On Thu, Oct 15, 2026 at 06:51:07AM -0700, Matthew Brost wrote: > On Tue, Oct 06, 2026 at 10:57:40AM -0700, FNU VISHWANATHA wrote: > > From: Kornel Dulęba <[email protected]> > > > > A kernel panic caused by a list corruption was observed when the IPU6 > > driver is running under heavy load. The panic would reproduce > > consistently within a few minutes of the test suite running, though > > never during the same test. The corruption would always happen in > > list_add_tail called from xe_bo_pin_external: > > > > list_add corruption. prev->next should be next (ffff8bb9862912c8), but was > > ffff8bb9e811e2a8. (prev=ffff8bb9e811e2a8) > > > > Having prev->next == prev, suggests that node was re-initialized without > > being removed from the list first. This indicates that the BO might have > > been destroyed while it was still pinned. > > This is a bug if true. > > > Looking into xe_ttm_bo_destroy and its caller ttm_bo_release, reveals > > that the latter supports a case where bo->pin_count > 0, albeit with a > > WARN_ON_ONCE. Since ttm_bo_release sets bo->pin_count to 0 in that case, > > add a complementary change to also remove bo->pinned_link from the list. > > With this applied, the test progresses much further, with the newly > > added warning seen in dmesg. > > > > Test: atest CtsCameraTestCases > > > > I don't doubt the test case but this an investigation for a proper fix. > > > Signed-off-by: Kornel Dulęba <[email protected]> > > --- > > drivers/gpu/drm/xe/xe_bo.c | 5 +++++ > > 1 file changed, 5 insertions(+) > > > > diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c > > index f2634d048cd4..c5989db950f7 100644 > > --- a/drivers/gpu/drm/xe/xe_bo.c > > +++ b/drivers/gpu/drm/xe/xe_bo.c > > @@ -1688,6 +1688,11 @@ static void xe_ttm_bo_destroy(struct > > ttm_buffer_object *ttm_bo) > > if (bo->parent_obj) > > xe_bo_put(bo->parent_obj); > > > > + spin_lock(&xe->pinned.lock); > > + if (WARN_ON_ONCE(!list_empty(&bo->pinned_link))) > > + list_del_init(&bo->pinned_link); > > + spin_unlock(&xe->pinned.lock); > > + > > It shouldn't be possible to get here with a BO on the pinned list, so > this is papering over a bug some where else in the driver. > > I'd prefer 'xe_assert(xe, !list_empty(&bo->pinned_link));' be added to
Inverted the logic... s/!list_empty(&bo->pinned_link)/list_empty(&bo->pinned_link)/g Matt > the code to assert this and if this pops, we case down the root cause. > > Can you please file a gitlab issue with the details of this failure so > we assist debugging and get a proper fix? > > Matt > > > mutex_lock(&xe->mem_access.vram_userfault.lock); > > if (!list_empty(&bo->vram_userfault_link)) > > list_del(&bo->vram_userfault_link); > > -- > > 2.34.1 > >
