WARNING in vkms_vblank_simulate

WARNING in vkms_vblank_simulate

https://syzkaller.appspot.com/bug?id=0ba17d70d062b2595e1f061231474800f076c7cb

Warning appears when a call to hrtimer_forward_now() fails. A bisection was provided and determined warning started with the following patch:

https://patchwork.freedesktop.org/patch/284352/

Introduction of WARNING is clear since the patch is adding a WARN_ON() which alerts if the return of hrtimer_forward_now() function is not 1. This error was likely being produced before this patch was implemented.

Function where WARN_ON() is called after calling hrtimer_forward_now() can be found here:
drivers/gpu/drm/vkms/vkms_crtc.c

hrtimer_forward_now() calls return hrtimer_forward() which verifies if request to forward the timer expiry is valid. hrtimer_forward() is further explored below:

Function Objective:
* hrtimer_forward - forward the timer expiry

Function Location:
kernel/time/hrtimer.c

Variables:

  * @timer:      hrtimer to forward
  * @now:        forward past this time
  * @interval:   the interval to forward
  * @delta:      @now ? timer expiry

A warning is issued if one of the following are met:

[1] If starting time expiry is greater than ?now?

[2] If the number of intervals needed to pass ?now? is greater than 1.

In the listed crashes with reproducers the kernel version is 5.0.0 and multiple reports without reproducers on kernel version 5.1.0

Quoted 1 line

I had the option to test on kernel versions 5.1.0-rc7 and 5.1.2 with

no success of reproducing. I was able to verify that the WARN_ON() is still checked in the vkms_crtc.c file. Reproducer was ran individually and in a loop to attempt triggering, though to no avail. It?s possible for debugging going to kernel 5.0.0 to test reproducer and find where the warning is typically triggered from could help find the problem. Since the reports are only on 5.0.0 and 5.1.0 (atleast in this report), it's possible the changes in newer kernels have resolved the error.

Quoted 8 lines · Kelsey Skunberg

WARNING in vkms_vblank_simulate

https://syzkaller.appspot.com/bug?id=0ba17d70d062b2595e1f061231474800f076c7cb

Warning appears when a call to hrtimer_forward_now() fails. A bisection was provided and determined warning started with the following patch:

Quoted 7 lines

https://patchwork.freedesktop.org/patch/284352/

Introduction of WARNING is clear since the patch is adding a WARN_ON() which alerts if the return of hrtimer_forward_now() function is not 1. This error was likely being produced before this patch was implemented.

It looks like only a few callers of hrtimer_forward_now() bother to check the return. Probably it doesn't matter in many cases.

The patch commit log doesn't really explain why the tolerance for overrun is 1. I am not sure if WARN_ON is even necessary here.

Quoted 29 lines

Function where WARN_ON() is called after calling hrtimer_forward_now() can be found here:
drivers/gpu/drm/vkms/vkms_crtc.c

hrtimer_forward_now() calls return hrtimer_forward() which verifies if request to forward the timer expiry is valid. hrtimer_forward() is further explored below:

Function Objective:
* hrtimer_forward - forward the timer expiry

Function Location:
kernel/time/hrtimer.c

Variables:

  * @timer:      hrtimer to forward
  * @now:        forward past this time
  * @interval:   the interval to forward
  * @delta:      @now ? timer expiry

A warning is issued if one of the following are met:

[1] If starting time expiry is greater than ?now?

[2] If the number of intervals needed to pass ?now? is greater than 1.

In the listed crashes with reproducers the kernel version is 5.0.0 and multiple reports without reproducers on kernel version 5.1.0

Quoted 9 lines

Quoted 1 line

I had the option to test on kernel versions 5.1.0-rc7 and 5.1.2 with

no success of reproducing. I was able to verify that the WARN_ON() is still checked in the vkms_crtc.c file. Reproducer was ran individually and in a loop to attempt triggering, though to no avail. It?s possible for debugging going to kernel 5.0.0 to test reproducer and find where the warning is typically triggered from could help find the problem. Since the reports are only on 5.0.0 and 5.1.0 (atleast in this report), it's possible the changes in newer kernels have resolved the error.

This might be an obvious question. Do you have DRM_VKMS enabled in your config. More like, are you using the same config the report is using.

https://syzkaller.appspot.com/text?tag=KernelConfig&x=c1e0e0ec44d1e5ff

thanks,
-- Shuah