On Tue, Oct 06, 2026 at 10:57:41AM -0700, FNU VISHWANATHA wrote:
> From: Kornel Dulęba <[email protected]>
>
> When running CtsCameraTestCases on a memory constrained, 4GB device the
> following list corruption oops was consistently observed:
>
> list_del corruption. prev->next should be ffff9ebe1ce42ea8, but was
> ffff9ebdf741fea8. (prev=ffff9ebe1ce43aa8)
>
> After adding printfs in multiple places it was concluded that
> bo->pinned_link was already a part of a list when xe_bo_pin_external
> tried adding it to xe->pinned.late.external.
> To fix this add a list_empty check and a WARN_ONCE in case the list is
> in fact not empty.
> With this addition the CtsCameraTestCases can now complete with no
> kernel crashes.
>
> Test: atest CtsCameraTestCases
> Signed-off-by: Kornel Dulęba <[email protected]>
> ---
> drivers/gpu/drm/xe/xe_bo.c | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index c5989db950f7..cc5a4ff64791 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
> @@ -2762,7 +2762,14 @@ int xe_bo_pin_external(struct xe_bo *bo, bool
> in_place, struct drm_exec *exec)
> }
>
> spin_lock(&xe->pinned.lock);
> - list_add_tail(&bo->pinned_link, &xe->pinned.late.external);
Like in first patch - I'd rather have a 'xe_assert(xe,
list_empty(&bo->pinned_link)' here as any other state is a bug.
Again if it pops, we then case down why this occuring rather than
papering over.
Again file gitlab with details so we can assist.
Matt
> + if (list_empty(&bo->pinned_link)) {
> + list_add_tail(&bo->pinned_link,
> + &xe->pinned.late.external);
> + } else {
> + WARN_ONCE(true,
> + "pinned_link already added to a list,
> bo->ttm.pin_count: %d\n",
> + bo->ttm.pin_count);
> + }
> spin_unlock(&xe->pinned.lock);
> }
>
> --
> 2.34.1
>
