
> #syz fix: exact-commit-title
> To mark this as a duplicate of another syzbot report, please reply with:
> #syz dup: exact-subject-of-another-report
> If it's a one-off invalid bug report, please reply with:
> #syz invalid
> Note: if the crash happens again, it will cause creation of a new bug  
> report.

Can we use 

Reported-by: syzbot <bot+8de19a03d6fdf256eb2b90ec48916b6f47b9b5a3@syzkaller.appspotmail.com>

as a unique tag for tracking purposes?
-Chris

Re: WARNING in drm_modeset_lock_all

[Dmitry Vyukov]

On Tue, Oct 31, 2017 at 3:45 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
> Quoting syzbot (2017-10-27 09:09:50)
>> This bug is generated by a dumb bot. It may contain errors.
>> See https://goo.gl/tpsmEJ for details.
>> Direct all questions to syzkaller@googlegroups.com.
>>
>> syzbot will keep track of this bug report.
>> Once a fix for this bug is committed, please reply to this email with:
>> #syz fix: exact-commit-title
>> To mark this as a duplicate of another syzbot report, please reply with:
>> #syz dup: exact-subject-of-another-report
>> If it's a one-off invalid bug report, please reply with:
>> #syz invalid
>> Note: if the crash happens again, it will cause creation of a new bug
>> report.
>
> Can we use
>
> Reported-by: syzbot <bot+8de19a03d6fdf256eb2b90ec48916b6f47b9b5a3@syzkaller.appspotmail.com>
>
> as a unique tag for tracking purposes?


Hi,

Seems to be a common question. I've added the following to bug template:

Please credit me with: Reported-by: syzbot <syzkaller@googlegroups.com>

will now be present on newly reported bugs:

https://groups.google.com/forum/#!topic/syzkaller-bugs/XE8YSiSZDdA






> -Chris
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/150945394709.15081.7550043352916368752%40mail.alporthouse.com.
> For more options, visit https://groups.google.com/d/optout.

Re: WARNING in drm_modeset_lock_all

[Dmitry Vyukov]

On Tue, Oct 31, 2017 at 2:03 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> On Tue, Oct 31, 2017 at 3:45 PM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
>> Quoting syzbot (2017-10-27 09:09:50)
>>> This bug is generated by a dumb bot. It may contain errors.
>>> See https://goo.gl/tpsmEJ for details.
>>> Direct all questions to syzkaller@googlegroups.com.
>>>
>>> syzbot will keep track of this bug report.
>>> Once a fix for this bug is committed, please reply to this email with:
>>> #syz fix: exact-commit-title
>>> To mark this as a duplicate of another syzbot report, please reply with:
>>> #syz dup: exact-subject-of-another-report
>>> If it's a one-off invalid bug report, please reply with:
>>> #syz invalid
>>> Note: if the crash happens again, it will cause creation of a new bug
>>> report.
>>
>> Can we use
>>
>> Reported-by: syzbot <bot+8de19a03d6fdf256eb2b90ec48916b6f47b9b5a3@syzkaller.appspotmail.com>
>>
>> as a unique tag for tracking purposes?
>
>
> Hi,
>
> Seems to be a common question. I've added the following to bug template:
>
> Please credit me with: Reported-by: syzbot <syzkaller@googlegroups.com>
>
> will now be present on newly reported bugs:
>
> https://groups.google.com/forum/#!topic/syzkaller-bugs/XE8YSiSZDdA


This was fixed by:
#syz fix: drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all


Now we indeed can use:
Reported-by: syzbot
<bot+8de19a03d6fdf256eb2b90ec48916b6f47b9b5a3@syzkaller.appspotmail.com>
which avoids the need to go back and manually attach fixing commit to
the report like this.