Kernel panic on RB3GEN2 with v6.19

[sgaud-quic]

Hi,
Observed Kernel panic on RB3GEN2 from Fastrpc with PR : #301

LAVA Job : https://lava-oss.qualcomm.com/scheduler/job/39421

• /lava-39421/0/tests/0_qcom-next-ci-premerge-tests/Runner/suites/Multimedia/DSP_AudioPD/run.sh
  [INFO] 1970-01-01 00:10:20 - -----------------------------------------------------------------------------------------
  [INFO] 1970-01-01 00:10:20 - -------------------Starting DSP_AudioPD Testcase----------------------------
  [INFO] 1970-01-01 00:10:20 - === Test Initialization ===
  [INFO] 1970-01-01 00:10:20 - Checking if dependency binary is available
  [INFO] 1970-01-01 00:10:20 - Process 'adsprpcd' is not running.
  [INFO] 1970-01-01 00:10:20 - adsprpcd is not running
  [INFO] 1970-01-01 00:10:20 - Manually starting adsprpcd daemon
  [INFO] 1970-01-01 00:10:20 - PID is 4073
  [ 601.777839][ T10] Unable to handle kernel paging request at virtual address 006b6b6b6b6b7153
  [ 601.787051][ T10] Mem abort info:
  [ 601.793750][ T10] ESR = 0x0000000096000004
  [ 601.798366][ T10] EC = 0x25: DABT (current EL), IL = 32 bits
  [ 601.804578][ T10] SET = 0, FnV = 0
  [ 601.808493][ T10] EA = 0, S1PTW = 0
  [ 601.812485][ T10] FSC = 0x04: level 0 translation fault
  [ 601.821762][ T10] Data abort info:
  [ 601.825461][ T10] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
  [ 601.831870][ T10] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  [ 601.841754][ T10] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
  [ 601.847987][ T10] [006b6b6b6b6b7153] address between user and kernel address ranges
  [ 601.861778][ T10] Internal error: Oops: 0000000096000004 [Create qualcomm-linux-organization-repolinter.yml #1] SMP
  [ 601.868321][ T10] Modules linked in: rfcomm reset_gpio snd_soc_wsa883x regmap_sdw q6prm_clocks q6apm_lpass_dais snd_q6dsp_common q6apm_dai q6prm snd_q6apm apr bnep fastrpc snd_soc_hdmi_codec venus_enc venus_dec videobuf2_dma_contig rpmsg_ctrl phy_qcom_edp videobuf2_memops qmi_cooling qrtr_smd rpmsg_char qcom_pd_mapper qcom_edac pci_pwrctrl_tc9563 ucsi_glink pmic_glink_altmode typec_ucsi aux_hpd_bridge qcom_battmgr hci_uart btqca leds_qcom_lpg led_class_multicolor qcom_pbs venus_core gpio_shared_proxy v4l2_mem2mem rtc_pm8xxx qcom_spmi_temp_alarm qcom_pon videobuf2_v4l2 bluetooth snd_soc_sc8280xp ecdh_generic snd_soc_qcom_sdw qcom_spmi_adc_tm5 videobuf2_common qcom_spmi_adc5 phy_qcom_qmp_combo pwrseq_qcom_wcn nvmem_qcom_spmi_sdam qcom_vadc_common ecc pwrseq_core camcc_sc7280 lontium_lt9611uxc snd_soc_qcom_common qcom_stats nb7vpq904m dispcc_sc7280 videodev coresight_stm msm aux_bridge mc stm_p_basic videocc_sc7280 qcom_refgen_regulator icc_bwmon gpi typec phy_qcom_snps_femto_v2 ubwc_config coresight_tpdm coresight_cti
  [ 601.868532][ T10] stm_core llcc_qcom ocmem gpu_sched qcom_q6v5_pas drm_gpuvm soundwire_qcom drm_exec qcom_pil_info drm_display_helper snd_soc_lpass_va_macro snd_soc_lpass_wsa_macro snd_soc_lpass_macro_common cec coresight_replicator coresight_tmc snd_soc_core qcom_q6v5 coresight_etm4x coresight_funnel drm_dp_aux_bus qcom_sysmon coresight gpucc_sc7280 drm_client_lib snd_compress snd_pcm qcrypto qcom_common ath11k_ahb sha1 snd_timer libdes qcom_glink_smem ufs_qcom snd ath11k mdt_loader authenc soundwire_bus pinctrl_sc7280_lpass_lpi phy_qcom_qmp_ufs qcom_ice phy_qcom_qmp_pcie pinctrl_lpass_lpi lpassaudiocc_sc7280 slimbus mac80211 soundcore libarc4 socinfo icc_osm_l3 pmic_glink pdr_interface qcom_pdr_msg qmi_helpers nvmem_reboot_mode qcom_rng display_connector drm_kms_helper sha256 qrtr cfg80211 rfkill 8021q garp mrp stp llc usb_f_fs libcomposite fuse drm backlight ipv6 [last unloaded: ipa]
  [ 602.041896][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G W 6.19.0-00763-g9ee7d590793d Create qualcomm-linux-organization-repolinter.yml #1 PREEMPT
  [ 602.053777][ T10] Tainted: [W]=WARN
  [ 602.057552][ T10] Hardware name: Qualcomm Technologies, Inc. Robotics RB3gen2 (DT)
  [ 602.065517][ T10] Workqueue: events fastrpc_context_put_wq [fastrpc]
  [ 602.072249][ T10] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
  [ 602.080125][ T10] pc : fastrpc_buf_free+0x38/0x80 [fastrpc]
  [ 602.086041][ T10] lr : fastrpc_context_free+0xa8/0x1b0 [fastrpc]
  [ 602.092396][ T10] sp : ffff8000800a3d40
  [ 602.096534][ T10] x29: ffff8000800a3d40 x28: 0000000000000000 x27: 0000000000000000
  [ 602.104587][ T10] x26: ffff00008039b3c0 x25: 0000000000000000 x24: ffff000080193205
  [ 602.112641][ T10] x23: ffff0001667e0780 x22: ffff00016543b800 x21: 0000000000000001
  [ 602.120692][ T10] x20: ffff0001667e0700 x19: ffff0000883b8c80 x18: 0000000000000000
  [ 602.128751][ T10] x17: ffffabd91b345a50 x16: ffffabd97526a2a8 x15: ffffabd91b344234
  [ 602.136806][ T10] x14: 0000000000000004 x13: ffffabd9742e7410 x12: ffffabd9743e7380
  [ 602.144860][ T10] x11: ffffabd9743dd924 x10: ffffabd9743dd0e0 x9 : ffffabd91b3458d0
  [ 602.152913][ T10] x8 : ffff8000800a3c98 x7 : 00000003ffffe000 x6 : 0000000000000001
  [ 602.160965][ T10] x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffffffffffffffff
  [ 602.169019][ T10] x2 : ffff800080380000 x1 : 6b6b6b6b6b6b6b6b x0 : ffff000164a0cc10
  [ 602.177071][ T10] Call trace:
  [ 602.180310][ T10] fastrpc_buf_free+0x38/0x80 [fastrpc] (P)
  [ 602.186228][ T10] fastrpc_context_free+0xa8/0x1b0 [fastrpc]
  [ 602.192231][ T10] fastrpc_context_put_wq+0x78/0xa0 [fastrpc]
  [ 602.198324][ T10] process_one_work+0x180/0x450
  [ 602.203185][ T10] worker_thread+0x26c/0x388
  [ 602.207773][ T10] kthread+0x120/0x140
  [ 602.211825][ T10] ret_from_fork+0x10/0x20
  [ 602.216232][ T10] Code: f9400001 a9410800 f9402021 f9401267 (f942f421)
  [ 602.223217][ T10] ---[ end trace 0000000000000000 ]---
  [ 602.228686][ T10] Kernel panic - not syncing: Oops: Fatal exception
  [ 602.235308][ T10] SMP: stopping secondary CPUs
  [ 602.440356][ T10] Kernel Offset: 0x2bd8f42d0000 from 0xffff800080000000
  [ 602.447343][ T10] PHYS_OFFSET: 0xfff1000080000000
  [ 602.452363][ T10] CPU features: 0x600000,000b8001,4008c501,0400720b
  [ 602.458984][ T10] Memory Limit: none
  [ 602.462899][ T10] ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---

[vnarapar]

CR: https://orbit/CR/4448282

[quic-anane]

Identified issue :

[ 87.363131][ T590] fastrpc: fastrpc_device_release: ak:releasing device for client_id=1 ------> T1
[ 87.372235][ T322] fastrpc: fastrpc_context_put_wq: workqueue calling fastrpc_context_put for client_id=1, ctxid=0xd00 —-----T2
[ 87.372566][ T590] fastrpc: fastrpc_device_release: ak:device release complete for client_id=1
[ 87.383385][ T322] fastrpc: fastrpc_context_free: freeing context with client_id=1, ctxid=0xd00, buf=ffff0001793ee800
[ 87.383398][ T322] fastrpc: fastrpc_context_free: calling fastrpc_buf_free for client_id=1
[ 87.383403][ T322] fastrpc: fastrpc_buf_free: freeing buf with client_id=1, size=0x380, dma_addr=0x3ffff1000
[ 87.383424][ T322] Unable to handle kernel paging request at virtual address 006b6b6b6b6b7153

T1 -> thread one is trying to free the user (fastrpc_device_release ) and T2 is a workqueue which is trying to free a context which belongs to the same user

T2 is running

    dma_free_coherent(buf->dev, buf->size, buf->virt,
                      fastrpc_ipa_to_dma_addr(buf->fl->cctx, buf->dma_addr));   —-> T1 already freed fl , thus resulting in crash 

[quic-anane]

#317
qualcomm-linux/kernel-topics#740

[sgaud-quic]

Closing this as fix is merged in tag : https://github.com/qualcomm-linux/kernel/tree/qcom-next-7.0-rc2-20260306