From 7509702bd8bd0975cc42a7272221446a897be950 Mon Sep 17 00:00:00 2001 From: Chris Wilson Date: Mon, 5 Mar 2018 10:33:12 +0000 Subject: [PATCH] drm/i915: Unwind vma pinning for intel_pin_and_fence_fb_obj error path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If we fail to acquire a fence when we must, we must unwind before reporting the error. Otherwise, we lose tracking of the vma pinning and eventually hit a bug like <3>[ 46.163202] i915_vma_unpin:333 GEM_BUG_ON(!i915_vma_is_pinned(vma)) <4>[ 46.163424] ------------[ cut here ]------------ <2>[ 46.163429] kernel BUG at drivers/gpu/drm/i915/i915_vma.h:333! <4>[ 46.163444] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI <0>[ 46.163451] Dumping ftrace buffer: <0>[ 46.163457] --------------------------------- <0>[ 46.163630] <...>-84 1.... 46260767us : i915_gem_object_unpin_from_display_plane: i915_vma_unpin:333 GEM_BUG_ON(!i915_vma_is_pinned(vma)) <0>[ 46.163635] --------------------------------- <4>[ 46.163638] Modules linked in: vgem i915 snd_hda_codec_analog snd_hda_codec_generic coretemp snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm lpc_ich mei_me e1000e mei prime_numbers <4>[ 46.163667] CPU: 1 PID: 84 Comm: kworker/u16:1 Tainted: G U 4.16.0-rc3-gc07ef2c77d14-kasan_18+ #1 <4>[ 46.163671] Hardware name: Dell Inc. OptiPlex 755 /0PU052, BIOS A08 02/19/2008 <4>[ 46.163743] Workqueue: events_unbound intel_atomic_commit_work [i915] <4>[ 46.163809] RIP: 0010:i915_gem_object_unpin_from_display_plane+0x253/0x2f0 [i915] <4>[ 46.163813] RSP: 0018:ffff8800624cfb48 EFLAGS: 00010286 <4>[ 46.163818] RAX: 000000000000000c RBX: ffff880064446c40 RCX: ffff8800653135b8 <4>[ 46.163822] RDX: dffffc0000000000 RSI: 0000000000000054 RDI: ffff8800651e30d0 <4>[ 46.163825] RBP: 00000000000003d0 R08: 0000000000000001 R09: ffff8800651e3158 <4>[ 46.163829] R10: 0000000000000000 R11: ffff8800651e30f0 R12: 0000000000000001 <4>[ 46.163832] R13: ffff880054c58620 R14: 0000000000000000 R15: dffffc0000000000 <4>[ 46.163836] FS: 0000000000000000(0000) GS:ffff880066040000(0000) knlGS:0000000000000000 <4>[ 46.163840] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 46.163843] CR2: 00007f1fc6fb0000 CR3: 00000000526fe000 CR4: 00000000000006e0 <4>[ 46.163846] Call Trace: <4>[ 46.163918] intel_unpin_fb_vma+0xbd/0x300 [i915] <4>[ 46.163990] intel_cleanup_plane_fb+0x99/0xc0 [i915] <4>[ 46.163998] drm_atomic_helper_cleanup_planes+0x166/0x280 <4>[ 46.164071] intel_atomic_commit_tail+0x1594/0x33a0 [i915] <4>[ 46.164081] ? process_one_work+0x66e/0x1460 <4>[ 46.164151] ? skl_update_crtcs+0x9c0/0x9c0 [i915] <4>[ 46.164157] ? lock_acquire+0x13d/0x390 <4>[ 46.164161] ? lock_acquire+0x13d/0x390 <4>[ 46.164169] process_one_work+0x71a/0x1460 <4>[ 46.164175] ? __schedule+0x838/0x1e50 <4>[ 46.164182] ? pwq_dec_nr_in_flight+0x2b0/0x2b0 <4>[ 46.164188] ? _raw_spin_lock_irq+0xa/0x40 <4>[ 46.164194] worker_thread+0xdf/0xf60 <4>[ 46.164204] ? process_one_work+0x1460/0x1460 <4>[ 46.164209] kthread+0x2cf/0x3c0 <4>[ 46.164213] ? _kthread_create_on_node+0xa0/0xa0 <4>[ 46.164218] ret_from_fork+0x3a/0x50 <4>[ 46.164227] Code: e8 78 d9 cd e8 48 8b 35 cc 9e 47 00 49 c7 c0 c0 31 84 c0 b9 4d 01 00 00 48 c7 c2 e0 80 84 c0 48 c7 c7 0e bb 57 c0 e8 5d 4b df e8 <0f> 0b 48 c7 c1 c0 30 84 c0 ba 4e 01 00 00 48 c7 c6 e0 80 84 c0 <1>[ 46.164368] RIP: i915_gem_object_unpin_from_display_plane+0x253/0x2f0 [i915] RSP: ffff8800624cfb48 Fixes: 85798ac9b35f ("drm/i915: Fail if we can't get a fence for gen2/3 tiled scanout") Signed-off-by: Chris Wilson Cc: Ville Syrjälä Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20180305103312.29492-1-chris@chris-wilson.co.uk --- drivers/gpu/drm/i915/intel_display.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c index 90f0fc8cc2bd..ceed0821b37d 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -2152,6 +2152,7 @@ intel_pin_and_fence_fb_obj(struct drm_framebuffer *fb, */ ret = i915_vma_pin_fence(vma); if (ret != 0 && INTEL_GEN(dev_priv) < 4) { + i915_gem_object_unpin_from_display_plane(vma); vma = ERR_PTR(ret); goto err; }