Bug 1794350 - [abrt] d_alloc: list_add corruption. next->prev should be prev (ffff930b5d4b6ca0), but was 0000000000000000. (next=ffff930beff5b690).
Summary: [abrt] d_alloc: list_add corruption. next->prev should be prev (ffff930b5d4b6...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: 31
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
URL: https://retrace.fedoraproject.org/faf...
Whiteboard: abrt_hash:b9d4cc88a170d847e3f1883cb2b...
: 1804712 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-01-23 11:22 UTC by Victor Stinner
Modified: 2020-02-19 13:54 UTC (History)
18 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: ---


Attachments (Terms of Use)
File: dmesg (96.03 KB, text/plain)
2020-01-23 11:23 UTC, Victor Stinner
no flags Details

Description Victor Stinner 2020-01-23 11:22:54 UTC
Description of problem:
I didn't do anything specific. I was using GNOME on my 2 external monitors
(laptop internal screen was off, the laptop was closed). Suddenly, the screens were not updated anymore.

Here is the kernel bug with the Intel Corporation HD Graphics 530 GPU (IGP).

My laptop uses hybrid graphics: it also has a NVIDIA Corporation GM107GLM [Quadro M1000M].

janv. 22 18:45:51 apu kernel
============================

list_add corruption. next->prev should be prev (ffff930b5d4b6ca0), but was 0000000000000000. (next=ffff930beff5b690).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:23!
invalid opcode: 0000 [#1] SMP PTI
CPU: 6 PID: 2415 Comm: gmain Not tainted 5.4.10-200.fc31.x86_64 #1
Hardware name: LENOVO 20EQS64N16/20EQS64N16, BIOS N1EET80W (1.53 ) 09/14/2018
RIP: 0010:__list_add_valid.cold+0xf/0x3f
Code: 39 fe 0f 85 71 00 00 00 48 8b 52 08 48 39 f2 0f 85 56 00 00 00 b8 01 00 00 00 c3 4c 89 c1 48 c7 c7 d8 fb 38 a8 e8 23 f3 c3 ff <0f> 0b 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 88 fc 38 a8 e8 0c f3 c3
RSP: 0018:ffffa6df06237b88 EFLAGS: 00010246
RAX: 0000000000000075 RBX: ffff930b5d4b6c00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff930bffb97908 RDI: ffff930bffb97908
RBP: ffff930b5d4b6c58 R08: ffff930bffb97908 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000001 R12: ffff930b2aaee600
R13: ffff930b2aaee690 R14: ffff930beff5b690 R15: ffff930b5d4b6ca0
FS:  00007f630cd88700(0000) GS:ffff930bffb80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000f703a3d25a CR3: 0000000782204006 CR4: 00000000003626e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 d_alloc+0x5c/0xa0
 d_alloc_parallel+0x56/0x4a0
 __lookup_slow+0x6b/0x160
 lookup_slow+0x36/0x50
 walk_component+0x1c4/0x340
 path_lookupat.isra.0+0x80/0x230
 filename_lookup+0xae/0x170
 ? strncpy_from_user+0x4f/0x170
 inotify_find_inode+0x25/0x70
 __x64_sys_inotify_add_watch+0xa8/0x130
 do_syscall_64+0x5b/0x1a0
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f631b98d11b
Code: f0 ff ff 73 01 c3 48 8b 0d 6a fd 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 fe 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3d fd 0b 00 f7 d8 64 89 01 48
RSP: 002b:00007f630cd87968 EFLAGS: 00000206 ORIG_RAX: 00000000000000fe
RAX: ffffffffffffffda RBX: 00007f630cd87994 RCX: 00007f631b98d11b
RDX: 0000000001002fce RSI: 000055bd9db41bc0 RDI: 0000000000000006
RBP: 000055bd9db41b90 R08: 000055bd9db41bc0 R09: 00007f630cd879e8
R10: 00007f630cd879e0 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 000055bd9db6fa80 R15: 000055bd9db6faf0
Modules linked in: can_bcm sctp can_raw can vhost_net vhost tap thunderbolt uinput rfcomm ccm xt_CHECKSUM xt_MASQUERADE nf_nat_tftp nf_conntrack_tftp tun bridge stp llc nf_conntrack_netbios_ns nf_conntrack_broadcast xt_CT ip6t_REJECT nf_reject_ipv6 ip6t_rpfilter ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ebtable_broute ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter cmac bnep rmi_smbus rmi_core sunrpc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel snd_hda_codec_hdmi kvm iwlmvm snd_hda_codec_realtek irqbypass mei_wdt mei_hdcp snd_hda_codec_generic iTCO_wdt iTCO_vendor_support mac80211 uvcvideo snd_hda_intel btusb snd_intel_nhlt videobuf2_vmalloc videobuf2_memops crct10dif_pclmul btrtl crc32_pclmul snd_usb_audio snd_hda_codec
 videobuf2_v4l2 btbcm libarc4 snd_hda_core snd_usbmidi_lib ghash_clmulni_intel snd_rawmidi snd_hwdep videobuf2_common intel_cstate btintel iwlwifi intel_uncore snd_seq bluetooth intel_rapl_perf snd_seq_device intel_wmi_thunderbolt pcspkr videodev thinkpad_acpi joydev mei_me cfg80211 wmi_bmof rtsx_pci_ms memstick snd_pcm mc ecdh_generic ecc i2c_i801 ledtrig_audio mei snd_timer snd intel_pch_thermal soundcore rfkill ip_tables btrfs libcrc32c xor zstd_decompress zstd_compress raid6_pq i915 nouveau mxm_wmi ttm rtsx_pci_sdmmc mmc_core i2c_algo_bit drm_kms_helper nvme drm e1000e crc32c_intel serio_raw nvme_core rtsx_pci wmi video fuse
---[ end trace 54ed79558dc98b99 ]---
RIP: 0010:__list_add_valid.cold+0xf/0x3f
Code: 39 fe 0f 85 71 00 00 00 48 8b 52 08 48 39 f2 0f 85 56 00 00 00 b8 01 00 00 00 c3 4c 89 c1 48 c7 c7 d8 fb 38 a8 e8 23 f3 c3 ff <0f> 0b 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 88 fc 38 a8 e8 0c f3 c3
RSP: 0018:ffffa6df06237b88 EFLAGS: 00010246
RAX: 0000000000000075 RBX: ffff930b5d4b6c00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff930bffb97908 RDI: ffff930bffb97908
RBP: ffff930b5d4b6c58 R08: ffff930bffb97908 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000001 R12: ffff930b2aaee600
R13: ffff930b2aaee690 R14: ffff930beff5b690 R15: ffff930b5d4b6ca0
FS:  00007f630cd88700(0000) GS:ffff930bffb80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000f703a3d25a CR3: 0000000782204006 CR4: 00000000003626e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

janv. 22 18:45:55 apu kernel
============================

i915 0000:00:02.0: GPU HANG: ecode 9:1:0x00000000, hang on rcs0
GPU hangs can indicate a bug anywhere in the entire gfx stack, including userspace.
Please file a _new_ bug report on bugs.freedesktop.org against DRI -> DRM/Intel
drm/i915 developers can then reassign to the right component if it's not a kernel issue.
The GPU crash dump is required to analyze GPU hangs, so please always attach it.
GPU crash dump saved to /sys/class/drm/card0/error
i915 0000:00:02.0: Resetting rcs0 for hang on rcs0

/sys/class/drm/card0/error content
==================================

GPU HANG: ecode 9:1:0x00000000, hang on rcs0
Kernel: 5.4.10-200.fc31.x86_64 x86_64
Driver: 20190822
Time: 1579715155 s 268443 us
Boottime: 26441 s 75075 us
Uptime: 26438 s 950699 us
Epoch: 4321108032 jiffies (1000 HZ)
Capture: 4321108032 jiffies; 624057 ms ago, 0 ms after epoch
Reset count: 0
Suspend count: 0
Platform: SKYLAKE
Subplatform: 0x0
PCI ID: 0x191b
PCI Revision: 0x06
PCI Subsystem: 17aa:222e
IOMMU enabled?: 0
DMC loaded: yes
DMC fw version: 1.27
GT awake: yes
RPM wakelock: yes
PM suspended: no
EIR: 0x00000000
IER: 0x08080000
GTIER[0]: 0x01010101
GTIER[1]: 0x01010101
GTIER[2]: 0x00000070
GTIER[3]: 0x00000101
PGTBL_ER: 0x00000000
FORCEWAKE: 0x00010001
DERRMR: 0x2077efef
CCID: 0x00000000
  fence[0] = 00000000
  fence[1] = 00000000
  fence[2] = 00000000
  fence[3] = 00000000
  fence[4] = 00000000
  fence[5] = 00000000
  fence[6] = 00000000
  fence[7] = 00000000
  fence[8] = 00000000
  fence[9] = 00000000
  fence[10] = 00000000
  fence[11] = 00000000
  fence[12] = 00000000
  fence[13] = 00000000
  fence[14] = 00000000
  fence[15] = 00000000
  fence[16] = 00000000
  fence[17] = 00000000
  fence[18] = 00000000
  fence[19] = 00000000
  fence[20] = 00000000
  fence[21] = 00000000
  fence[22] = 00000000
  fence[23] = 00000000
  fence[24] = 00000000
  fence[25] = 00000000
  fence[26] = 00000000
  fence[27] = 00000000
  fence[28] = 00000000
  fence[29] = 00000000
  fence[30] = 00000000
  fence[31] = 00000000
ERROR: 0x00000000
DONE_REG: 0x07ffffff
FAULT_TLB_DATA: 0x0000000d 0x1d84eacf
Num Pipes: 3
Pipe [0]:
  Power: on
  SRC: 077f0437
  STAT: 00000000
Plane [0]:
  CNTR: 00000000
  STRIDE: 0000000f
  SURF: 00000000
  TILEOFF: 00000000
Cursor [0]:
  CNTR: 00000000
  POS: 00000000
  BASE: 00000000
Pipe [1]:
  Power: off
  SRC: 00000000
  STAT: 00000000
Plane [1]:
  CNTR: 00000000
  STRIDE: 00000000
  SURF: 00000000
  TILEOFF: 00000000
Cursor [1]:
  CNTR: 00000000
  POS: 00000000
  BASE: 00000000
Pipe [2]:
  Power: off
  SRC: 00000000
  STAT: 00000000
Plane [2]:
  CNTR: 00000000
  STRIDE: 00000000
  SURF: 00000000
  TILEOFF: 00000000
Cursor [2]:
  CNTR: 00000000
  POS: 00000000
  BASE: 00000000
CPU transcoder: A
  Power: off
  CONF: 00000000
  HTOTAL: 00000000
  HBLANK: 00000000
  HSYNC: 00000000
  VTOTAL: 00000000
  VBLANK: 00000000
  VSYNC: 00000000
CPU transcoder: A
  Power: off
  CONF: 00000000
  HTOTAL: 00000000
  HBLANK: 00000000
  HSYNC: 00000000
  VTOTAL: 00000000
  VBLANK: 00000000
  VSYNC: 00000000
CPU transcoder: A
  Power: off
  CONF: 00000000
  HTOTAL: 00000000
  HBLANK: 00000000
  HSYNC: 00000000
  VTOTAL: 00000000
  VBLANK: 00000000
  VSYNC: 00000000
CPU transcoder: EDP
  Power: on
  CONF: 00000000
  HTOTAL: 0833077f
  HBLANK: 0833077f
  HSYNC: 081b07eb
  VTOTAL: 04650437
  VBLANK: 04650437
  VSYNC: 044b0441
is_mobile: no
is_lp: no
require_force_probe: no
has_64bit_reloc: yes
gpu_reset_clobbers_display: no
has_reset_engine: yes
has_fpga_dbg: yes
has_global_mocs: no
has_gt_uc: yes
has_l3_dpf: no
has_llc: yes
has_logical_ring_contexts: yes
has_logical_ring_elsq: no
has_logical_ring_preemption: yes
has_pooled_eu: no
has_rc6: yes
has_rc6p: no
has_rps: yes
has_runtime_pm: yes
has_snoop: no
has_coherent_ggtt: yes
unfenced_needs_alignment: no
hws_needs_physical: no
cursor_needs_physical: no
has_csr: yes
has_ddi: yes
has_dp_mst: yes
has_fbc: yes
has_gmch: no
has_hotplug: yes
has_ipc: yes
has_modular_fia: no
has_overlay: no
has_psr: yes
overlay_needs_physical: no
supports_tv: no
Has logical contexts? yes
scheduler: 1f
slice0: 3 subslice(s) (0x7):
	subslice0: 8 EUs (0xff)
	subslice1: 8 EUs (0xff)
	subslice2: 8 EUs (0xff)
	subslice3: 0 EUs (0x0)
slice1: 0 subslice(s) (0x0):
	subslice0: 0 EUs (0x0)
	subslice1: 0 EUs (0x0)
	subslice2: 0 EUs (0x0)
	subslice3: 0 EUs (0x0)
slice2: 0 subslice(s) (0x0):
	subslice0: 0 EUs (0x0)
	subslice1: 0 EUs (0x0)
	subslice2: 0 EUs (0x0)
	subslice3: 0 EUs (0x0)
i915.vbt_firmware=(null)
i915.modeset=-1
i915.lvds_channel_mode=0
i915.panel_use_ssc=-1
i915.vbt_sdvo_panel_type=-1
i915.enable_dc=-1
i915.enable_fbc=1
i915.enable_psr=-1
i915.disable_power_well=1
i915.enable_ips=1
i915.invert_brightness=0
i915.enable_guc=0
i915.guc_log_level=-1
i915.guc_firmware_path=(null)
i915.huc_firmware_path=(null)
i915.dmc_firmware_path=(null)
i915.mmio_debug=0
i915.edp_vswing=0
i915.reset=2
i915.inject_load_failure=0
i915.fastboot=-1
i915.enable_dpcd_backlight=0
i915.force_probe=
i915.alpha_support=no
i915.enable_hangcheck=yes
i915.prefault_disable=no
i915.load_detect_test=no
i915.force_reset_modeset_test=no
i915.error_capture=yes
i915.disable_display=no
i915.verbose_state_checks=yes
i915.nuclear_pageflip=no
i915.enable_dp_mst=yes
i915.enable_gvt=no
GuC firmware:
	status: DISABLED
	version: wanted 33.0, found 0.0
	uCode: 0 bytes
	RSA: 0 bytes
HuC firmware: (null)
	status: N/A
	version: wanted 0.0, found 0.0
	uCode: 0 bytes
	RSA: 0 bytes

Additional info:
reporter:       libreport-2.11.3
list_add corruption. next->prev should be prev (ffff930b5d4b6ca0), but was 0000000000000000. (next=ffff930beff5b690).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:23!
invalid opcode: 0000 [#1] SMP PTI
CPU: 6 PID: 2415 Comm: gmain Not tainted 5.4.10-200.fc31.x86_64 #1
Hardware name: LENOVO 20EQS64N16/20EQS64N16, BIOS N1EET80W (1.53 ) 09/14/2018
RIP: 0010:__list_add_valid.cold+0xf/0x3f
Code: 39 fe 0f 85 71 00 00 00 48 8b 52 08 48 39 f2 0f 85 56 00 00 00 b8 01 00 00 00 c3 4c 89 c1 48 c7 c7 d8 fb 38 a8 e8 23 f3 c3 ff <0f> 0b 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 88 fc 38 a8 e8 0c f3 c3
RSP: 0018:ffffa6df06237b88 EFLAGS: 00010246
RAX: 0000000000000075 RBX: ffff930b5d4b6c00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff930bffb97908 RDI: ffff930bffb97908
RBP: ffff930b5d4b6c58 R08: ffff930bffb97908 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000001 R12: ffff930b2aaee600
R13: ffff930b2aaee690 R14: ffff930beff5b690 R15: ffff930b5d4b6ca0
FS:  00007f630cd88700(0000) GS:ffff930bffb80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000f703a3d25a CR3: 0000000782204006 CR4: 00000000003626e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 d_alloc+0x5c/0xa0
 d_alloc_parallel+0x56/0x4a0
 __lookup_slow+0x6b/0x160
 lookup_slow+0x36/0x50
 walk_component+0x1c4/0x340
 path_lookupat.isra.0+0x80/0x230
 filename_lookup+0xae/0x170
 ? strncpy_from_user+0x4f/0x170
 inotify_find_inode+0x25/0x70
 __x64_sys_inotify_add_watch+0xa8/0x130
 do_syscall_64+0x5b/0x1a0
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f631b98d11b
Code: f0 ff ff 73 01 c3 48 8b 0d 6a fd 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 fe 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3d fd 0b 00 f7 d8 64 89 01 48
RSP: 002b:00007f630cd87968 EFLAGS: 00000206 ORIG_RAX: 00000000000000fe
RAX: ffffffffffffffda RBX: 00007f630cd87994 RCX: 00007f631b98d11b
RDX: 0000000001002fce RSI: 000055bd9db41bc0 RDI: 0000000000000006
RBP: 000055bd9db41b90 R08: 000055bd9db41bc0 R09: 00007f630cd879e8
R10: 00007f630cd879e0 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 000055bd9db6fa80 R15: 000055bd9db6faf0
Modules linked in: can_bcm sctp can_raw can vhost_net vhost tap thunderbolt uinput rfcomm ccm xt_CHECKSUM xt_MASQUERADE nf_nat_tftp nf_conntrack_tftp tun bridge stp llc nf_conntrack_netbios_ns nf_conntrack_broadcast xt_CT ip6t_REJECT nf_reject_ipv6 ip6t_rpfilter ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ebtable_broute ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter cmac bnep rmi_smbus rmi_core sunrpc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel snd_hda_codec_hdmi kvm iwlmvm snd_hda_codec_realtek irqbypass mei_wdt mei_hdcp snd_hda_codec_generic iTCO_wdt iTCO_vendor_support mac80211 uvcvideo snd_hda_intel btusb snd_intel_nhlt videobuf2_vmalloc videobuf2_memops crct10dif_pclmul btrtl crc32_pclmul snd_usb_audio snd_hda_codec
 videobuf2_v4l2 btbcm libarc4 snd_hda_core snd_usbmidi_lib ghash_clmulni_intel snd_rawmidi snd_hwdep videobuf2_common intel_cstate btintel iwlwifi intel_uncore snd_seq bluetooth intel_rapl_perf snd_seq_device intel_wmi_thunderbolt pcspkr videodev thinkpad_acpi joydev mei_me cfg80211 wmi_bmof rtsx_pci_ms memstick snd_pcm mc ecdh_generic ecc i2c_i801 ledtrig_audio mei snd_timer snd intel_pch_thermal soundcore rfkill ip_tables btrfs libcrc32c xor zstd_decompress zstd_compress raid6_pq i915 nouveau mxm_wmi ttm rtsx_pci_sdmmc mmc_core i2c_algo_bit drm_kms_helper nvme drm e1000e crc32c_intel serio_raw nvme_core rtsx_pci wmi video fuse

Comment 1 Victor Stinner 2020-01-23 11:23:01 UTC
Created attachment 1654824 [details]
File: dmesg

Comment 2 Jeff Hicks 2020-02-19 13:54:33 UTC
*** Bug 1804712 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.