On Tue, Oct 06, 2026 at 10:57:40AM -0700, FNU VISHWANATHA wrote: > From: Kornel Dulęba <[email protected]> > > A kernel panic caused by a list corruption was observed when the IPU6 > driver is running under heavy load. The panic would reproduce > consistently within a few minutes of the test suite running, though > never during the same test. The corruption would always happen in > list_add_tail called from xe_bo_pin_external: > > list_add corruption. prev->next should be next (ffff8bb9862912c8), but was > ffff8bb9e811e2a8. (prev=ffff8bb9e811e2a8) > > Having prev->next == prev, suggests that node was re-initialized without > being removed from the list first. This indicates that the BO might have > been destroyed while it was still pinned.
This is a bug if true. > Looking into xe_ttm_bo_destroy and its caller ttm_bo_release, reveals > that the latter supports a case where bo->pin_count > 0, albeit with a > WARN_ON_ONCE. Since ttm_bo_release sets bo->pin_count to 0 in that case, > add a complementary change to also remove bo->pinned_link from the list. > With this applied, the test progresses much further, with the newly > added warning seen in dmesg. > > Test: atest CtsCameraTestCases > I don't doubt the test case but this an investigation for a proper fix. > Signed-off-by: Kornel Dulęba <[email protected]> > --- > drivers/gpu/drm/xe/xe_bo.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c > index f2634d048cd4..c5989db950f7 100644 > --- a/drivers/gpu/drm/xe/xe_bo.c > +++ b/drivers/gpu/drm/xe/xe_bo.c > @@ -1688,6 +1688,11 @@ static void xe_ttm_bo_destroy(struct ttm_buffer_object > *ttm_bo) > if (bo->parent_obj) > xe_bo_put(bo->parent_obj); > > + spin_lock(&xe->pinned.lock); > + if (WARN_ON_ONCE(!list_empty(&bo->pinned_link))) > + list_del_init(&bo->pinned_link); > + spin_unlock(&xe->pinned.lock); > + It shouldn't be possible to get here with a BO on the pinned list, so this is papering over a bug some where else in the driver. I'd prefer 'xe_assert(xe, !list_empty(&bo->pinned_link));' be added to the code to assert this and if this pops, we case down the root cause. Can you please file a gitlab issue with the details of this failure so we assist debugging and get a proper fix? Matt > mutex_lock(&xe->mem_access.vram_userfault.lock); > if (!list_empty(&bo->vram_userfault_link)) > list_del(&bo->vram_userfault_link); > -- > 2.34.1 >
