Skip to content
Snippets Groups Projects

intermittent crash in ttm_bo_put ttm_bo_delayed_delete, black screens after logging in, possible kref reference counting error

    • Open Issue created by Chris Bainbridge @chrisb

    Brief summary of the problem:

    Laptop is Lenovo Legion 7 16ACHg6 with hybrid graphics (nouveau) connected to a Dell WD19 dock and multiple monitors. On around 15% of boots - at GDM login screen the laptop and external monitors are on and showing an image, then immediately after logging in, the laptop screen and external monitors go black, and the kernel log has some kind of oops or lock error from ttm_bo_put / ttm_bo_delayed_delete.

    [  404.943404] ------------[ cut here ]------------
[  404.943411] DEBUG_LOCKS_WARN_ON(mutex_is_locked(lock))
[  404.943417] WARNING: CPU: 12 PID: 3882 at kernel/locking/mutex-debug.c:114 mutex_destroy+0x57/0x60
[  404.943428] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat nf_tables br_netfilter bridge stp llc ccm overlay qrtr rfcomm cmac algif_hash algif_skcipher af_alg bnep binfmt_misc snd_hda_codec_realtek intel_rapl_msr snd_hda_codec_generic intel_rapl_common snd_hda_scodec_component iwlmvm snd_hda_codec_hdmi uvcvideo btusb kvm_amd snd_usb_audio snd_hda_intel btrtl videobuf2_vmalloc snd_intel_dspcfg mac80211 snd_usbmidi_lib btintel videobuf2_memops kvm snd_hda_codec snd_ump btbcm libarc4 uvc snd_hwdep snd_rawmidi rapl btmtk videobuf2_v4l2 ee1004 snd_hda_core snd_seq_device wmi_bmof videodev snd_pcm pcspkr bluetooth iwlwifi videobuf2_common k10temp snd_timer sp5100_tco ucsi_acpi snd typec_ucsi cfg80211 soundcore ccp mc typec joydev input_leds serio_raw mac_hid sch_fq_codel msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables
[  404.943537]  autofs4 btrfs blake2b_generic xor raid6_pq dm_crypt hid_microsoft ff_memless usbmouse hid_cmedia r8153_ecm cdc_ether usbnet usbkbd r8152 mii usbhid amdgpu drm_panel_backlight_quirks drm_suballoc_helper cec rc_core amdxcp drm_buddy nouveau mxm_wmi drm_gpuvm i2c_algo_bit drm_ttm_helper hid_multitouch ttm hid_generic drm_exec polyval_clmulni polyval_generic nvme ahci i2c_piix4 gpu_sched i2c_hid_acpi r8169 ghash_clmulni_intel nvme_core video libahci i2c_smbus drm_display_helper i2c_hid realtek nvme_auth wmi hid uas usb_storage aesni_intel crypto_simd cryptd
[  404.943595] CPU: 12 UID: 125 PID: 3882 Comm: gnome-shell Not tainted 6.13.0-09950-g60c828cf80c0 #185
[  404.943599] Hardware name: LENOVO 82N6/LNVNB161216, BIOS GKCN65WW 01/16/2024
[  404.943602] RIP: 0010:mutex_destroy+0x57/0x60
[  404.943608] Code: 84 c0 74 e1 e8 da 54 6f 00 85 c0 74 d8 8b 05 10 75 e7 01 85 c0 75 ce 48 c7 c6 77 de 99 a5 48 c7 c7 7a 29 99 a5 e8 89 7d f5 ff <0f> 0b eb b7 0f 1f 44 00 00 55 48 89 f2 48 c7 c1 aa de 99 a5 48 89
[  404.943611] RSP: 0018:ffffb55c8d383a78 EFLAGS: 00010246
[  404.943615] RAX: 0000000000000000 RBX: ffff903394a9c980 RCX: 0000000000000000
[  404.943618] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  404.943620] RBP: ffffb55c8d383a80 R08: 0000000000000000 R09: 0000000000000000
[  404.943622] R10: 0000000000000000 R11: 0000000000000000 R12: ffff903394a9c800
[  404.943624] R13: ffff9033a718ffd8 R14: ffff903394a9c848 R15: ffff903394a9c980
[  404.943626] FS:  00007e6a38510e80(0000) GS:ffff903992000000(0000) knlGS:0000000000000000
[  404.943629] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  404.943631] CR2: 00007e6a38140000 CR3: 000000010bf80000 CR4: 0000000000f50ef0
[  404.943634] PKRU: 55555554
[  404.943637] Call Trace:
[  404.943639]  <TASK>
[  404.943643]  ? show_regs.cold+0x19/0x24
[  404.943647]  ? mutex_destroy+0x57/0x60
[  404.943651]  ? __warn.cold+0xce/0x188
[  404.943656]  ? mutex_destroy+0x57/0x60
[  404.943660]  ? report_bug+0x110/0x160
[  404.943665]  ? handle_bug+0x6a/0xb0
[  404.943669]  ? exc_invalid_op+0x18/0x80
[  404.943673]  ? asm_exc_invalid_op+0x1b/0x20
[  404.943681]  ? mutex_destroy+0x57/0x60
[  404.943685]  ? mutex_destroy+0x57/0x60
[  404.943689]  dma_resv_fini+0x2b/0x40
[  404.943693]  drm_gem_object_release+0x31/0x60
[  404.943698]  amdgpu_bo_destroy+0x4a/0x70 [amdgpu]
[  404.943912]  amdgpu_bo_user_destroy+0x21/0x30 [amdgpu]
[  404.944029]  ttm_bo_release+0x69/0x320 [ttm]
[  404.944033]  ttm_bo_put+0x38/0x60 [ttm]
[  404.944035]  amdgpu_gem_object_free+0x1e/0x30 [amdgpu]
[  404.944124]  drm_gem_object_free+0x1a/0x30
[  404.944125]  drm_gem_dmabuf_release+0x45/0x70
[  404.944127]  dma_buf_release+0x3b/0xa0
[  404.944129]  __dentry_kill+0x95/0x1b0
[  404.944131]  ? dput.part.0+0x203/0x460
[  404.944132]  dput.part.0+0x23c/0x460
[  404.944134]  dput+0x13/0x20
[  404.944135]  __fput+0x157/0x2e0
[  404.944137]  ____fput+0x15/0x20
[  404.944139]  task_work_run+0x5d/0xb0
[  404.944141]  syscall_exit_to_user_mode+0x20a/0x210
[  404.944143]  do_syscall_64+0x93/0x140
[  404.944145]  ? ktime_get_mono_fast_ns+0x39/0xd0
[  404.944147]  ? __pm_runtime_suspend+0xf6/0x140
[  404.944149]  ? amdgpu_drm_ioctl+0x70/0x90 [amdgpu]
[  404.944235]  ? trace_hardirqs_off+0x59/0xe0
[  404.944238]  ? syscall_exit_to_user_mode+0xcc/0x210
[  404.944240]  ? do_syscall_64+0x93/0x140
[  404.944242]  ? ktime_get_mono_fast_ns+0x39/0xd0
[  404.944243]  ? __pm_runtime_suspend+0xf6/0x140
[  404.944245]  ? amdgpu_drm_ioctl+0x70/0x90 [amdgpu]
[  404.944331]  ? trace_hardirqs_off+0x59/0xe0
[  404.944333]  ? syscall_exit_to_user_mode+0xcc/0x210
[  404.944335]  ? do_syscall_64+0x93/0x140
[  404.944336]  ? trace_hardirqs_off+0x59/0xe0
[  404.944338]  ? syscall_exit_to_user_mode+0xcc/0x210
[  404.944340]  ? do_syscall_64+0x93/0x140
[  404.944342]  ? do_syscall_64+0x93/0x140
[  404.944343]  ? do_syscall_64+0x93/0x140
[  404.944345]  entry_SYSCALL_64_after_hwframe+0x4b/0x53
[  404.944347] RIP: 0033:0x7e6a4731637b
[  404.944349] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[  404.944350] RSP: 002b:00007ffdad9a5c40 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  404.944352] RAX: 0000000000000000 RBX: 000056850b5e61c0 RCX: 00007e6a4731637b
[  404.944353] RDX: 00007ffdad9a5cd0 RSI: 0000000040086409 RDI: 0000000000000012
[  404.944354] RBP: 00007ffdad9a5cd0 R08: 00000005685090dd R09: 0000000000000000
[  404.944355] R10: 0000000000000007 R11: 0000000000000246 R12: 0000000040086409
[  404.944356] R13: 0000000000000012 R14: 00005685091929cc R15: 0000568509676080
[  404.944358]  </TASK>
[  404.944359] irq event stamp: 21600713
[  404.944360] hardirqs last  enabled at (21600713): [<ffffffffa52d3b3d>] _raw_spin_unlock_irqrestore+0x4d/0x70
[  404.944362] hardirqs last disabled at (21600712): [<ffffffffa4544408>] kvfree_call_rcu+0x1a8/0x3d0
[  404.944365] softirqs last  enabled at (21600000): [<ffffffffa4211958>] __irq_exit_rcu+0xb8/0xf0
[  404.944366] softirqs last disabled at (21599681): [<ffffffffa4211958>] __irq_exit_rcu+0xb8/0xf0
[  404.944368] ---[ end trace 0000000000000000 ]---
    • CPU: Ryzen 7 5800H
    • GPU:
    • 01:00.0 VGA compatible controller [0300]: NVIDIA Corporation GA104M [GeForce RTX 3070 Mobile / Max-Q] [10de:24dd] (rev a1)
    • 05:00.0 VGA compatible controller [0300]: Advanced Micro Devices, Inc. [AMD/ATI] Cezanne [Radeon Vega Series / Radeon Vega Mobile Series] [1002:1638] (rev c5)
    • System Memory: 32GB
    • Display(s): laptop display and docked monitors
    • Type of Display Connection: eDP and USB-C DP

    System information:

    • Distro name and Version: Debian Trixie
    • Kernel version: 6.12.12 and 6.14.0-rc4

    How to reproduce the issue:

    Happens intermittently on around 15% of boots. At GDM login screen the laptop and external monitors are on and showing an image, then immediately after logging in, the laptop screen and external monitors go black, and the kernel log has some kind of oops from ttm_bo_delayed_delete.

    Edited

    Designs

    Child items 0

    • No child items are currently open.

    Activity

    • Chris Bainbridge changed the description

      changed the description

    • Chris Bainbridge
      Chris Bainbridge @chrisb ·
      Author

      It seems to happen intermittently on boot sometime around logging in to gdm3. Another (probably) related backtrace:

      [   42.223927] ------------[ cut here ]------------
[   42.223933] DEBUG_LOCKS_WARN_ON(lock->magic != lock)
[   42.223938] WARNING: CPU: 6 PID: 2935 at kernel/locking/mutex.c:564 __ww_mutex_lock.constprop.0+0xd94/0x1920
[   42.223945] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat nf_tables br_netfilter bridge stp llc ccm overlay qrtr rfcomm cmac algif_hash algif_skcipher af_alg bnep binfmt_misc snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg snd_usb_audio intel_rapl_msr uvcvideo btusb snd_usbmidi_lib iwlmvm snd_hda_codec intel_rapl_common btrtl videobuf2_vmalloc snd_ump snd_rawmidi videobuf2_memops snd_hwdep btintel kvm_amd mac80211 snd_hda_core snd_seq_device uvc snd_pcm videobuf2_v4l2 libarc4 btbcm kvm iwlwifi snd_timer btmtk ee1004 videodev ucsi_acpi videobuf2_common snd rapl pcspkr wmi_bmof typec_ucsi sp5100_tco cfg80211 k10temp mc bluetooth joydev ccp typec soundcore input_leds mac_hid serio_raw sch_fq_codel msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables
[   42.224017]  autofs4 btrfs blake2b_generic xor raid6_pq dm_crypt usbmouse hid_microsoft ff_memless hid_cmedia r8153_ecm cdc_ether usbnet amdgpu r8152 mii nouveau drm_panel_backlight_quirks mxm_wmi drm_suballoc_helper drm_gpuvm cec i2c_algo_bit hid_multitouch drm_ttm_helper rc_core ttm amdxcp usbkbd drm_buddy hid_generic drm_exec usbhid nvme polyval_clmulni gpu_sched i2c_hid_acpi uas ahci r8169 video nvme_core polyval_generic i2c_hid i2c_piix4 usb_storage drm_display_helper libahci ghash_clmulni_intel nvme_auth i2c_smbus realtek wmi hid aesni_intel crypto_simd cryptd
[   42.224054] CPU: 6 UID: 0 PID: 2935 Comm: kworker/u65:6 Not tainted 6.13.0-09950-g60c828cf80c0-dirty #191
[   42.224057] Hardware name: LENOVO 82N6/LNVNB161216, BIOS GKCN65WW 01/16/2024
[   42.224059] Workqueue: ttm ttm_bo_delayed_delete [ttm]
[   42.224067] RIP: 0010:__ww_mutex_lock.constprop.0+0xd94/0x1920
[   42.224070] Code: ff 85 c0 0f 84 39 f3 ff ff 8b 3d b7 9f e5 00 85 ff 0f 85 2b f3 ff ff 48 c7 c6 e8 dc d9 95 48 c7 c7 ba 29 d9 95 e8 2c a8 f3 fe <0f> 0b e9 11 f3 ff ff 45 31 c9 e9 31 f3 ff ff 48 8b 85 70 ff ff ff
[   42.224072] RSP: 0018:ffffbbccc95d3ce0 EFLAGS: 00010246
[   42.224074] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   42.224075] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   42.224077] RBP: ffffbbccc95d3db0 R08: 0000000000000000 R09: 0000000000000000
[   42.224078] R10: 0000000000000000 R11: 0000000000000000 R12: ffff990396d50d80
[   42.224079] R13: ffff99039f106e60 R14: ffff9903802fdec0 R15: ffff990396d50d80
[   42.224080] FS:  0000000000000000(0000) GS:ffff990991d00000(0000) knlGS:0000000000000000
[   42.224082] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   42.224083] CR2: 000071b56f3b1258 CR3: 0000000331e59000 CR4: 0000000000f50ef0
[   42.224085] PKRU: 55555554
[   42.224087] Call Trace:
[   42.224088]  <TASK>
[   42.224092]  ? show_regs.cold+0x19/0x24
[   42.224096]  ? __ww_mutex_lock.constprop.0+0xd94/0x1920
[   42.224098]  ? __warn.cold+0xce/0x188
[   42.224101]  ? __ww_mutex_lock.constprop.0+0xd94/0x1920
[   42.224103]  ? report_bug+0x110/0x160
[   42.224105]  ? __wake_up_klogd.part.0+0x40/0x70
[   42.224109]  ? handle_bug+0x6a/0xb0
[   42.224111]  ? exc_invalid_op+0x18/0x80
[   42.224113]  ? asm_exc_invalid_op+0x1b/0x20
[   42.224118]  ? __ww_mutex_lock.constprop.0+0xd94/0x1920
[   42.224120]  ? __schedule+0x5c3/0x1b30
[   42.224122]  ? ttm_bo_delayed_delete+0x3a/0xb0 [ttm]
[   42.224126]  ww_mutex_lock+0x3c/0xb0
[   42.224128]  ? ww_mutex_lock+0x3c/0xb0
[   42.224130]  ttm_bo_delayed_delete+0x3a/0xb0 [ttm]
[   42.224133]  process_one_work+0x217/0x5c0
[   42.224137]  worker_thread+0x1c8/0x3d0
[   42.224139]  ? apply_wqattrs_cleanup.part.0+0xc0/0xc0
[   42.224141]  kthread+0x10b/0x240
[   42.224143]  ? kthreads_online_cpu+0x140/0x140
[   42.224144]  ret_from_fork+0x40/0x70
[   42.224147]  ? kthreads_online_cpu+0x140/0x140
[   42.224149]  ret_from_fork_asm+0x11/0x20
[   42.224152]  </TASK>
[   42.224153] irq event stamp: 87
[   42.224154] hardirqs last  enabled at (87): [<ffffffff946582bd>] finish_task_switch.isra.0+0xbd/0x2d0
[   42.224157] hardirqs last disabled at (86): [<ffffffff956c7eb0>] __schedule+0xf30/0x1b30
[   42.224159] softirqs last  enabled at (0): [<ffffffff94603f5a>] copy_process+0xa8a/0x2ce0
[   42.224161] softirqs last disabled at (0): [<0000000000000000>] 0x0
[   42.224163] ---[ end trace 0000000000000000 ]---

      The backtrace looks like https://lore.kernel.org/lkml/20230307212223.7e49384a@gandalf.local.home/#t - from that email thread, it doesn't look like the root cause was found? @ckoenig

    • Alex Deucher added Cezanne / Barcelo label

      added Cezanne / Barcelo label

    • Alex Deucher added TTM label

      added TTM label

    • Chris Bainbridge
      Chris Bainbridge @chrisb ·
      Author

      It looks like a reference counting error on some struct ttm_buffer_object kref. I keep hitting this but it's intermittent. It happens on some percentage of boots - at GDM login screen the laptop and external monitors are on and showing an image, then immediately after logging in, the laptop screen and external monitors go black, and the kernel log has some kind of oops from ttm_bo_delayed_delete. I've also seen it on shutdown. It might be related to this laptop having hybrid graphics which uses nouveau for the external monitors.

      Adding a delay before the ttm_bo_put in ttm_bo_delayed_delete seems to increase the probability of hitting the issue:

      diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index ea5e49858857..90f6b68e8b05 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -47,6 +47,8 @@
 
 #include "ttm_module.h"
 
+#include <linux/delay.h>
+
 static void ttm_bo_mem_space_debug(struct ttm_buffer_object *bo,
                                        struct ttm_placement *placement)
 {
@@ -240,6 +242,8 @@ static void ttm_bo_delayed_delete(struct work_struct *work)
        dma_resv_lock(bo->base.resv, NULL);
        ttm_bo_cleanup_memtype_use(bo);
        dma_resv_unlock(bo->base.resv);
+       mdelay(500);
        ttm_bo_put(bo);
 }
      Mar 02 21:00:47 debian kernel: ------------[ cut here ]------------
Mar 02 21:00:47 debian kernel: DEBUG_LOCKS_WARN_ON(mutex_is_locked(lock))
Mar 02 21:00:47 debian kernel: WARNING: CPU: 15 PID: 2113 at kernel/locking/mutex-debug.c:117 mutex_destroy+0x57/0x60
Mar 02 21:00:47 debian kernel: Modules linked in: snd_seq_dummy snd_hrtimer snd_seq xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat nf_tables br_netfilter bridge stp llc overlay qrtr rfcomm cmac algif_hash algif_skcipher af_alg bnep binfmt_misc snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component intel_rapl_msr snd_hda_codec_hdmi intel_rapl_common snd_hda_intel uvcvideo videobuf2_vmalloc btusb snd_intel_dspcfg snd_usb_audio videobuf2_memops snd_usbmidi_lib btrtl uvc btintel kvm_amd snd_hda_codec snd_ump videobuf2_v4l2 btbcm btmtk videodev snd_hwdep snd_rawmidi kvm ee1004 bluetooth snd_seq_device videobuf2_common rapl snd_hda_core wmi_bmof pcspkr snd_pcm k10temp ucsi_acpi sp5100_tco snd_timer typec_ucsi snd mc ccp soundcore typec input_leds joydev mac_hid serio_raw sch_fq_codel msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 btrfs blake2b_generic xor raid6_pq
Mar 02 21:00:47 debian kernel:  dm_crypt hid_microsoft usbmouse ff_memless hid_cmedia r8153_ecm cdc_ether usbnet usbkbd r8152 mii usbhid amdgpu nouveau drm_panel_backlight_quirks drm_suballoc_helper mxm_wmi cec drm_gpuvm i2c_algo_bit rc_core drm_ttm_helper hid_multitouch ttm amdxcp nvme hid_generic drm_exec drm_buddy polyval_clmulni gpu_sched polyval_generic uas r8169 i2c_hid_acpi ahci video nvme_core drm_display_helper i2c_piix4 i2c_hid ghash_clmulni_intel realtek nvme_auth wmi usb_storage libahci i2c_smbus hid aesni_intel crypto_simd cryptd
Mar 02 21:00:47 debian kernel: CPU: 15 UID: 125 PID: 2113 Comm: gnome-shell Not tainted 6.14.0-rc4-00266-gdf87d843c6eb-dirty #208
Mar 02 21:00:47 debian kernel: Hardware name: LENOVO 82N6/LNVNB161216, BIOS GKCN65WW 01/16/2024
Mar 02 21:00:47 debian kernel: RIP: 0010:mutex_destroy+0x57/0x60 
Mar 02 21:00:47 debian kernel: Code: 84 c0 74 e1 e8 1a 69 6f 00 85 c0 74 d8 8b 05 d0 6a e7 01 85 c0 75 ce 48 c7 c6 1e f5 19 a5 48 c7 c7 33 40 19 a5 e8 a9 7c f5 ff <0f> 0b eb b7 0f 1f 44 00 00 55 48 89 f2 48 c7 c1 51 f5 19 a5 48 89
Mar 02 21:00:47 debian kernel: RSP: 0018:ffffb7fd43f17c08 EFLAGS: 00010246
Mar 02 21:00:47 debian kernel: RAX: 0000000000000000 RBX: ffff96c91888b580 RCX: 0000000000000000
Mar 02 21:00:47 debian kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
Mar 02 21:00:47 debian kernel: RBP: ffffb7fd43f17c10 R08: 0000000000000000 R09: 0000000000000000
Mar 02 21:00:47 debian kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff96c91888b400
Mar 02 21:00:47 debian kernel: R13: ffff96c921a0ffd8 R14: ffff96c91888b448 R15: ffff96c91888b580
Mar 02 21:00:47 debian kernel: FS:  0000741f2f221e00(0000) GS:ffff96cf12180000(0000) knlGS:0000000000000000
Mar 02 21:00:47 debian kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Mar 02 21:00:47 debian kernel: CR2: 00005f134a810188 CR3: 000000010dcdd000 CR4: 0000000000f50ef0
Mar 02 21:00:47 debian kernel: PKRU: 55555554
Mar 02 21:00:47 debian kernel: Call Trace: 
Mar 02 21:00:47 debian kernel:  <TASK> 
Mar 02 21:00:47 debian kernel:  ? show_regs.cold+0x19/0x24
Mar 02 21:00:47 debian kernel:  ? mutex_destroy+0x57/0x60 
Mar 02 21:00:47 debian kernel:  ? __warn.cold+0xce/0x188
Mar 02 21:00:47 debian kernel:  ? mutex_destroy+0x57/0x60 
Mar 02 21:00:47 debian kernel:  ? report_bug+0x110/0x160
Mar 02 21:00:47 debian kernel:  ? handle_bug+0x6a/0xb0
Mar 02 21:00:47 debian kernel:  ? exc_invalid_op+0x18/0x80 
Mar 02 21:00:47 debian kernel:  ? asm_exc_invalid_op+0x1b/0x20
Mar 02 21:00:47 debian kernel:  ? mutex_destroy+0x57/0x60 
Mar 02 21:00:47 debian kernel:  ? mutex_destroy+0x57/0x60
Mar 02 21:00:47 debian kernel:  dma_resv_fini+0x2b/0x40
Mar 02 21:00:47 debian kernel:  drm_gem_object_release+0x31/0x60
Mar 02 21:00:47 debian kernel:  amdgpu_bo_destroy+0x4a/0x70 [amdgpu]
Mar 02 21:00:47 debian kernel:  amdgpu_bo_user_destroy+0x21/0x30 [amdgpu]
Mar 02 21:00:47 debian kernel:  ttm_bo_release+0x69/0x320 [ttm]
Mar 02 21:00:47 debian kernel:  ttm_bo_put+0x38/0x60 [ttm]
Mar 02 21:00:47 debian kernel:  amdgpu_gem_object_free+0x1e/0x30 [amdgpu]
Mar 02 21:00:47 debian kernel:  drm_gem_object_free+0x1a/0x30
Mar 02 21:00:47 debian kernel:  drm_gem_dmabuf_release+0x45/0x70
Mar 02 21:00:47 debian kernel:  dma_buf_release+0x3b/0xa0
Mar 02 21:00:47 debian kernel:  __dentry_kill+0x95/0x1b0
Mar 02 21:00:47 debian kernel:  ? dput.part.0+0x203/0x460
Mar 02 21:00:47 debian kernel:  dput.part.0+0x23c/0x460
Mar 02 21:00:47 debian kernel:  dput+0x13/0x20
Mar 02 21:00:47 debian kernel:  __fput+0x157/0x2e0
Mar 02 21:00:47 debian kernel:  ____fput+0x15/0x20
Mar 02 21:00:47 debian kernel:  task_work_run+0x5d/0xb0
Mar 02 21:00:47 debian kernel:  syscall_exit_to_user_mode+0x20a/0x210
Mar 02 21:00:47 debian kernel:  do_syscall_64+0x93/0x140
Mar 02 21:00:47 debian kernel:  ? lock_release+0xd6/0x2d0
Mar 02 21:00:47 debian kernel:  ? do_user_addr_fault+0x636/0x8f0
Mar 02 21:00:47 debian kernel:  ? irqentry_exit_to_user_mode+0xc2/0x210
Mar 02 21:00:47 debian kernel:  ? irqentry_exit+0x6f/0xa0
Mar 02 21:00:47 debian kernel:  ? exc_page_fault+0xae/0x2f0
Mar 02 21:00:47 debian kernel:  entry_SYSCALL_64_after_hwframe+0x4b/0x53
Mar 02 21:00:47 debian kernel: RIP: 0033:0x741f33b1637b 
Mar 02 21:00:47 debian kernel: Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
Mar 02 21:00:47 debian kernel: RSP: 002b:00007ffd801b5db0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 
Mar 02 21:00:47 debian kernel: RAX: 0000000000000000 RBX: 00005f134d2de600 RCX: 0000741f33b1637b
Mar 02 21:00:47 debian kernel: RDX: 00007ffd801b5e40 RSI: 0000000040086409 RDI: 0000000000000012
Mar 02 21:00:47 debian kernel: RBP: 00007ffd801b5e40 R08: 00000005f134e318 R09: 0000000000000000
Mar 02 21:00:47 debian kernel: R10: 0000000000000007 R11: 0000000000000246 R12: 0000000040086409
Mar 02 21:00:47 debian kernel: R13: 0000000000000012 R14: 00005f134a82cf6c R15: 00007ffd801b61f0
Mar 02 21:00:47 debian kernel:  </TASK>
Mar 02 21:00:47 debian kernel: irq event stamp: 2395173
Mar 02 21:00:47 debian kernel: hardirqs last  enabled at (2395173): [<ffffffffa4adcb5d>] _raw_spin_unlock_irqrestore+0x4d/0x70
Mar 02 21:00:47 debian kernel: hardirqs last disabled at (2395172): [<ffffffffa3d47008>] kvfree_call_rcu+0x1a8/0x3d0
Mar 02 21:00:47 debian kernel: softirqs last  enabled at (2389282): [<ffffffffa3a139d8>] __irq_exit_rcu+0xb8/0xf0
Mar 02 21:00:47 debian kernel: softirqs last disabled at (2389277): [<ffffffffa3a139d8>] __irq_exit_rcu+0xb8/0xf0
Mar 02 21:00:47 debian kernel: ---[ end trace 0000000000000000 ]---
Mar 02 21:00:49 debian kernel: Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b7b: 0000 [#1] PREEMPT SMP
Mar 02 21:00:49 debian kernel: CPU: 15 UID: 0 PID: 2539 Comm: kworker/u65:10 Tainted: G        W          6.14.0-rc4-00266-gdf87d843c6eb-dirty #208
Mar 02 21:00:49 debian kernel: Tainted: [W]=WARN
Mar 02 21:00:49 debian kernel: Hardware name: LENOVO 82N6/LNVNB161216, BIOS GKCN65WW 01/16/2024
Mar 02 21:00:49 debian kernel: Workqueue: ttm ttm_bo_delayed_delete [ttm]
Mar 02 21:00:49 debian kernel: RIP: 0010:dma_resv_iter_first_unlocked+0x55/0x290
Mar 02 21:00:49 debian kernel: Code: 31 f6 48 c7 c7 00 2b 5a a5 e8 97 b6 52 ff e8 a2 ba 53 00 5a 85 c0 74 48 e9 88 01 00 00 4c 89 63 20 4d 85 e4 0f 84 30 01 00 00 <41> 8b 44 24 10 c6 43 2c 01 48 89 df 89 43 28 e8 97 fd ff ff 4c 8b
Mar 02 21:00:49 debian kernel: RSP: 0018:ffffb7fd49ef3d60 EFLAGS: 00010202
Mar 02 21:00:49 debian kernel: RAX: 0000000000000000 RBX: ffffb7fd49ef3d88 RCX: 0000000000000000
Mar 02 21:00:49 debian kernel: RDX: ffffffffa458d525 RSI: 0000000000000000 RDI: 0000000000000000
Mar 02 21:00:49 debian kernel: RBP: ffffb7fd49ef3d78 R08: 0000000000000000 R09: 0000000000000000
Mar 02 21:00:49 debian kernel: R10: 0000000000000000 R11: 0000000000000000 R12: 6b6b6b6b6b6b6b6b
Mar 02 21:00:49 debian kernel: R13: ffff96c92d0d1d80 R14: ffff96c9178b44c0 R15: 00000000000383cc
Mar 02 21:00:49 debian kernel: FS:  0000000000000000(0000) GS:ffff96cf12180000(0000) knlGS:0000000000000000
Mar 02 21:00:49 debian kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Mar 02 21:00:49 debian kernel: CR2: 0000757fa4045474 CR3: 00000001e0459000 CR4: 0000000000f50ef0
Mar 02 21:00:49 debian kernel: PKRU: 55555554
Mar 02 21:00:49 debian kernel: Call Trace:
Mar 02 21:00:49 debian kernel:  <TASK>
Mar 02 21:00:49 debian kernel:  ? __die_body.cold+0x19/0x26
Mar 02 21:00:49 debian kernel:  ? die_addr+0x3d/0x70
Mar 02 21:00:49 debian kernel:  ? exc_general_protection+0x159/0x460
Mar 02 21:00:49 debian kernel:  ? asm_exc_general_protection+0x27/0x30
Mar 02 21:00:49 debian kernel:  ? dma_resv_iter_first_unlocked+0x25/0x290
Mar 02 21:00:49 debian kernel:  ? dma_resv_iter_first_unlocked+0x55/0x290
Mar 02 21:00:49 debian kernel:  dma_resv_wait_timeout+0x56/0x100
Mar 02 21:00:49 debian kernel:  ttm_bo_delayed_delete+0x2c/0xd0 [ttm]
Mar 02 21:00:49 debian kernel:  process_one_work+0x217/0x5c0
Mar 02 21:00:49 debian kernel:  worker_thread+0x1c8/0x3d0
Mar 02 21:00:49 debian kernel:  ? apply_wqattrs_cleanup.part.0+0xc0/0xc0
Mar 02 21:00:49 debian kernel:  kthread+0x10b/0x240
Mar 02 21:00:49 debian kernel:  ? kthreads_online_cpu+0x140/0x140
Mar 02 21:00:49 debian kernel:  ret_from_fork+0x40/0x70
Mar 02 21:00:49 debian kernel:  ? kthreads_online_cpu+0x140/0x140
Mar 02 21:00:49 debian kernel:  ret_from_fork_asm+0x11/0x20
Mar 02 21:00:49 debian kernel:  </TASK>
Mar 02 21:00:49 debian kernel: Modules linked in: snd_seq_dummy snd_hrtimer snd_seq xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat nf_tables br_netfilter bridge stp llc overlay qrtr rfcomm cmac algif_hash algif_skcipher af_alg bnep binfmt_misc snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component intel_rapl_msr snd_hda_codec_hdmi intel_rapl_common snd_hda_intel uvcvideo videobuf2_vmalloc btusb snd_intel_dspcfg snd_usb_audio videobuf2_memops snd_usbmidi_lib btrtl uvc btintel kvm_amd snd_hda_codec snd_ump videobuf2_v4l2 btbcm btmtk videodev snd_hwdep snd_rawmidi kvm ee1004 bluetooth snd_seq_device videobuf2_common rapl snd_hda_core wmi_bmof pcspkr snd_pcm k10temp ucsi_acpi sp5100_tco snd_timer typec_ucsi snd mc ccp soundcore typec input_leds joydev mac_hid serio_raw sch_fq_codel msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 btrfs blake2b_generic xor raid6_pq
Mar 02 21:00:49 debian kernel:  dm_crypt hid_microsoft usbmouse ff_memless hid_cmedia r8153_ecm cdc_ether usbnet usbkbd r8152 mii usbhid amdgpu nouveau drm_panel_backlight_quirks drm_suballoc_helper mxm_wmi cec drm_gpuvm i2c_algo_bit rc_core drm_ttm_helper hid_multitouch ttm amdxcp nvme hid_generic drm_exec drm_buddy polyval_clmulni gpu_sched polyval_generic uas r8169 i2c_hid_acpi ahci video nvme_core drm_display_helper i2c_piix4 i2c_hid ghash_clmulni_intel realtek nvme_auth wmi usb_storage libahci i2c_smbus hid aesni_intel crypto_simd cryptd
Mar 02 21:00:49 debian kernel: ---[ end trace 0000000000000000 ]---
Mar 02 21:00:49 debian kernel: Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b7b: 0000 [#2] PREEMPT SMP
Mar 02 21:00:49 debian kernel: CPU: 11 UID: 0 PID: 2533 Comm: kworker/u65:4 Tainted: G      D W          6.14.0-rc4-00266-gdf87d843c6eb-dirty #208
Mar 02 21:00:49 debian kernel: Tainted: [D]=DIE, [W]=WARN
Mar 02 21:00:49 debian kernel: Hardware name: LENOVO 82N6/LNVNB161216, BIOS GKCN65WW 01/16/2024
Mar 02 21:00:49 debian kernel: Workqueue: ttm ttm_bo_delayed_delete [ttm]
Mar 02 21:00:49 debian kernel: RIP: 0010:dma_resv_iter_first_unlocked+0x55/0x290
Mar 02 21:00:49 debian kernel: Code: 31 f6 48 c7 c7 00 2b 5a a5 e8 97 b6 52 ff e8 a2 ba 53 00 5a 85 c0 74 48 e9 88 01 00 00 4c 89 63 20 4d 85 e4 0f 84 30 01 00 00 <41> 8b 44 24 10 c6 43 2c 01 48 89 df 89 43 28 e8 97 fd ff ff 4c 8b
Mar 02 21:00:49 debian kernel: RSP: 0018:ffffb7fd49d3fd60 EFLAGS: 00010202
Mar 02 21:00:49 debian kernel: RAX: 0000000000000000 RBX: ffffb7fd49d3fd88 RCX: 0000000000000000
Mar 02 21:00:49 debian kernel: RDX: ffffffffa458d525 RSI: 0000000000000000 RDI: 0000000000000000
Mar 02 21:00:49 debian kernel: RBP: ffffb7fd49d3fd78 R08: 0000000000000000 R09: 0000000000000000
Mar 02 21:00:49 debian kernel: R10: 0000000000000000 R11: 0000000000000000 R12: 6b6b6b6b6b6b6b6b
Mar 02 21:00:49 debian kernel: R13: ffff96c9159c8580 R14: ffff96c9178b5b40 R15: 00000000000383cc
Mar 02 21:00:49 debian kernel: FS:  0000000000000000(0000) GS:ffff96cf11f80000(0000) knlGS:0000000000000000
Mar 02 21:00:49 debian kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Mar 02 21:00:49 debian kernel: CR2: 00007d60b0c3e350 CR3: 000000011e1a3000 CR4: 0000000000f50ef0
Mar 02 21:00:49 debian kernel: PKRU: 55555554
Mar 02 21:00:49 debian kernel: Call Trace:
Mar 02 21:00:49 debian kernel:  <TASK>
Mar 02 21:00:49 debian kernel:  ? __die_body.cold+0x19/0x26
Mar 02 21:00:49 debian kernel:  ? die_addr+0x3d/0x70
Mar 02 21:00:49 debian kernel:  ? exc_general_protection+0x159/0x460
Mar 02 21:00:49 debian kernel:  ? asm_exc_general_protection+0x27/0x30
Mar 02 21:00:49 debian kernel:  ? dma_resv_iter_first_unlocked+0x25/0x290
Mar 02 21:00:49 debian kernel:  ? dma_resv_iter_first_unlocked+0x55/0x290
Mar 02 21:00:49 debian kernel:  dma_resv_wait_timeout+0x56/0x100
Mar 02 21:00:49 debian kernel:  ttm_bo_delayed_delete+0x2c/0xd0 [ttm]
Mar 02 21:00:49 debian kernel:  process_one_work+0x217/0x5c0
Mar 02 21:00:49 debian kernel:  ? process_one_work+0x241/0x5c0
Mar 02 21:00:49 debian kernel:  worker_thread+0x1c8/0x3d0
Mar 02 21:00:49 debian kernel:  ? apply_wqattrs_cleanup.part.0+0xc0/0xc0
Mar 02 21:00:49 debian kernel:  kthread+0x10b/0x240
Mar 02 21:00:49 debian kernel:  ? kthreads_online_cpu+0x140/0x140
Mar 02 21:00:49 debian kernel:  ret_from_fork+0x40/0x70
Mar 02 21:00:49 debian kernel:  ? kthreads_online_cpu+0x140/0x140
Mar 02 21:00:49 debian kernel:  ret_from_fork_asm+0x11/0x20
Mar 02 21:00:49 debian kernel:  </TASK>
Mar 02 21:00:49 debian kernel: Modules linked in: snd_seq_dummy snd_hrtimer snd_seq xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat nf_tables br_netfilter bridge stp llc overlay qrtr rfcomm cmac algif_hash algif_skcipher af_alg bnep binfmt_misc snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component intel_rapl_msr snd_hda_codec_hdmi intel_rapl_common snd_hda_intel uvcvideo videobuf2_vmalloc btusb snd_intel_dspcfg snd_usb_audio videobuf2_memops snd_usbmidi_lib btrtl uvc btintel kvm_amd snd_hda_codec snd_ump videobuf2_v4l2 btbcm btmtk videodev snd_hwdep snd_rawmidi kvm ee1004 bluetooth snd_seq_device videobuf2_common rapl snd_hda_core wmi_bmof pcspkr snd_pcm k10temp ucsi_acpi sp5100_tco snd_timer typec_ucsi snd mc ccp soundcore typec input_leds joydev mac_hid serio_raw sch_fq_codel msr parport_pc ppdev lp parport nvme_fabrics efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 btrfs blake2b_generic xor raid6_pq
Mar 02 21:00:49 debian kernel:  dm_crypt hid_microsoft usbmouse ff_memless hid_cmedia r8153_ecm cdc_ether usbnet usbkbd r8152 mii usbhid amdgpu nouveau drm_panel_backlight_quirks drm_suballoc_helper mxm_wmi cec drm_gpuvm i2c_algo_bit rc_core drm_ttm_helper hid_multitouch ttm amdxcp nvme hid_generic drm_exec drm_buddy polyval_clmulni gpu_sched polyval_generic uas r8169 i2c_hid_acpi ahci video nvme_core drm_display_helper i2c_piix4 i2c_hid ghash_clmulni_intel realtek nvme_auth wmi usb_storage libahci i2c_smbus hid aesni_intel crypto_simd cryptd
Mar 02 21:00:49 debian kernel: ---[ end trace 0000000000000000 ]---
Mar 02 21:00:49 debian kernel: RIP: 0010:dma_resv_iter_first_unlocked+0x55/0x290
Mar 02 21:00:49 debian kernel: Code: 31 f6 48 c7 c7 00 2b 5a a5 e8 97 b6 52 ff e8 a2 ba 53 00 5a 85 c0 74 48 e9 88 01 00 00 4c 89 63 20 4d 85 e4 0f 84 30 01 00 00 <41> 8b 44 24 10 c6 43 2c 01 48 89 df 89 43 28 e8 97 fd ff ff 4c 8b
Mar 02 21:00:49 debian kernel: RSP: 0018:ffffb7fd49ef3d60 EFLAGS: 00010202
Mar 02 21:00:49 debian kernel: RAX: 0000000000000000 RBX: ffffb7fd49ef3d88 RCX: 0000000000000000
Mar 02 21:00:49 debian kernel: RDX: ffffffffa458d525 RSI: 0000000000000000 RDI: 0000000000000000
Mar 02 21:00:49 debian kernel: RBP: ffffb7fd49ef3d78 R08: 0000000000000000 R09: 0000000000000000
Mar 02 21:00:49 debian kernel: R10: 0000000000000000 R11: 0000000000000000 R12: 6b6b6b6b6b6b6b6b
Mar 02 21:00:49 debian kernel: R13: ffff96c92d0d1d80 R14: ffff96c9178b44c0 R15: 00000000000383cc
Mar 02 21:00:49 debian kernel: FS:  0000000000000000(0000) GS:ffff96cf12180000(0000) knlGS:0000000000000000
Mar 02 21:00:49 debian kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Mar 02 21:00:49 debian kernel: CR2: 0000757fa4045474 CR3: 0000000111964000 CR4: 0000000000f50ef0
Mar 02 21:00:49 debian kernel: PKRU: 55555554
Mar 02 21:00:49 debian kernel: BUG: sleeping function called from invalid context at ./include/linux/percpu-rwsem.h:49
Mar 02 21:00:49 debian kernel: in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 2539, name: kworker/u65:10
Mar 02 21:00:49 debian kernel: preempt_count: 0, expected: 0
Mar 02 21:00:49 debian kernel: RCU nest depth: 1, expected: 0
Mar 02 21:00:49 debian kernel: INFO: lockdep is turned off.
Mar 02 21:00:49 debian kernel: CPU: 15 UID: 0 PID: 2539 Comm: kworker/u65:10 Tainted: G      D W          6.14.0-rc4-00266-gdf87d843c6eb-dirty #208
Mar 02 21:00:49 debian kernel: Tainted: [D]=DIE, [W]=WARN
Mar 02 21:00:49 debian kernel: Hardware name: LENOVO 82N6/LNVNB161216, BIOS GKCN65WW 01/16/2024
Mar 02 21:00:49 debian kernel: Workqueue: ttm ttm_bo_delayed_delete [ttm]
Mar 02 21:00:49 debian kernel: Call Trace:
Mar 02 21:00:49 debian kernel:  <TASK>
Mar 02 21:00:49 debian kernel:  dump_stack_lvl+0x70/0xa0
Mar 02 21:00:49 debian kernel:  dump_stack+0x10/0x14
Mar 02 21:00:49 debian kernel:  __might_resched.cold+0x104/0x115
Mar 02 21:00:49 debian kernel:  __might_sleep+0x58/0x90
Mar 02 21:00:49 debian kernel:  exit_signals+0x20/0x390
Mar 02 21:00:49 debian kernel:  do_exit+0x14d/0xb30
Mar 02 21:00:49 debian kernel:  ? kthread+0x10b/0x240
Mar 02 21:00:49 debian kernel:  make_task_dead+0x93/0xa0
Mar 02 21:00:49 debian kernel:  rewind_stack_and_make_dead+0x16/0x20
Mar 02 21:00:49 debian kernel:  </TASK>
Mar 02 21:00:50 debian kernel: RIP: 0010:dma_resv_iter_first_unlocked+0x55/0x290
Mar 02 21:00:50 debian kernel: Code: 31 f6 48 c7 c7 00 2b 5a a5 e8 97 b6 52 ff e8 a2 ba 53 00 5a 85 c0 74 48 e9 88 01 00 00 4c 89 63 20 4d 85 e4 0f 84 30 01 00 00 <41> 8b 44 24 10 c6 43 2c 01 48 89 df 89 43 28 e8 97 fd ff ff 4c 8b
Mar 02 21:00:50 debian kernel: RSP: 0018:ffffb7fd49ef3d60 EFLAGS: 00010202
Mar 02 21:00:50 debian kernel: RAX: 0000000000000000 RBX: ffffb7fd49ef3d88 RCX: 0000000000000000
Mar 02 21:00:50 debian kernel: RDX: ffffffffa458d525 RSI: 0000000000000000 RDI: 0000000000000000
Mar 02 21:00:50 debian kernel: RBP: ffffb7fd49ef3d78 R08: 0000000000000000 R09: 0000000000000000
Mar 02 21:00:50 debian kernel: R10: 0000000000000000 R11: 0000000000000000 R12: 6b6b6b6b6b6b6b6b
Mar 02 21:00:50 debian kernel: R13: ffff96c92d0d1d80 R14: ffff96c9178b44c0 R15: 00000000000383cc
Mar 02 21:00:50 debian kernel: FS:  0000000000000000(0000) GS:ffff96cf11f80000(0000) knlGS:0000000000000000
Mar 02 21:00:50 debian kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Mar 02 21:00:50 debian kernel: CR2: 00007d60b0c3e350 CR3: 000000011e1a3000 CR4: 0000000000f50ef0
Mar 02 21:00:50 debian kernel: PKRU: 55555554
Mar 02 21:00:50 debian kernel: BUG: sleeping function called from invalid context at ./include/linux/percpu-rwsem.h:49
Mar 02 21:00:50 debian kernel: in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 2533, name: kworker/u65:4
Mar 02 21:00:50 debian kernel: preempt_count: 0, expected: 0
Mar 02 21:00:50 debian kernel: RCU nest depth: 1, expected: 0
Mar 02 21:00:50 debian kernel: INFO: lockdep is turned off.
Mar 02 21:00:50 debian kernel: CPU: 11 UID: 0 PID: 2533 Comm: kworker/u65:4 Tainted: G      D W          6.14.0-rc4-00266-gdf87d843c6eb-dirty #208
Mar 02 21:00:50 debian kernel: Tainted: [D]=DIE, [W]=WARN
Mar 02 21:00:50 debian kernel: Hardware name: LENOVO 82N6/LNVNB161216, BIOS GKCN65WW 01/16/2024
Mar 02 21:00:50 debian kernel: Workqueue: ttm ttm_bo_delayed_delete [ttm]
Mar 02 21:00:50 debian kernel: Call Trace:
Mar 02 21:00:50 debian kernel:  <TASK>
Mar 02 21:00:50 debian kernel:  dump_stack_lvl+0x70/0xa0
Mar 02 21:00:50 debian kernel:  dump_stack+0x10/0x14
Mar 02 21:00:50 debian kernel:  __might_resched.cold+0x104/0x115
Mar 02 21:00:50 debian kernel:  __might_sleep+0x58/0x90
Mar 02 21:00:50 debian kernel:  exit_signals+0x20/0x390
Mar 02 21:00:50 debian kernel:  do_exit+0x14d/0xb30
Mar 02 21:00:50 debian kernel:  ? kthread+0x10b/0x240
Mar 02 21:00:50 debian kernel:  make_task_dead+0x93/0xa0
Mar 02 21:00:50 debian kernel:  rewind_stack_and_make_dead+0x16/0x20
Mar 02 21:00:50 debian kernel:  </TASK>
Mar 02 21:00:53 debian kernel: workqueue: pm_runtime_work hogged CPU for >10000us 5 times, consider switching to WQ_UNBOUND
Mar 02 21:00:56 debian kernel: workqueue: nouveau_display_hpd_work [nouveau] hogged CPU for >10000us 19 times, consider switching to WQ_UNBOUND
    • Chris Bainbridge changed title from DEBUG_LOCKS_WARN_ON(mutex_is_locked(lock)) kernel/locking/mutex-debug.c:114 mutex_destroy+0x57/0x60 to intermittent crash in ttm_bo_delayed_delete, black screens after logging in, possible kref reference counting error

      changed title from DEBUG_LOCKS_WARN_ON(mutex_is_locked(lock)) kernel/locking/mutex-debug.c:114 mutex_destroy+0x57/0x60 to intermittent crash in ttm_bo_delayed_delete, black screens after logging in, possible kref reference counting error

    • Chris Bainbridge changed title from intermittent crash in ttm_bo_delayed_delete, black screens after logging in, possible kref reference counting error to intermittent crash in ttm_bo_put ttm_bo_delayed_delete, black screens after logging in, possible kref reference counting error

      changed title from intermittent crash in ttm_bo_delayed_delete, black screens after logging in, possible kref reference counting error to intermittent crash in ttm_bo_put ttm_bo_delayed_delete, black screens after logging in, possible kref reference counting error

    • Chris Bainbridge changed the description

      changed the description

    • Christian König closed

      closed

    • Christian König
      Christian König @ckoenig ·
      Owner

      That's a well known false positive from lockdep. Lockdep thinks that because of some other mutex of the same class is locked that the one used by the destroyed object is locked as well.

      There has been some work on fixing this, but I'm not sure if and when that has landed.

    • Chris Bainbridge
      Chris Bainbridge @chrisb ·
      Author

      Oops: general protection fault

      This isn't a false positive. The laptop screen and external monitors all go black and stay black. The login fails.

    • Chris Bainbridge reopened

      reopened

    • Chris Bainbridge
      Chris Bainbridge @chrisb ·
      Author

      Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b7b

      I suspect that what happens here is a reference counting error. In the destructor, a new kref is init so ref counts increased to 1, and ttm_bo_delayed_delete scheduled, but then an extra put is called somewhere, the object is deallocated, then later the scheduled ttm_bo_delayed_delete is called which references the deallocated object, resulting in the oops.

    • Christian König
      Christian König @ckoenig ·
      Owner

      Can you try this code snippet here:

      diff --git a/drivers/gpu/drm/drm_exec.c b/drivers/gpu/drm/drm_exec.c
index 18e366cc4993..b7a1852cf19d 100644
--- a/drivers/gpu/drm/drm_exec.c
+++ b/drivers/gpu/drm/drm_exec.c
@@ -58,6 +58,9 @@ static void drm_exec_unlock_all(struct drm_exec *exec)
 
        drm_exec_for_each_locked_object_reverse(exec, index, obj) {
                dma_resv_unlock(obj->resv);
+       }
+
+       drm_exec_for_each_locked_object_reverse(exec, index, obj) {
                drm_gem_object_put(obj);
        }

      It works around the false positive warning from lockdep and might result in printing the actual warning.

    • Chris Bainbridge
      Chris Bainbridge @chrisb ·
      Author

      I reproduced the issue with the patch, several stack traces, full dmesg attached.

      dmesg-6.14.0-rc4-drm_exec-patch.gz

    • Chris Bainbridge
      Chris Bainbridge @chrisb ·
      Author

      Here's another reproduction with the patch applied. It has a different stack trace.

      dmesg-6.14.0-rc4-drm_exec-patch-2.gz

    • Chris Bainbridge
      Chris Bainbridge @chrisb ·
      Author

      That second log has a lock warning with a stack that includes nouveau. I ran it through scripts/decode_stacktrace.sh:

      [   40.233273] DEBUG_LOCKS_WARN_ON(mutex_is_locked(lock))
...
[   40.233426] ? show_regs.cold (arch/x86/kernel/dumpstack.c:478 (discriminator 1) arch/x86/kernel/dumpstack.c:465 (discriminator 1)) 
[   40.233428] ? mutex_destroy (kernel/locking/mutex-debug.c:117 (discriminator 1)) 
[   40.233431] ? __warn.cold (kernel/panic.c:748) 
[   40.233433] ? mutex_destroy (kernel/locking/mutex-debug.c:117 (discriminator 1)) 
[   40.233436] ? report_bug (lib/bug.c:180 lib/bug.c:219) 
[   40.233439] ? handle_bug (arch/x86/kernel/traps.c:260) 
[   40.233442] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) 
[   40.233444] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:574) 
[   40.233449] ? mutex_destroy (kernel/locking/mutex-debug.c:117 (discriminator 1)) 
[   40.233452] ? mutex_destroy (kernel/locking/mutex-debug.c:117 (discriminator 1)) 
[   40.233454] dma_resv_fini (drivers/dma-buf/dma-resv.c:158) 
[   40.233457] drm_gem_object_release (drivers/gpu/drm/drm_gem.c:476 drivers/gpu/drm/drm_gem.c:983) 
[   40.233460] amdgpu_bo_destroy (drivers/gpu/drm/amd/amdgpu/amdgpu_object.c:68) amdgpu 
[   40.233652] amdgpu_bo_user_destroy (drivers/gpu/drm/amd/amdgpu/amdgpu_object.c:80) amdgpu 
[   40.233764] ttm_bo_release (drivers/gpu/drm/ttm/ttm_bo.c:333) ttm 
[   40.233768] ttm_bo_put (drivers/gpu/drm/ttm/ttm_bo.c:345) ttm 
[   40.233771] amdgpu_gem_object_free (drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c:94) amdgpu 
[   40.233883] drm_gem_object_free (drivers/gpu/drm/drm_gem.c:1006) 
[   40.233885] drm_gem_dmabuf_release (drivers/gpu/drm/drm_prime.c:277) 
[   40.233887] dma_buf_release (drivers/dma-buf/dma-buf.c:104) 
[   40.233889] __dentry_kill (fs/dcache.c:650) 
[   40.233892] ? dput.part.0 (fs/dcache.c:883) 
[   40.233894] dput.part.0 (fs/dcache.c:885) 
[   40.233896] dput (fs/dcache.c:896) 
[   40.233898] __fput (fs/file_table.c:473 (discriminator 1)) 
[   40.233900] ____fput (fs/file_table.c:493) 
[   40.233902] task_work_run (kernel/task_work.c:229) 
[   40.233904] syscall_exit_to_user_mode (./include/linux/resume_user_mode.h:50 kernel/entry/common.c:114 ./include/linux/entry-common.h:329 kernel/entry/common.c:207 kernel/entry/common.c:218) 
[   40.233906] do_syscall_64 (./arch/x86/include/asm/cpufeature.h:172 arch/x86/entry/common.c:98) 
[   40.233908] ? syscall_exit_to_user_mode (kernel/entry/common.c:221) 
[   40.233910] ? do_syscall_64 (./arch/x86/include/asm/cpufeature.h:172 arch/x86/entry/common.c:98) 
[   40.233912] ? __might_fault (mm/memory.c:6851 (discriminator 2)) 
[   40.233914] ? __might_fault (mm/memory.c:6851 (discriminator 5)) 
[   40.233916] ? __might_fault (mm/memory.c:6851 (discriminator 2)) 
[   40.233917] ? _copy_to_user (./arch/x86/include/asm/uaccess_64.h:103 ./arch/x86/include/asm/uaccess_64.h:98 ./include/linux/uaccess.h:195 lib/usercopy.c:26) 
[   40.233920] ? drm_ioctl (drivers/gpu/drm/drm_ioctl.c:894 (discriminator 1)) 
[   40.233922] ? drm_gem_handle_create (drivers/gpu/drm/drm_gem.c:829) 
[   40.233925] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:80) 
[   40.233927] ? read_hpet (./arch/x86/include/asm/paravirt.h:691 ./arch/x86/include/asm/irqflags.h:155 arch/x86/kernel/hpet.c:816) 
[   40.233929] ? ktime_get_mono_fast_ns (kernel/time/timekeeping.c:318 kernel/time/timekeeping.c:335 kernel/time/timekeeping.c:383 kernel/time/timekeeping.c:423) 
[   40.233931] ? __pm_runtime_suspend (./include/trace/events/rpm.h:77 (discriminator 2) drivers/base/power/runtime.c:1134 (discriminator 2)) 
[   40.233933] ? nouveau_drm_ioctl (drivers/gpu/drm/nouveau/nouveau_drm.c:1299) nouveau 
[   40.233978] ? trace_hardirqs_off (./include/trace/events/preemptirq.h:36 (discriminator 2) kernel/trace/trace_preemptirq.c:109 (discriminator 2)) 
[   40.233979] ? syscall_exit_to_user_mode (kernel/entry/common.c:221) 
[   40.233981] ? do_syscall_64 (./arch/x86/include/asm/cpufeature.h:172 arch/x86/entry/common.c:98) 
[   40.233984] ? find_held_lock (kernel/locking/lockdep.c:5341 (discriminator 1)) 
[   40.233985] ? do_user_addr_fault (./include/linux/rcupdate.h:347 (discriminator 1) ./include/linux/rcupdate.h:880 (discriminator 1) ./include/linux/mm.h:742 (discriminator 1) arch/x86/mm/fault.c:1339 (discriminator 1)) 
[   40.233988] ? lock_release (kernel/locking/lockdep.c:5527 kernel/locking/lockdep.c:5872) 
[   40.233990] ? do_user_addr_fault (arch/x86/mm/fault.c:1341) 
[   40.233992] ? irqentry_exit_to_user_mode (kernel/entry/common.c:234) 
[   40.233994] ? irqentry_exit (kernel/entry/common.c:367) 
[   40.233995] ? exc_page_fault (arch/x86/mm/fault.c:1542) 
[   40.233997] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

      This could be completely wrong, and/or another false positive, but it looks like nouveau_drm_ioctl is calling __pm_runtime_suspend which releases some object and calls dma_buf_release, which calls dma_resv_fini(dmabuf->resv) (dma-buf.c line 105), which ends up in amdgpu_bo_destroy then drm_gem_object_release then dma_resv_fini. So maybe this is some race condition with the re-entrant calls to dma_resv_fini? i.e. nouveau and amdgpu are simultaneously releasing the same object?

      • Christian König
        Christian König @ckoenig ·
        Owner
        Resolved by Christian König

        Yeah that indeed gave a bunch of new information. I agree that looks like somebody or something messed up the reference count and tries to free the BO twice.

        The interesting part is that here:

        [   40.233454]  dma_resv_fini+0x2b/0x40
[   40.233457]  drm_gem_object_release+0x31/0x60
[   40.233460]  amdgpu_bo_destroy+0x4a/0x70 [amdgpu]
[   40.233652]  amdgpu_bo_user_destroy+0x21/0x30 [amdgpu]
[   40.233764]  ttm_bo_release+0x69/0x320 [ttm]
[   40.233768]  ttm_bo_put+0x38/0x60 [ttm]
[   40.233771]  amdgpu_gem_object_free+0x1e/0x30 [amdgpu]
[   40.233883]  drm_gem_object_free+0x1a/0x30
[   40.233885]  drm_gem_dmabuf_release+0x45/0x70
[   40.233887]  dma_buf_release+0x3b/0xa0

        Can you try to keep nouveau out of the picture by blacklisting it? Just to narrow down the issue further.

    • Mario Limonciello added A+N label

      added A+N label

    Please register or sign in to reply