kern/52907: Unconditional KASSERT in DRM TTM code

[coypu%sdf.org@localhost]

>Number:         52907
>Category:       kern
>Synopsis:       Unconditional KASSERT in DRM TTM code
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jan 07 18:40:00 +0000 2018
>Originator:     coypu
>Release:        NetBSD 8.99.9
>Organization:
>Environment:
NetBSD localhost 8.99.9 NetBSD 8.99.9 (GENERIC) #9: Sat Dec  9 18:35:18 IST 2017  fly@localhost:/home/fly/obj/sys/arch/amd64/compile/GENERIC amd64

>Description:



panic: kernel diagnostic assertion "!ISSET(ttm->page_flags, TTM_PAGE_FLAG_SWAPPED)" failed: file "/usr/src/sys/external/bsd/drm2/dist/drm/ttm/ttm_tt.c", line 418 

ttm_tt_unwire() at netbsd:ttm_tt_unwire+0xc5
ttm_bus_dma_populate() at netbsd:ttm_bus_dma_populate+0x14f
ttm_tt_bind() at netbsd:ttm_tt_bind+0x26
ttm_bo_handle_move_mem() at netbsd:ttm_bo_handle_move_mem+0x61a
ttm_bo_validate() at netbsd:ttm_bo_validate+0x238
ttm_bo_init() at netbsd:ttm_bo_init+0x213
nouveau_bo_new() at netbsd:nouveau_bo_new+0x200
nouveau_gem_new() at netbsd:nouveau_gem_new+0x53
nouveau_gem_ioctl_new() at netbsd:nouveau_gem_ioctl_new+0x9d
drm_ioctl() at netbsd:drm_ioctl+0x11e
sys_ioctl() at netbsd:sys_ioctl+0x101
syscall() at netbsd:syscall+0x1d8
--- syscall (number 54) ---



>How-To-Repeat:
This KASSERT is unconditional if bus_dmamap_load_pglist fails.


ttm_bus_dma_populate:

  /* Pretend it is now, for the sake of ttm_tt_wire.  */
  ttm_dma->ttm.page_flags |= TTM_PAGE_FLAG_SWAPPED;

  ret = -bus_dmamap_load_pglist(ttm_dma->ttm.bdev->dmat,
  if (ret)
         goto fail1;

fail1:  KASSERT(ttm_dma->ttm.state == tt_unbound);
        ttm_tt_unwire(&ttm_dma->ttm);


ttm_tt_unwire:

  KASSERT(!ISSET(ttm->page_flags, TTM_PAGE_FLAG_SWAPPED));

- Maybe we should try some fault injection code for error branches.
>Fix:
No idea yet.