Critical Memory Management issues and System Freezing after update to Kernel 5.12.0

Looks like this problem to be related to i915

The issue was discussed on the OpenSUSE Bugzilla, and more information and Logs accessible at the below link

https://bugzilla.opensuse.org/show_bug.cgi?id=1185624

A few more details from the distro bugzilla report: the 5.12 kernel started showing the KFENCE error reports at first around i915_gem_madvise_ioctl(), followed by the actual NULL dereference and other crashes.

May 02 15:12:36 localhost.localdomain kernel: BUG: KFENCE: use-after-free write in i915_gem_madvise_ioctl+0x23a/0x2a0 [i915]
May 02 15:12:36 localhost.localdomain kernel: Use-after-free write at 0x0000000034c58beb (in kfence-#84):
May 02 15:12:36 localhost.localdomain kernel:  i915_gem_madvise_ioctl+0x23a/0x2a0 [i915]
May 02 15:12:36 localhost.localdomain kernel:  drm_ioctl_kernel+0xaa/0xf0 [drm]
May 02 15:12:36 localhost.localdomain kernel:  drm_ioctl+0x202/0x3b0 [drm]
May 02 15:12:36 localhost.localdomain kernel:  __x64_sys_ioctl+0x83/0xb0
May 02 15:12:36 localhost.localdomain kernel:  do_syscall_64+0x33/0x80
May 02 15:12:36 localhost.localdomain kernel:  entry_SYSCALL_64_after_hwframe+0x44/0xae

The same error and a similar crash are seen on the latest drm-tip (as of two days ago, commit 83c98bb), too, so it's still not fixed in the latest upstream code, as it seems.

The same system works fine on 5.11.x kernels (though, kfence didn't exist on 5.11).

Could you please try: https://patchwork.freedesktop.org/series/90065/

A bit of a long shot, but at least in the bugzilla some of the logs do reference i915_gem_object_make_unshrinkable(), so might be related.

I'm building a test kernel package with the suggested patch in OBS home:tiwai:bsc1185624 repo. The package will be available later at http://download.opensuse.org/repositories/home:/tiwai:/bsc1185624/standard/ Behzad, please give it a try and report back if this works.

Thank you

Since yesterday I trying to build the kernel but my pc is so weak for compiling the kernel.

There are several packages in the repo and I installed "kernel-vanilla-5.12.4-1.1.gb31df5b.x86_64.rpm"(If I have installed the right package) and currently using that and I inform the result.

kernel-vanilla is a wrong pick. That is a package without downstream patches (that's why called "vanilla"), and this fix patch won't be applied there. Use kernel-default instead.

OK, I switched to "5.12.4-1.gb31df5b-default" but looks like 'Kfence' is disabled(on both 'Vanilla' and 'Default') because I don't see the "kfence: initialized" message in Logs(Or maybe somethings changed since 5.12.0).

Right, kfence is disabled as default due to performance issues. For enabling it, pass kfence.sample_interval=100 boot option.

Thanks to both of you

Maybe too early to conclude, But I ran QEMU/KVM VM(Without patching, Kernel 5.12.0 always caused the system to freeze) and did few hours of web browsing and also played several online(from Youtube and other websites) and local videoes(Without patching usually caused the system to freeze) and I don't see any issue and looks like the problem is solved with this patch but to ensure about it, I will monitor the situation in the next few days and report the result.

Great, I pushed the fix to the branch for openSUSE Tumbleweed kernel now. Hopefully this fix will be merged to the upstream ASAP.

BTW, this bug manifests itself as a different Oops pattern, typically via i915_gem_shrinker_*() code path, too. See https://bugzilla.suse.com/show_bug.cgi?id=1186075

Very well, After about two days of using the patched Kernel, I didn't see any issue and the system works fine.

Thanks again

Fix in now in drm-tip:

    drm/i915/gem: Pin the L-shape quirked object as unshrinkable
    
    When instantiating a tiled object on an L-shaped memory machine, we mark
    the object as unshrinkable to prevent the shrinker from trying to swap
    out the pages. We have to do this as we do not know the swizzling on the
    individual pages, and so the data will be scrambled across swap out/in.
    
    Not only do we need to move the object off the shrinker list, we need to
    mark the object with shrink_pin so that the counter is consistent across
    calls to madvise.
    
    v2: in the madvise ioctl we need to check if the object is currently
    shrinkable/purgeable, not if the object type supports shrinking
    
    Fixes: 0175969e489a ("drm/i915/gem: Use shrinkable status for unknown swizzle quirks")
    References: https://gitlab.freedesktop.org/drm/intel/-/issues/3293
    References: https://gitlab.freedesktop.org/drm/intel/-/issues/3450
    Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
    Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Reviewed-by: Matthew Auld <matthew.auld@intel.com>
    Signed-off-by: Matthew Auld <matthew.auld@intel.com>
    Cc: <stable@vger.kernel.org> # v5.12+
    Link: https://patchwork.freedesktop.org/patch/msgid/20210517084640.18862-1-matthew.auld@intel.com

closed

mentioned in commit nouveau@036867e9

mentioned in commit nouveau@5645f180