[BISECTED] vc4: f309946 crashes the kernel if vc4 can't allocate buffers

[Noralf Trønnes]

The following commit crashes the kernel if vc4 can't allocate buffers:

drm/vc4: Add an ioctl for labeling GEM BOs for summary stats

It boots fine if I give it enough memory: cma=128M
I'm doing this on a Pi1 with bcm2835_defconfig.

Uncompressing Linux... done, booting the kernel.
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] random: get_random_bytes called from 
start_kernel+0x30/0x3c8 with crng_init=0
[    0.000000] Linux version 4.13.0-rc2+ (pi at agl) (gcc version 4.9.3 
(crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1 Mon Jul 31 15:27:34 
CEST 2017
[    0.000000] CPU: ARMv6-compatible processor [410fb767] revision 7 
(ARMv7), cr=00c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT nonaliasing 
instruction cache
[    0.000000] OF: fdt: Machine model: Raspberry Pi Model B Plus Rev 1.2
[    0.000000] Memory policy: Data cache writeback
[    0.000000] cma: Reserved 12 MiB at 0x1b000000
[    0.000000] CPU: All CPU(s) started in SVC mode.
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  
Total pages: 113792
[    0.000000] Kernel command line: earlyprintk console=ttyAMA0 
bcm2708_fb.fbwidth=656 bcm2708_fb.fbheight=416 bcm2708_fb.fbswap=1 
dma.dmachans=0x7f35 bcm2708.boardrev=0x10 bcm2708.serial=0xa1725dd1 
bcm2708.uart_clock=48000000 bcm2708.disk_led_gpio=47 
bcm2708.disk_led_active_low=0 smsc95xx.macaddr=B8:27:EB:72:5D:D1 
vc_mem.mem_base=0x1ec00000 vc_mem.mem_size=0x20000000  drm.debug=0x0 
cma=12M dwc_otg.lpm_enable=0 console=tty1 console=ttyAMA0,115200 
root=/dev/mmcblk0p2 rootfstype=ext4 elevator=deadline fsck.repair=yes 
rootwait
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 
bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 
bytes)
[    0.000000] Memory: 429820K/458752K available (7168K kernel code, 
527K rwdata, 2204K rodata, 1024K init, 684K bss, 16644K reserved, 12288K 
cma-reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xdc800000 - 0xff800000   ( 560 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xdc000000   ( 448 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .text : 0xc0008000 - 0xc0800000   (8160 kB)
[    0.000000]       .init : 0xc0b00000 - 0xc0c00000   (1024 kB)
[    0.000000]       .data : 0xc0c00000 - 0xc0c83fe0   ( 528 kB)
[    0.000000]        .bss : 0xc0c8a3e8 - 0xc0d357dc   ( 685 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] ftrace: allocating 24917 entries in 74 pages
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000030] sched_clock: 32 bits at 1000kHz, resolution 1000ns, wraps 
every 2147483647500ns
[    0.000071] clocksource: timer: mask: 0xffffffff max_cycles: 
0xffffffff, max_idle_ns: 1911260446275 ns
[    0.000155] bcm2835: system timer (irq = 27)
[    0.000747] Console: colour dummy device 80x30
[    0.001727] console [tty1] enabled
[    0.001783] Calibrating delay loop... 697.95 BogoMIPS (lpj=3489792)
[    0.060348] pid_max: default: 32768 minimum: 301
[    0.060766] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.060840] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 
bytes)
[    0.061831] CPU: Testing write buffer coherency: ok
[    0.062919] Setting up static identity map for 0x100000 - 0x100054
[    0.067672] devtmpfs: initialized
[    0.076233] VFP support v0.3: implementor 41 architecture 1 part 20 
variant b rev 5
[    0.076759] clocksource: jiffies: mask: 0xffffffff max_cycles: 
0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.076866] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.078775] pinctrl core: initialized pinctrl subsystem
[    0.079456] NET: Registered protocol family 16
[    0.082097] DMA: preallocated 256 KiB pool for atomic coherent 
allocations
[    0.087731] No ATAGs?
[    0.087768] hw-breakpoint: found 6 breakpoint and 1 watchpoint registers.
[    0.087882] hw-breakpoint: maximum watchpoint size is 4 bytes.
[    0.088208] Serial: AMBA PL011 UART driver
[    0.110991] SCSI subsystem initialized
[    0.111548] usbcore: registered new interface driver usbfs
[    0.111731] usbcore: registered new interface driver hub
[    0.111937] usbcore: registered new device driver usb
[    0.112719] Advanced Linux Sound Architecture Driver Initialized.
[    0.115728] clocksource: Switched to clocksource timer
[    0.198960] simple-framebuffer 1eb75000.framebuffer: framebuffer at 
0x1eb75000, 0x85400 bytes, mapped to 0xdc900000
[    0.199092] simple-framebuffer 1eb75000.framebuffer: format=r5g6b5, 
mode=656x416x16, linelength=1312
[    0.205329] Console: switching to colour frame buffer device 82x26
[    0.214619] simple-framebuffer 1eb75000.framebuffer: fb0: simplefb 
registered!
[    0.238520] NET: Registered protocol family 2
[    0.243688] TCP established hash table entries: 4096 (order: 2, 16384 
bytes)
[    0.248000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.252123] TCP: Hash tables configured (established 4096 bind 4096)
[    0.256292] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.260255] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.264409] NET: Registered protocol family 1
[    0.269006] RPC: Registered named UNIX socket transport module.
[    0.272953] RPC: Registered udp transport module.
[    0.276797] RPC: Registered tcp transport module.
[    0.280456] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.286535] hw perfevents: no irqs for PMU, sampling events not supported
[    0.290396] hw perfevents: enabled with armv6_1176 PMU driver, 3 
counters available
[    0.300290] workingset: timestamp_bits=30 max_order=17 bucket_order=0
[    0.321011] Installing knfsd (copyright (C) 1996 okir at monad.swb.de).
[    0.327344] random: fast init done
[    0.336751] jitterentropy: Initialization failed with host not 
compliant with requirements: 2
[    0.345425] Block layer SCSI generic (bsg) driver version 0.4 loaded 
(major 252)
[    0.353707] io scheduler noop registered
[    0.357782] io scheduler deadline registered (default)
[    0.362278] io scheduler cfq registered
[    0.366233] io scheduler mq-deadline registered
[    0.369987] io scheduler kyber registered
[    0.390927] libphy: Fixed MDIO Bus: probed
[    0.394985] usbcore: registered new interface driver zd1211rw
[    0.398932] usbcore: registered new interface driver asix
[    0.402534] usbcore: registered new interface driver ax88179_178a
[    0.406173] usbcore: registered new interface driver cdc_ether
[    0.409642] usbcore: registered new interface driver smsc95xx
[    0.412929] usbcore: registered new interface driver net1080
[    0.416258] usbcore: registered new interface driver cdc_subset
[    0.419432] usbcore: registered new interface driver zaurus
[    0.422636] usbcore: registered new interface driver cdc_ncm
[    0.426486] usbcore: registered new interface driver usb-storage
[    0.429829] i2c /dev entries driver
[    0.434689] i2c-bcm2835 20805000.i2c: Could not read clock-frequency 
property
[    0.439744] bcm2835-wdt 20100000.watchdog: Broadcom BCM2835 watchdog 
timer
[    0.443158] sdhci: Secure Digital Host Controller Interface driver
[    0.446127] sdhci: Copyright(c) Pierre Ossman
[    0.585809] sdhost-bcm2835 20202000.mmc: loaded - DMA enabled (>1)
[    0.588920] sdhci-pltfm: SDHCI platform and OF driver helper
[    0.592740] ledtrig-cpu: registered to indicate activity on CPUs
[    0.596283] usbcore: registered new interface driver usbhid
[    0.598962] usbhid: USB HID core driver
[    0.601800] bcm2835-mbox 2000b880.mailbox: mailbox enabled
[    0.606425] oprofile: using arm/armv6
[    0.610839] NET: Registered protocol family 10
[    0.615539] Segment Routing with IPv6
[    0.618726] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[    0.622916] NET: Registered protocol family 17
[    0.632768] 20201000.serial: ttyAMA0 at MMIO 0x20201000 (irq = 81, 
base_baud = 0) is a PL011 rev2
[    0.981828] mmc0: host does not support reading read-only switch, 
assuming write-enable
[    0.998918] mmc0: new high speed SDHC card at address aaaa
[    1.009065] mmcblk0: mmc0:aaaa SL08G 7.40 GiB
[    1.367365] console [ttyAMA0] enabled
[    1.377254] raspberrypi-firmware soc:firmware: Attached to firmware 
from 2017-07-11 12:29
[    1.396463] vc4_hdmi 20902000.hdmi: vc4-hdmi-hifi <-> 20902000.hdmi 
mapping ok
[    1.408899] vc4-drm soc:gpu: bound 20902000.hdmi (ops vc4_hdmi_ops)
[    1.419296] vc4-drm soc:gpu: bound 20806000.vec (ops vc4_vec_ops)
[    1.429360] vc4-drm soc:gpu: bound 20400000.hvs (ops vc4_hvs_ops)
[    1.439607] vc4-drm soc:gpu: bound 20206000.pixelvalve (ops vc4_crtc_ops)
[    1.450578] vc4-drm soc:gpu: bound 20207000.pixelvalve (ops vc4_crtc_ops)
[    1.461398] vc4-drm soc:gpu: bound 20807000.pixelvalve (ops vc4_crtc_ops)
[    1.471899] vc4-drm soc:gpu: failed to allocate buffer with size 16777216
[    1.482322] vc4-drm soc:gpu: failed to allocate buffer with size 16777216
[    1.492558] [drm:vc4_bo_create] *ERROR* Failed to allocate from CMA:
[    1.502334] vc4_v3d 20c00000.v3d: Failed to allocate memory for tile 
binning: -12. You may need to enable CMA or give it more memory.
[    1.521188] vc4-drm soc:gpu: failed to bind 20c00000.v3d (ops 
vc4_v3d_ops): -12
[    1.533757]  mmcblk0: p1 p2
[    1.542525] vc4-drm soc:gpu: master bind failed: -12
[    1.551298] vc4_v3d: probe of 20c00000.v3d failed with error -12
[    1.640411] dwc2 20980000.usb: DWC OTG Controller
[    1.648902] dwc2 20980000.usb: new USB bus registered, assigned bus 
number 1
[    1.659736] dwc2 20980000.usb: irq 33, io mem 0x20980000
[    1.670235] hub 1-0:1.0: USB hub found
[    1.677751] hub 1-0:1.0: 1 port detected
[    1.686403] ALSA device list:
[    1.692716]   No soundcards found.
[    1.699817] uart-pl011 20201000.serial: no DMA platform data
[    1.708935] Unable to handle kernel paging request at virtual address 
f000012f
[    1.719468] pgd = c0004000
[    1.725294] [f000012f] *pgd=00000000
[    1.731939] Internal error: Oops: 5 [#1] ARM
[    1.739299] Modules linked in:
[    1.745466] CPU: 0 PID: 1 Comm: swapper Not tainted 4.13.0-rc2+ #1
[    1.754879] Hardware name: BCM2835
[    1.761559] task: da8e4000 task.stack: da8e2000
[    1.769499] PC is at kmem_cache_alloc+0x8c/0x164
[    1.777498] LR is at kmem_cache_alloc+0x3c/0x164
[    1.785497] pc : [<c021cd78>]    lr : [<c021cd28>]    psr: a0000013
[    1.795160] sp : da8e3ec0  ip : 00000410  fp : da8e3eec
[    1.803712] r10: 00000000  r9 : c097088b  r8 : c0c8a400
[    1.812169] r7 : c013b700  r6 : 014000c0  r5 : da801d80  r4 : f000012f
[    1.821890] r3 : 00000000  r2 : 00000000  r1 : 014000c0  r0 : 00000000
[    1.831539] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  
Segment none
[    1.841872] Control: 00c5387d  Table: 00004008  DAC: 00000051
[    1.850802] Process swapper (pid: 1, stack limit = 0xda8e2208)
[    1.859820] Stack: (0xda8e3ec0 to 0xda8e4000)
[    1.867346] 3ec0: c02423fc c02423fc 00000008 da8e4000 c0b55834 
c0b7b2d4 c0c8a400 c097088b
[    1.881962] 3ee0: da8e3f04 da8e3ef0 c013b700 c021ccf8 00000008 
00000000 da8e3f4c da8e3f08
[    1.897034] 3f00: c0223ea8 c013b6d8 00000000 00000008 ffffff9c 
c0b55834 00000002 daab4000
[    1.912531] 3f20: c0b55834 00000008 0000009a c0b55834 c0b7b2d4 
c0c8a400 c0c8a400 00000000
[    1.928152] 3f40: da8e3f5c da8e3f50 c0224050 c0223e80 da8e3f94 
da8e3f60 c0b00f40 c0224034
[    1.944130] 3f60: 00000007 00000007 00000000 c0b00654 00000000 
c0710a88 00000000 00000000
[    1.960471] 3f80: 00000000 00000000 da8e3fac da8e3f98 c0710aa0 
c0b00dd8 ffffffff 00000000
[    1.977050] 3fa0: 00000000 da8e3fb0 c0107ff8 c0710a94 00000000 
00000000 00000000 00000000
[    1.994074] 3fc0: 00000000 00000000 00000000 00000000 00000000 
00000000 00000000 00000000
[    2.011430] 3fe0: 00000000 00000000 00000000 00000000 00000013 
00000000 00000000 00000000
[    2.029137] [<c021cd78>] (kmem_cache_alloc) from [<c013b700>] 
(prepare_creds+0x34/0x98)
[    2.046974] [<c013b700>] (prepare_creds) from [<c0223ea8>] 
(SyS_faccessat+0x34/0x1b4)
[    2.064759] [<c0223ea8>] (SyS_faccessat) from [<c0224050>] 
(SyS_access+0x28/0x2c)
[    2.082397] [<c0224050>] (SyS_access) from [<c0b00f40>] 
(kernel_init_freeable+0x174/0x1d4)
[    2.100857] [<c0b00f40>] (kernel_init_freeable) from [<c0710aa0>] 
(kernel_init+0x18/0x11c)
[    2.119325] [<c0710aa0>] (kernel_init) from [<c0107ff8>] 
(ret_from_fork+0x14/0x3c)
[    2.137058] Code: e1a04000 e121f008 ea000014 e5953014 (e7941003)
[    2.148284] ---[ end trace ce8a0c43d048416d ]---
[    2.158146] Unable to handle kernel paging request at virtual address 
f000012f
[    2.170511] pgd = c0004000
[    2.178144] [f000012f] *pgd=00000000
[    2.186564] Internal error: Oops: 5 [#2] ARM
[    2.195585] Modules linked in:
[    2.203269] CPU: 0 PID: 47 Comm: kworker/0:2 Tainted: G D         
4.13.0-rc2+ #1
[    2.220215] Hardware name: BCM2835
[    2.228093] Workqueue: events_power_efficient hub_init_func2
[    2.238221] task: daa60f00 task.stack: daa92000
[    2.247117] PC is at __kmalloc+0xc4/0x198
[    2.255387] LR is at __kmalloc+0x74/0x198
[    2.263480] pc : [<c021d034>]    lr : [<c021cfe4>]    psr: a0000113
[    2.273831] sp : daa93dc0  ip : 00000410  fp : daa93dec
[    2.283056] r10: daa93ed4  r9 : 000000a3  r8 : c049b9d4
[    2.292158] r7 : 01400000  r6 : 0000007c  r5 : da801d80  r4 : f000012f
[    2.302516] r3 : 00000000  r2 : 00000000  r1 : 01400000  r0 : 00000000
[    2.312774] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  
Segment none
[    2.323636] Control: 00c5387d  Table: 00004008  DAC: 00000051
[    2.333040] Process kworker/0:2 (pid: 47, stack limit = 0xdaa92208)
[    2.342930] Stack: (0xdaa93dc0 to 0xdaa94000)
[    2.350821] 3dc0: c0144c64 c021d148 daab3180 00000004 80000180 
daac4000 00000000 000000a3
[    2.365957] 3de0: daa93e04 daa93df0 c049b9d4 c021cf7c 00000001 
daab3180 daa93e34 daa93e08
[    2.381216] 3e00: c049c89c c049b9c0 daa93e54 c0713158 ffffff92 
daac7800 00000000 00000005
[    2.396595] 3e20: daac7818 00000004 daa93e94 daa93e38 c049177c 
c049c834 00000000 00000001
[    2.412338] 3e40: daac6b40 00000004 000003e8 c0145a40 00000001 
daac4000 00000001 00000004
[    2.428427] 3e60: 00000000 daac6b40 c0145a40 daac7800 00000001 
daac4000 00000001 00000000
[    2.444731] 3e80: 00000000 00000000 daa93eac daa93e98 c0491878 
c04916c0 daa93ed6 00000000
[    2.461332] 3ea0: daa93f04 daa93eb0 c0494698 c0491854 ffffffff 
c0711468 daa60f00 da8e4000
[    2.478342] 3ec0: d3053b52 c0c03048 daa93eec daac7a00 c0c0c0a0 
00000000 c0c23538 daa7cc00
[    2.495674] 3ee0: daac78cc 00000000 dbc5a600 c0c0b468 00000000 
daa7cc00 daa93f14 daa93f08
[    2.513372] 3f00: c0494a80 c0494470 daa93f4c daa93f18 c0133c48 
c0494a6c c0c0b47c daa7cc18
[    2.531398] 3f20: 00000008 c0c0b468 c0c0b468 c0c13700 c0c0b47c 
daa7cc18 00000008 daa7cc00
[    2.549551] 3f40: daa93f7c daa93f50 c0134a80 c0133a58 00000000 
daa7bfc0 daa7bdc0 00000000
[    2.567876] 3f60: daa7cc00 c01347c8 da8f1eac daa7bfd8 daa93fac 
daa93f80 c0139654 c01347d4
[    2.586215] 3f80: ffffffff daa7bdc0 c0139518 00000000 00000000 
00000000 00000000 00000000
[    2.604560] 3fa0: 00000000 daa93fb0 c0107ff8 c0139524 00000000 
00000000 00000000 00000000
[    2.622904] 3fc0: 00000000 00000000 00000000 00000000 00000000 
00000000 00000000 00000000
[    2.641249] 3fe0: 00000000 00000000 00000000 00000000 00000013 
00000000 00000000 00000000
[    2.659620] [<c021d034>] (__kmalloc) from [<c049b9d4>] 
(usb_alloc_urb+0x20/0x34)
[    2.677204] [<c049b9d4>] (usb_alloc_urb) from [<c049c89c>] 
(usb_control_msg+0x74/0xdc)
[    2.695295] [<c049c89c>] (usb_control_msg) from [<c049177c>] 
(hub_ext_port_status+0xc8/0x194)
[    2.714024] [<c049177c>] (hub_ext_port_status) from [<c0491878>] 
(hub_port_status+0x30/0x38)
[    2.732660] [<c0491878>] (hub_port_status) from [<c0494698>] 
(hub_activate+0x234/0x598)
[    2.750864] [<c0494698>] (hub_activate) from [<c0494a80>] 
(hub_init_func2+0x20/0x24)
[    2.768800] [<c0494a80>] (hub_init_func2) from [<c0133c48>] 
(process_one_work+0x1fc/0x374)
[    2.787276] [<c0133c48>] (process_one_work) from [<c0134a80>] 
(worker_thread+0x2b8/0x404)
[    2.805674] [<c0134a80>] (worker_thread) from [<c0139654>] 
(kthread+0x13c/0x158)
[    2.823268] [<c0139654>] (kthread) from [<c0107ff8>] 
(ret_from_fork+0x14/0x3c)
[    2.835701] Code: e1a04000 e121f009 ea000014 e5953014 (e7941003)
[    2.846941] ---[ end trace ce8a0c43d048416e ]---
[    2.856800] Kernel panic - not syncing: Attempted to kill init! 
exitcode=0x0000000b
[    2.856800]
[    2.880682] ---[ end Kernel panic - not syncing: Attempted to kill 
init! exitcode=0x0000000b
[    2.880682]