[BUG] HID: amd_sfh (drivers/hid/amd-sfh-hid/): memory/page corruption

Wed Jul 17 11:21:09 UTC 2024

On 15.07.24 06:39, Chris Hixon wrote:
> System: HP ENVY x360 Convertible 15-ds1xxx; AMD Ryzen 7 4700U with
> Radeon Graphics
> 
> Problem commits (introduced in v6.9-rc1):
> 6296562f30b1 HID: amd_sfh: Extend MP2 register access to SFH
> 2105e8e00da4 HID: amd_sfh: Improve boot time when SFH is available
>> It appears amd_sfh commits 6296562f30b1 and 2105e8e00da4 correlate with
> some form of memory/page corruption. 

Hi! From a quick search on lore it looks like Basavaraj Natikar who
authored those two commits is inactive since a few days. This is totally
fine, but given the nature of the problem slightly unfortunate. That's
why I'm trying to raise awareness to this report by adding the
subsystems maintainers, a few lists, and a few people to the list of
recipients that were involved in the submission of those two patches.
With a bit of luck somebody might be able to help out. Ciao, Thorsten

> On my system, this typically
> presents itself as a page dump followed by BTRFS errors, usually
> involving "corrupt leaf" (see dmesg output below); often the BTRFS
> filesystem becomes read-only afterwards. Note that the underlying NVME
> disk seems fine, and the BTRFS filesystem does not actually appear to be
> corrupt when booted/checked from kernels without this bug (no BTRFS
> errors or I/O errors reported on non-problem kernels).
> 
> I have no problems when I blacklist the amd_sfh module (any kernel
> version), or revert both commits 6296562f30b1 and 2105e8e00da4 (on
> stable, linux-6.9.y). I have no problems on any recent linux-mainline
> (v6.10{,-rc*}) when reverting these two commits (in addition to
> reverting 7902ec988a9a and 6856f079cd45 to successfully build the
> kernel). I have had no problems with any 6.6.y, v6.7.y, or v6.8.y version.
> 
> It is curious BTRFS always seems involved, but problems go away with
> these amd_sfh commits reverted (or amd_afh disabled).
> 
> Further notes:
> 
> I have not specifically used the amd_sfh module for anything. As far
> I've been able to determine, my system has the "Sensor Fusion Hub" mp2
> chip, but has no supported sensors/sub-devices (or I need to do
> something to enable them), (or there is an error while detecting
> sensors?). All logs I've checked contain something like:
> 
> Jul 09 04:14:37 arch kernel: pcie_mp2_amd 0000:04:00.7: enabling device
> (0000 -> 0002)
> Jul 09 04:15:07 arch kernel: pcie_mp2_amd 0000:04:00.7: Failed to
> discover, sensors not enabled is 0
> Jul 09 04:15:07 arch kernel: pcie_mp2_amd 0000:04:00.7:
> amd_sfh_hid_client_init failed err -95
> 
> Excerpt from lshw:
>            *-generic:1 UNCLAIMED
>                 description: Signal processing controller
>                 product: Sensor Fusion Hub
>                 vendor: Advanced Micro Devices, Inc. [AMD]
>                 physical id: 0.7
>                 bus info: pci at 0000:04:00.7
>                 version: 00
>                 width: 32 bits
>                 clock: 33MHz
>                 capabilities: pm pciexpress msi msix cap_list
>                 configuration: latency=0
>                 resources: memory:fe000000-fe0fffff
> memory:fe4cc000-fe4cdfff
> 
> How I tracked down the problem commits:
> 
> I was not able to successfully "git bisect" this bug - I seemed to run
> into a mess of unrelated problems/errors that sent me down a rabbit hole
> chasing who knows what. I had already manually narrowed down the bug to
> amd_sfh by blacklisting modules, so I reverted each
> drivers/hid/amd-sfh-hid commit on the stable linux-6.9.y branch (v6.9.8
> known "bad"), back to v6.6 (known "good"), and then manually bisected
> the revert commits, landing on "HID: amd_sfh: Improve boot time when SFH
> is available" (2105e8e00da4) as the first "bad" commit.
> 
> I wanted to be able to test with only the "bad" commit(s) removed; it
> turns out 6296562f30b1 ("HID: amd_sfh: Extend MP2 register access to
> SFH") needs to be reverted to do that. Everything seems fine with these
> two commits reverted (again, this in on the stable linux-6.9.y branch).
> 
> When testing, "bad" commits usually quickly display some variation of
> the page dump/BTRFS errors, similar to the dmesg output below. I
> consider commits "good" if the system survives "stress-ng --all 2
> --vm-bytes 50% --minimize --syslog --status 10 -t 5m" (run as a non-root
> user), which was usually followed by building the next test kernel. The
> "bad" commits often show errors before I even get to the stress test.
> 
> Examples of error messages from dmesg:
> 
> [  653.364343] page: refcount:4 mapcount:0 mapping:00000000b159289f
> index:0x585a7cec pfn:0x10b5c1
> [  653.364353] memcg:ffff8f2600918000
> [  653.364354] aops:btree_aops ino:1
> [  653.364358] flags:
> 0x17ffffd000802a(uptodate|lru|private|writeback|node=0|zone=2|lastcpupid=0x1fffff)
> [  653.364361] page_type: 0xffffffff()
> [  653.364363] raw: 0017ffffd000802a fffff1da87ee3288 fffff1da842d70c8
> ffff8f260c719458
> [  653.364365] raw: 00000000585a7cec ffff8f26cd09e0f0 00000004ffffffff
> ffff8f2600918000
> [  653.364366] page dumped because: eb page dump
> [  653.364367] BTRFS critical (device dm-0): corrupt leaf: root=7
> block=6071604133888 slot=159, unexpected item end, have 2768254010
> expect 13379
> [  653.364371] BTRFS info (device dm-0): leaf 6071604133888 gen 679995
> total ptrs 353 free space 322 owner 7
> [  653.364373]     item 0 key (18446744073709551606 128 1062871883776)
> itemoff 16271 itemsize 12
> [  653.364375]     item 1 key (18446744073709551606 128 1062871896064)
> itemoff 16263 itemsize 8
> [  653.364376]     item 2 key (18446744073709551606 128 1062871904256)
> itemoff 16255 itemsize 8
> ...
> [  653.364762]     item 350 key (18446744073709551606 128 1062879260672)
> itemoff 9227 itemsize 12
> [  653.364763]     item 351 key (18446744073709551606 128 1062879272960)
> itemoff 9223 itemsize 4
> [  653.364764]     item 352 key (18446744073709551606 128 1062879277056)
> itemoff 9147 itemsize 76
> [  653.364766] BTRFS error (device dm-0): block=6071604133888 write time
> tree block corruption detected
> [  653.375440] BTRFS: error (device dm-0) in
> btrfs_commit_transaction:2511: errno=-5 IO failure (Error while writing
> out transaction)
> [  653.375453] BTRFS info (device dm-0 state E): forced readonly
> [  653.375458] BTRFS warning (device dm-0 state E): Skipping commit of
> aborted transaction.
> [  653.375461] BTRFS error (device dm-0 state EA): Transaction aborted
> (error -5)
> [  653.375465] BTRFS: error (device dm-0 state EA) in
> cleanup_transaction:2005: errno=-5 IO failure
> [  653.375582] BTRFS warning (device dm-0 state EA): Skipping commit of
> aborted transaction.
> [  653.375586] BTRFS: error (device dm-0 state EA) in
> cleanup_transaction:2005: errno=-5 IO failure
> 
> Another example:
> 
> [ 5478.134046] page: refcount:4 mapcount:0 mapping:0000000010080c01
> index:0x5459ff30 pfn:0x168c7f
> [ 5478.134054] memcg:ffff89c240988000
> [ 5478.134056] aops:btree_aops ino:1
> [ 5478.134061] flags:
> 0x17ffffd800802a(uptodate|lru|private|writeback|node=0|zone=2|lastcpupid=0x1fffff)
> [ 5478.134064] page_type: 0xffffffff()
> [ 5478.134066] raw: 0017ffffd800802a ffffcc5d043e2bc8 ffffcc5d05a08c88
> ffff89c249968338
> [ 5478.134068] raw: 000000005459ff30 ffff89c246fa22d0 00000004ffffffff
> ffff89c240988000
> [ 5478.134069] page dumped because: eb page dump
> [ 5478.134071] BTRFS critical (device dm-0): corrupt leaf: root=2161
> block=5796594384896 slot=84 ino=2434728, invalid inode generation: has
> 72057594122450740 expect (0, 664473]
> [ 5478.134075] BTRFS info (device dm-0): leaf 5796594384896 gen 664472
> total ptrs 120 free space 1223 owner 2161
> [ 5478.134077]  item 0 key (2434713 24 3817753667) itemoff 16210
> itemsize 73
> [ 5478.134078]  item 1 key (2434713 108 0) itemoff 15359 itemsize 851
> [ 5478.134080]          inline extent data size 830
> [ 5478.134081]  item 2 key (2434714 1 0) itemoff 15199 itemsize 160
> [ 5478.134082]          inode generation 636724 size 758 mode 100644
> [ 5478.134083]  item 3 key (2434714 12 2348495) itemoff 15181 itemsize 18
>   ...
> [ 5478.134242]  item 117 key (2434733 108 0) itemoff 4398 itemsize 329
> [ 5478.134243]          inline extent data size 308
> [ 5478.134244]  item 118 key (2434734 1 0) itemoff 4238 itemsize 160
> [ 5478.134245]          inode generation 636724 size 30 mode 40755
> [ 5478.134245]  item 119 key (2434734 12 2434375) itemoff 4223 itemsize 15
> [ 5478.134247] BTRFS error (device dm-0): block=5796594384896 write time
> tree block corruption detected
> [ 5478.263726] BTRFS: error (device dm-0) in
> btrfs_commit_transaction:2511: errno=-5 IO failure (Error while writing
> out transaction)
> [ 5478.263733] BTRFS info (device dm-0 state E): forced readonly
> [ 5478.263736] BTRFS warning (device dm-0 state E): Skipping commit of
> aborted transaction.
> [ 5478.263737] BTRFS error (device dm-0 state EA): Transaction aborted
> (error -5)
> [ 5478.263739] BTRFS: error (device dm-0 state EA) in
> cleanup_transaction:2005: errno=-5 IO failure
> [ 5478.264582] BTRFS warning (device dm-0 state EA): Skipping commit of
> aborted transaction.
> [ 5478.264595] BTRFS: error (device dm-0 state EA) in
> cleanup_transaction:2005: errno=-5 IO failure

#regzbot ^introduced: 6296562f30b1
#regzbot summary: hid: amd_sfh: memory/page corruption correlated with
6296562f30b1 or 2105e8e00da4
#regzbot ignore-activity