kern/56765: drm2 lockdebug "already initialized" panic

[prlw1%cam.ac.uk@localhost]

>Number:         56765
>Category:       kern
>Synopsis:       drm2 lockdebug "already initialized" panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Mar 24 16:10:01 +0000 2022
>Originator:     Patrick Welche
>Release:        NetBSD-9.99.95/amd64 20 Mar 2022
>Organization:
>Environment:
>Description:
Opening shadertoy with firefox resulted in:

[ 3517.9310269] Mutex error: _mutex_init,369: already initialized

[ 3517.9310269] lock address : 0xffffb800297e9030 type     :               spin
[ 3517.9310269] initialized  : 0xffffffff80597627
[ 3517.9310269] shared holds :                  0 exclusive:                  0
[ 3517.9310269] shares wanted:                  0 exclusive:                  0
[ 3517.9310269] relevant cpu :                  0 last held:                  0
[ 3517.9310269] relevant lwp : 0xffff96786a764600 last held: 000000000000000000
[ 3517.9310269] last locked  : 0xffffffff8057cb2f unlocked*: 0xffffffff8057cc9e
[ 3517.9310269] owner field  : 000000000000000000 wait/spin:                0/0

[ 3517.9310269] panic: LOCKDEBUG: Mutex error: _mutex_init,369: already initiali
zed
[ 3517.9310269] cpu0: Begin traceback...
[ 3517.9310269] vpanic() at netbsd:vpanic+0x14a
[ 3517.9310269] panic() at netbsd:panic+0x3c
[ 3517.9310269] lockdebug_abort1() at netbsd:lockdebug_abort1+0xe6
[ 3517.9310269] lockdebug_alloc() at netbsd:lockdebug_alloc+0xe6
[ 3517.9310269] _mutex_init() at netbsd:_mutex_init+0x4a
[ 3517.9310269] __alloc_pd() at netbsd:__alloc_pd+0x3d
[ 3517.9310269] alloc_pd() at netbsd:alloc_pd+0x15
[ 3517.9310269] __gen8_ppgtt_alloc() at netbsd:__gen8_ppgtt_alloc+0x45c
[ 3517.9310269] gen8_ppgtt_alloc() at netbsd:gen8_ppgtt_alloc+0xb8
[ 3517.9310269] ppgtt_bind_vma() at netbsd:ppgtt_bind_vma+0x34
[ 3517.9310269] __vma_bind() at netbsd:__vma_bind+0x28
[ 3517.9310269] fence_work() at netbsd:fence_work+0x1b
[ 3517.9310269] linux_workqueue_thread() at netbsd:linux_workqueue_thread+0x17a
[ 3517.9310269] cpu0: End traceback...

(gdb) print panicstr
$1 = 0xffffffff81108680 <scratchstr> "LOCKDEBUG: Mutex error: _mutex_init,369: already initialized"
(gdb) bt
#0  0xffffffff80222765 in cpu_reboot (howto=howto@entry=260, 
    bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:720
#1  0xffffffff808b0587 in kern_reboot (howto=howto@entry=260, 
    bootstr=bootstr@entry=0x0) at ../../../../kern/kern_reboot.c:73
#2  0xffffffff808f5afa in vpanic (
    fmt=fmt@entry=0xffffffff80e52b20 "LOCKDEBUG: %s error: %s,%zu: %s", 
    ap=ap@entry=0xffffb8013c5f8b98) at ../../../../kern/subr_prf.c:290
#3  0xffffffff808f5bbf in panic (
    fmt=fmt@entry=0xffffffff80e52b20 "LOCKDEBUG: %s error: %s,%zu: %s")
    at ../../../../kern/subr_prf.c:209
#4  0xffffffff808e9d80 in lockdebug_abort1 (dopanic=true, 
    msg=0xffffffff80e64359 "already initialized", s=0, ld=0xffffb80028772608, 
    line=369, func=0xffffffff80d648d8 <__func__.8> "_mutex_init")
    at ../../../../kern/subr_lockdebug.c:794
#5  lockdebug_abort1 (func=0xffffffff80d648d8 <__func__.8> "_mutex_init", 
    line=369, ld=0xffffb80028772608, s=0, 
    msg=0xffffffff80e64359 "already initialized", dopanic=<optimized out>)
    at ../../../../kern/subr_lockdebug.c:772
#6  0xffffffff808ea037 in lockdebug_alloc (
    func=func@entry=0xffffffff80d648d8 <__func__.8> "_mutex_init", 
    line=line@entry=369, lock=lock@entry=0xffffb800297e9030, 
    lo=0xffffffff81045390 <mutex_spin_lockops>, initaddr=18446744071567930919)
    at ../../../../kern/subr_lockdebug.c:276
#7  0xffffffff808a2984 in _mutex_init (mtx=0xffffb800297e9030, 
    type=<optimized out>, ipl=6, return_address=<optimized out>)
    at ../../../../kern/kern_mutex.c:369
#8  0xffffffff808a29f2 in mutex_init (mtx=<optimized out>, 
    type=<optimized out>, ipl=<optimized out>)
    at ../../../../kern/kern_mutex.c:378
#9  0xffffffff80597627 in spin_lock_init (spinlock=0xffffb800297e9030)
    at ../../../../external/bsd/drm2/include/linux/spinlock.h:109
#10 __alloc_pd (sz=sz@entry=4144)
    at ../../../../external/bsd/drm2/dist/drm/i915/gt/intel_ppgtt.c:43
#11 0xffffffff80597677 in alloc_pd (vm=vm@entry=0xffff9675928324c8)
    at ../../../../external/bsd/drm2/dist/drm/i915/gt/intel_ppgtt.c:51
#12 0xffffffff8057cee1 in __gen8_ppgtt_alloc (vm=vm@entry=0xffff9675928324c8, 
    pd=0xffffb800297d9008, start=start@entry=0xffffb8013c5f8d98, 
    end=end@entry=69, lvl=2, lvl@entry=3)
    at ../../../../external/bsd/drm2/dist/drm/i915/gt/gen8_ppgtt.c:287
#13 0xffffffff8057e391 in gen8_ppgtt_alloc (vm=0xffff9675928324c8, 
    start=<optimized out>, length=5)
    at ../../../../external/bsd/drm2/dist/drm/i915/gt/intel_gtt.h:447
#14 0xffffffff80597463 in ppgtt_bind_vma (vma=0xffff9675337ad9c0, 
    cache_level=I915_CACHE_LLC, flags=<optimized out>)
    at ../../../../external/bsd/drm2/dist/drm/i915/gt/intel_ppgtt.c:176
#15 0xffffffff805d5cf0 in __vma_bind (work=<optimized out>)
    at ../../../../external/bsd/drm2/dist/drm/i915/i915_vma.c:373
#16 0xffffffff805d49a6 in fence_work (work=0xffff967599132c58)
    at ../../../../external/bsd/drm2/dist/drm/i915/i915_sw_fence_work.c:26
#17 0xffffffff80729d41 in linux_workqueue_thread (cookie=0xffff96786c883c00)
    at ../../../../external/bsd/common/linux/linux_work.c:455
#18 0xffffffff80208747 in lwp_trampoline ()
#19 0x0000000000000000 in ?? ()

PID    LID S CPU     FLAGS       STRUCT LWP *               NAME WAIT
0    >  21 7   0       200   ffff96786a764600           lnxubdwq


The i915_page_directory struct was only just kzalloc'd - how can its 
lock appear in a lockdebug_lookup?

>How-To-Repeat:

>Fix: