[Nouveau] nouveau: refcount_t splat on 4.15-rc1 on nv50

Adam Borowski kilobyte at angband.pl
Sat Dec 2 18:03:16 UTC 2017


Hi guys!
I'm getting the following warn on 4.15-rc1, on GTX 560 Ti:

[    9.430433] nouveau 0000:01:00.0: NVIDIA GF114 (0ce000a1)
...
[    9.585172] nouveau 0000:01:00.0: bios: version 70.24.2e.00.02
...
[    9.772204] nouveau 0000:01:00.0: fb: 1024 MiB GDDR5
[    9.777342] ------------[ cut here ]------------
[    9.782106] refcount_t: increment on 0; use-after-free.
[    9.787522] WARNING: CPU: 0 PID: 3 at lib/refcount.c:153 refcount_inc+0x30/0x50
[    9.795060] Modules linked in: sha256_generic cfg80211(+) rfkill snd_usb_audio snd_usbmidi_lib nouveau(+) video ttm
[    9.805756] CPU: 0 PID: 3 Comm: kworker/0:0 Not tainted 4.15.0-rc1-debug-ubsan-00020-gf4707a916107 #1
[    9.815215] Hardware name: System manufacturer System Product Name/M4A77T, BIOS 2401    05/18/2011
[    9.824420] Workqueue: events work_for_cpu_fn
[    9.828915] task: ffff880226110c80 task.stack: ffffc90000c80000
[    9.830647] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[    9.841681] RIP: 0010:refcount_inc+0x30/0x50
[    9.846093] RSP: 0018:ffffc90000c83808 EFLAGS: 00010296
[    9.851458] RAX: 000000000000002b RBX: 0000000000000000 RCX: 0000000000000000
[    9.858763] RDX: 0000000000000001 RSI: 0000000000000082 RDI: ffffffff8378eb8c
[    9.866051] RBP: ffff88021f103fd0 R08: 0000000000000199 R09: ffff8800000bd500
[    9.873330] R10: 0000000000000000 R11: ffffffff82289a80 R12: 0000000000000000
[    9.880621] R13: ffff8802103a69e0 R14: ffff88021f103fe0 R15: ffff88021f103fe0
[    9.887909] FS:  0000000000000000(0000) GS:ffff88022fc00000(0000) knlGS:0000000000000000
[    9.896230] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    9.902117] CR2: 0000560476ba0000 CR3: 0000000225232000 CR4: 00000000000006f0
[    9.909417] Call Trace:
[    9.912106]  nv50_instobj_acquire+0x123/0x1c0 [nouveau]
[    9.917565]  ? nvbios_rd08+0x1b/0x70 [nouveau]
[    9.922239]  nvkm_instobj_new+0x1e3/0x520 [nouveau]
[    9.927353]  ? nvbios_rd08+0x1b/0x70 [nouveau]
[    9.932017]  ? nvbios_pll_parse+0x8d7/0xcf0 [nouveau]
[    9.937218]  ? kmem_cache_alloc+0x1f0/0x2d0
[    9.941624]  nvkm_memory_new+0x4b/0xc0 [nouveau]
[    9.946461]  ? nvkm_longopt+0x17/0x60 [nouveau]
[    9.951208]  gf100_fb_oneinit+0x7b/0x1c0 [nouveau]
[    9.956218]  nvkm_fb_oneinit+0x89/0x2e0 [nouveau]
[    9.961144]  nvkm_subdev_init+0x92/0x600 [nouveau]
[    9.966085]  ? ktime_get+0x64/0x110
[    9.969815]  nvkm_device_init+0x169/0x2a0 [nouveau]
[    9.974922]  nvkm_udevice_init+0x7e/0xf0 [nouveau]
[    9.979924]  nvkm_object_init+0x6a/0x2e0 [nouveau]
[    9.984932]  nvkm_ioctl_new+0x198/0x430 [nouveau]
[    9.989846]  ? nvif_vmm_init+0x340/0x340 [nouveau]
[    9.994864]  ? nvkm_udevice_rd08+0x90/0x90 [nouveau]
[   10.000056]  nvkm_ioctl+0x21e/0x5a0 [nouveau]
[   10.004548]  ? yield_to+0x2b2/0x370
[   10.008257]  nvif_object_init+0xef/0x1b0 [nouveau]
[   10.013281]  nvif_device_init+0x9/0x40 [nouveau]
[   10.018136]  nouveau_cli_init+0x234/0x12f0 [nouveau]
[   10.023253]  ? idr_alloc_cyclic+0x6c/0x110
[   10.027487]  ? _cond_resched+0x1d/0x80
[   10.031366]  ? kmem_cache_alloc+0x1f0/0x2d0
[   10.035790]  nouveau_drm_load+0x71/0xec0 [nouveau]
[   10.040735]  drm_dev_register+0x1b4/0x330
[   10.044872]  ? pci_enable_device_flags+0x155/0x200
[   10.049806]  drm_get_pci_dev+0xde/0x2c0
[   10.053874]  nouveau_drm_probe+0x1b9/0x240 [nouveau]
[   10.058986]  ? __pm_runtime_resume+0x68/0xb0
[   10.063409]  local_pci_probe+0x5e/0xf0
[   10.067300]  work_for_cpu_fn+0x10/0x30
[   10.071183]  process_one_work+0x21a/0x670
[   10.075325]  worker_thread+0x256/0x500
[   10.079208]  ? manage_workers+0x1e0/0x1e0
[   10.083362]  kthread+0x169/0x220
[   10.086730]  ? kthread_create_worker_on_cpu+0x40/0x40
[   10.091933]  ret_from_fork+0x1f/0x30
[   10.095655] Code: ff 84 c0 74 02 5b c3 0f b6 1d 59 b2 a6 01 80 fb 01 77 1c 83 e3 01 75 ed 48 c7 c7 c8 f1 3f 82 c6 05 41 b2 a6 01 01 e8 50 02 8d ff <0f> ff 5b c3 0f b6 f3 48 c7 c7 00 16 c7 82 e8 dd 81 0d 00 eb d3 
[   10.114909] ---[ end trace 08f29138ff4259e6 ]---
[   10.119703] hpet1: lost 21 rtc interrupts
[   10.125534] ------------[ cut here ]------------
[   10.130326] refcount_t: underflow; use-after-free.
[   10.135292] WARNING: CPU: 0 PID: 3 at lib/refcount.c:281 refcount_dec_not_one+0x68/0x90
[   10.143540] Modules linked in: sha256_generic cfg80211 rfkill snd_usb_audio snd_usbmidi_lib nouveau(+) video ttm
[   10.153956] CPU: 0 PID: 3 Comm: kworker/0:0 Tainted: G        W        4.15.0-rc1-debug-ubsan-00020-gf4707a916107 #1
[   10.164719] Hardware name: System manufacturer System Product Name/M4A77T, BIOS 2401    05/18/2011
[   10.173929] Workqueue: events work_for_cpu_fn
[   10.178423] task: ffff880226110c80 task.stack: ffffc90000c80000
[   10.184488] RIP: 0010:refcount_dec_not_one+0x68/0x90
[   10.189580] RSP: 0018:ffffc90000c837f0 EFLAGS: 00010286
[   10.194946] RAX: 0000000000000026 RBX: 0000000000000000 RCX: 0000000000000000
[   10.202232] RDX: 0000000000000001 RSI: 0000000000000092 RDI: ffffffff8378eb8c
[   10.209512] RBP: ffff8802103a69e0 R08: 0000000000000199 R09: ffff8800000b9040
[   10.216801] R10: 0000000000000000 R11: ffffffff82289a80 R12: ffff8802103a69e0
[   10.224090] R13: ffffffffa025dc20 R14: ffff88021f103f80 R15: ffffffffa0368e60
[   10.231362] FS:  0000000000000000(0000) GS:ffff88022fc00000(0000) knlGS:0000000000000000
[   10.239679] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   10.245569] CR2: 0000560476ba0000 CR3: 0000000225232000 CR4: 00000000000006f0
[   10.252862] Call Trace:
[   10.255433]  refcount_dec_and_mutex_lock+0x18/0x70
[   10.260450]  nv50_instobj_release+0x69/0x1a0 [nouveau]
[   10.265834]  nvkm_instobj_new+0x219/0x520 [nouveau]
[   10.270935]  ? nvbios_rd08+0x1b/0x70 [nouveau]
[   10.275598]  ? nvbios_pll_parse+0x8d7/0xcf0 [nouveau]
[   10.280807]  ? kmem_cache_alloc+0x1f0/0x2d0
[   10.285205]  nvkm_memory_new+0x4b/0xc0 [nouveau]
[   10.290042]  ? nvkm_longopt+0x17/0x60 [nouveau]
[   10.294808]  gf100_fb_oneinit+0x7b/0x1c0 [nouveau]
[   10.299818]  nvkm_fb_oneinit+0x89/0x2e0 [nouveau]
[   10.304733]  nvkm_subdev_init+0x92/0x600 [nouveau]
[   10.309667]  ? ktime_get+0x64/0x110
[   10.313394]  nvkm_device_init+0x169/0x2a0 [nouveau]
[   10.318512]  nvkm_udevice_init+0x7e/0xf0 [nouveau]
[   10.323524]  nvkm_object_init+0x6a/0x2e0 [nouveau]
[   10.328539]  nvkm_ioctl_new+0x198/0x430 [nouveau]
[   10.333464]  ? nvif_vmm_init+0x340/0x340 [nouveau]
[   10.338506]  ? nvkm_udevice_rd08+0x90/0x90 [nouveau]
[   10.343691]  nvkm_ioctl+0x21e/0x5a0 [nouveau]
[   10.348190]  ? yield_to+0x2b2/0x370
[   10.351891]  nvif_object_init+0xef/0x1b0 [nouveau]
[   10.356914]  nvif_device_init+0x9/0x40 [nouveau]
[   10.361761]  nouveau_cli_init+0x234/0x12f0 [nouveau]
[   10.366876]  ? idr_alloc_cyclic+0x6c/0x110
[   10.371120]  ? _cond_resched+0x1d/0x80
[   10.375000]  ? kmem_cache_alloc+0x1f0/0x2d0
[   10.379405]  nouveau_drm_load+0x71/0xec0 [nouveau]
[   10.384340]  drm_dev_register+0x1b4/0x330
[   10.388488]  ? pci_enable_device_flags+0x155/0x200
[   10.393411]  drm_get_pci_dev+0xde/0x2c0
[   10.397482]  nouveau_drm_probe+0x1b9/0x240 [nouveau]
[   10.402583]  ? __pm_runtime_resume+0x68/0xb0
[   10.407001]  local_pci_probe+0x5e/0xf0
[   10.410890]  work_for_cpu_fn+0x10/0x30
[   10.414780]  process_one_work+0x21a/0x670
[   10.418925]  worker_thread+0x256/0x500
[   10.422816]  ? manage_workers+0x1e0/0x1e0
[   10.426967]  kthread+0x169/0x220
[   10.430328]  ? kthread_create_worker_on_cpu+0x40/0x40
[   10.435524]  ret_from_fork+0x1f/0x30
[   10.439246] Code: da eb ea 31 c0 eb eb 0f b6 1d ce b0 a6 01 80 fb 01 77 2c 83 e3 01 75 d5 48 c7 c7 f8 f1 3f 82 c6 05 b6 b0 a6 01 01 e8 c8 00 8d ff <0f> ff eb be 31 f6 48 c7 c7 a0 14 c7 82 e8 a6 7d 0d 00 eb 91 0f 
[   10.458480] ---[ end trace 08f29138ff4259e7 ]---

Appears to be benign: no obvious breakage afterwards.

I did not yet bisect -- would you want me to?


Meow!
-- 
< darkling> When all you have is a hammock, every problem looks like a nap.


More information about the Nouveau mailing list