NetBSD Problem Report #52907

From www@NetBSD.org  Sun Jan  7 18:36:45 2018
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 44EA57A222
	for <gnats-bugs@gnats.NetBSD.org>; Sun,  7 Jan 2018 18:36:45 +0000 (UTC)
Message-Id: <20180107183641.CA84C7A21A@mollari.NetBSD.org>
Date: Sun,  7 Jan 2018 18:36:41 +0000 (UTC)
From: coypu@sdf.org
Reply-To: coypu@sdf.org
To: gnats-bugs@NetBSD.org
Subject: Unconditional KASSERT in DRM TTM code
X-Send-Pr-Version: www-1.0

>Number:         52907
>Category:       kern
>Synopsis:       Unconditional KASSERT in DRM TTM code
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jan 07 18:40:00 +0000 2018
>Closed-Date:    Sun Apr 21 16:09:11 +0000 2019
>Last-Modified:  Sun Apr 21 16:09:11 +0000 2019
>Originator:     coypu
>Release:        NetBSD 8.99.9
>Organization:
>Environment:
NetBSD localhost 8.99.9 NetBSD 8.99.9 (GENERIC) #9: Sat Dec  9 18:35:18 IST 2017  fly@localhost:/home/fly/obj/sys/arch/amd64/compile/GENERIC amd64

>Description:



panic: kernel diagnostic assertion "!ISSET(ttm->page_flags, TTM_PAGE_FLAG_SWAPPED)" failed: file "/usr/src/sys/external/bsd/drm2/dist/drm/ttm/ttm_tt.c", line 418 

ttm_tt_unwire() at netbsd:ttm_tt_unwire+0xc5
ttm_bus_dma_populate() at netbsd:ttm_bus_dma_populate+0x14f
ttm_tt_bind() at netbsd:ttm_tt_bind+0x26
ttm_bo_handle_move_mem() at netbsd:ttm_bo_handle_move_mem+0x61a
ttm_bo_validate() at netbsd:ttm_bo_validate+0x238
ttm_bo_init() at netbsd:ttm_bo_init+0x213
nouveau_bo_new() at netbsd:nouveau_bo_new+0x200
nouveau_gem_new() at netbsd:nouveau_gem_new+0x53
nouveau_gem_ioctl_new() at netbsd:nouveau_gem_ioctl_new+0x9d
drm_ioctl() at netbsd:drm_ioctl+0x11e
sys_ioctl() at netbsd:sys_ioctl+0x101
syscall() at netbsd:syscall+0x1d8
--- syscall (number 54) ---



>How-To-Repeat:
This KASSERT is unconditional if bus_dmamap_load_pglist fails.


ttm_bus_dma_populate:

  /* Pretend it is now, for the sake of ttm_tt_wire.  */
  ttm_dma->ttm.page_flags |= TTM_PAGE_FLAG_SWAPPED;

  ret = -bus_dmamap_load_pglist(ttm_dma->ttm.bdev->dmat,
  if (ret)
         goto fail1;

fail1:  KASSERT(ttm_dma->ttm.state == tt_unbound);
        ttm_tt_unwire(&ttm_dma->ttm);


ttm_tt_unwire:

  KASSERT(!ISSET(ttm->page_flags, TTM_PAGE_FLAG_SWAPPED));

- Maybe we should try some fault injection code for error branches.
>Fix:
No idea yet.

>Release-Note:

>Audit-Trail:

State-Changed-From-To: open->closed
State-Changed-By: maya@NetBSD.org
State-Changed-When: Sun, 21 Apr 2019 16:09:11 +0000
State-Changed-Why:
Fixed by chuq in http://mail-index.netbsd.org/source-changes/2019/04/21/msg105307.html


>Unformatted:

Home	PR Database Search