linux/drivers
Linus Torvalds 39cb2c9a31 drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj()
I've seen this trigger twice now, where the i915_gem_object_to_ggtt()
call in intel_unpin_fb_obj() returns NULL, resulting in an oops
immediately afterwards as the (inlined) call to i915_vma_unpin_fence()
tries to dereference it.

It seems to be some race condition where the object is going away at
shutdown time, since both times happened when shutting down the X
server.  The call chains were different:

 - VT ioctl(KDSETMODE, KD_TEXT):

    intel_cleanup_plane_fb+0x5b/0xa0 [i915]
    drm_atomic_helper_cleanup_planes+0x6f/0x90 [drm_kms_helper]
    intel_atomic_commit_tail+0x749/0xfe0 [i915]
    intel_atomic_commit+0x3cb/0x4f0 [i915]
    drm_atomic_commit+0x4b/0x50 [drm]
    restore_fbdev_mode+0x14c/0x2a0 [drm_kms_helper]
    drm_fb_helper_restore_fbdev_mode_unlocked+0x34/0x80 [drm_kms_helper]
    drm_fb_helper_set_par+0x2d/0x60 [drm_kms_helper]
    intel_fbdev_set_par+0x18/0x70 [i915]
    fb_set_var+0x236/0x460
    fbcon_blank+0x30f/0x350
    do_unblank_screen+0xd2/0x1a0
    vt_ioctl+0x507/0x12a0
    tty_ioctl+0x355/0xc30
    do_vfs_ioctl+0xa3/0x5e0
    SyS_ioctl+0x79/0x90
    entry_SYSCALL_64_fastpath+0x13/0x94

 - i915 unpin_work workqueue:

    intel_unpin_work_fn+0x58/0x140 [i915]
    process_one_work+0x1f1/0x480
    worker_thread+0x48/0x4d0
    kthread+0x101/0x140

and this patch purely papers over the issue by adding a NULL pointer
check and a WARN_ON_ONCE() to avoid the oops that would then generally
make the machine unresponsive.

Other callers of i915_gem_object_to_ggtt() seem to also check for the
returned pointer being NULL and warn about it, so this clearly has
happened before in other places.

[ Reported it originally to the i915 developers on Jan 8, applying the
  ugly workaround on my own now after triggering the problem for the
  second time with no feedback.

  This is likely to be the same bug reported as

     https://bugs.freedesktop.org/show_bug.cgi?id=98829
     https://bugs.freedesktop.org/show_bug.cgi?id=99134

  which has a patch for the underlying problem, but it hasn't gotten to
  me, so I'm applying the workaround. ]

Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Imre Deak <imre.deak@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-01-29 13:50:06 -08:00
..
accessibility
acpi ACPI fixes for v4.10-rc6 2017-01-26 17:27:00 -08:00
amba
android
ata Merge branch 'for-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata 2016-12-13 15:30:50 -08:00
atm Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
auxdisplay auxdisplay: fix new ht16k33 build errors 2017-01-11 09:27:30 +01:00
base memory_hotplug: make zone_can_shift() return a boolean value 2017-01-24 16:26:14 -08:00
bcma bcma: add Dell Inspiron 3148 2016-11-29 17:35:14 +02:00
block xen-blkfront: correct maximum segment accounting 2017-01-23 13:27:42 -05:00
bluetooth Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-12-16 10:24:44 -08:00
bus cpu/hotplug: Cleanup state names 2016-12-25 10:47:44 +01:00
cdrom Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
char virtio_console: fix a crash in config_work_handler 2017-01-19 23:46:31 +02:00
clk One fix for Samsung Exynos524x SoCs where recent IOMMU patches have 2017-01-21 18:46:45 -08:00
clocksource clocksource/exynos_mct: Clear interrupt when cpu is shut down 2017-01-17 10:08:38 +01:00
connector
cpufreq Merge branches 'pm-sleep' and 'pm-cpufreq' 2017-01-27 00:08:59 +01:00
cpuidle Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2016-12-27 17:51:36 -08:00
dax libnvdimm for 4.10 2016-12-18 15:49:10 -08:00
dca
devfreq PM / devfreq: exynos-bus: Fix the wrong return value 2017-01-03 00:21:45 +01:00
dio Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
dma dmaengine: rcar-dmac: unmap slave resource when channel is freed 2017-01-13 12:14:28 +05:30
dma-buf
edac Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
eisa
extcon extcon: return error code on failure 2017-01-11 09:11:39 +01:00
firewire
firmware Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2017-01-15 10:54:39 -08:00
fmc
fpga fpga: Clarify how write_init works streaming modes 2016-11-29 15:51:49 -06:00
gpio gpio: provide lockdep keys for nested/unnested irqchips 2017-01-19 09:57:20 +01:00
gpu drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj() 2017-01-29 13:50:06 -08:00
hid HID: wacom: Fix sibling detection regression 2017-01-19 14:19:25 +01:00
hsi
hv clocksource: Use a plain u64 instead of cycle_t 2016-12-25 11:04:12 +01:00
hwmon hwmon: (lm90) fix temp1_max_alarm attribute 2017-01-02 10:15:28 -08:00
hwspinlock
hwtracing coresight/etm3/4x: Consolidate hotplug state space 2016-12-25 10:47:44 +01:00
i2c i2c: imx-lpi2c: add VLLS mode support 2017-01-26 00:24:23 +01:00
ide Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
idle Power management material for v4.10-rc1 2016-12-13 10:41:53 -08:00
iio First round of IIO fixes for the 4.10 cycle. 2017-01-02 16:59:44 +01:00
infiniband RDMA/cma: Fix unknown symbol when CONFIG_IPV6 is not enabled 2017-01-27 14:29:04 -05:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2017-01-13 11:49:34 -08:00
iommu IOMMU Fixes for Linux v4.10-rc2 2017-01-06 10:49:36 -08:00
ipack
irqchip Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-12-25 14:30:04 -08:00
isdn ISDN: eicon: silence misleading array-bounds warning 2017-01-27 11:27:34 -05:00
leds cpu/hotplug: Cleanup state names 2016-12-25 10:47:44 +01:00
lguest Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
lightnvm Char/Misc driver patches for 4.10-rc1 2016-12-13 12:11:01 -08:00
macintosh Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
mailbox ktime: Cleanup ktime_set() usage 2016-12-25 17:21:22 +01:00
mcb
md md/r5cache: disable write back for degraded array 2017-01-24 11:26:06 -08:00
media media fixes for v4.10-rc6 2017-01-27 10:29:33 -08:00
memory Fixes for drivers already queued to prevent 2016-11-30 14:58:00 +01:00
memstick drivers/memstick/core/memstick.c: avoid -Wnonnull warning 2017-01-24 16:26:14 -08:00
message Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
mfd - New Device Support 2016-12-19 08:16:26 -08:00
misc mei: bus: enable OS version only for SPT and newer 2017-01-11 07:43:57 +01:00
mmc mmc: dw_mmc: force setup bus if active slots exist 2017-01-23 10:19:30 +01:00
mtd mtd: nand: lpc32xx: fix invalid error handling of a requested irq 2017-01-04 20:50:18 +01:00
net net: phy: micrel: add support for KSZ8795 2017-01-27 11:10:50 -05:00
nfc
ntb ntb_transport: Remove unnecessary call to ntb_peer_spad_read 2016-12-23 16:11:07 -05:00
nubus Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
nvdimm libnvdimm, namespace: fix pmem namespace leak, delete when size set to zero 2017-01-13 09:50:33 -08:00
nvme nvme-fc: use blk_rq_nr_phys_segments 2017-01-26 17:49:14 +02:00
nvmem nvmem: fix nvmem_cell_read() return type doc 2017-01-04 18:22:47 +01:00
of pci-v4.10-changes 2016-12-15 12:46:48 -08:00
oprofile Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
parisc Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
parport parisc, parport_gsc: Fixes for printk continuation lines 2017-01-28 21:54:21 +01:00
pci PCI/MSI: pci-xgene-msi: Fix CPU hotplug registration handling 2017-01-17 08:41:51 -06:00
pcmcia drivers/pcmcia/m32r_pcc.c: check return from add_pcc_socket 2016-12-12 18:55:06 -08:00
perf cpu/hotplug: Cleanup state names 2016-12-25 10:47:44 +01:00
phy SCSI misc on 20161213 2016-12-14 10:49:33 -08:00
pinctrl pinctrl: uniphier: fix Ethernet (RMII) pin-mux setting for LD20 2017-01-19 10:36:40 +01:00
platform platform/x86: ideapad-laptop: handle ACPI event 1 2017-01-22 12:47:06 +02:00
pnp Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
power ktime: Cleanup ktime_set() usage 2016-12-25 17:21:22 +01:00
powercap powercap / RAPL: Add Knights Mill CPUID 2016-11-30 23:41:33 +01:00
pps
ps3
ptp Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-12-12 19:56:15 -08:00
pwm pwm: Changes for v4.10-rc1 2016-12-15 11:45:13 -08:00
rapidio
ras
regulator - New Device Support 2016-12-19 08:16:26 -08:00
remoteproc Revert "remoteproc: Merge table_ptr and cached_table pointers" 2016-12-30 03:26:31 -08:00
reset ARM: SoC driver updates for v4.10 2016-12-15 16:03:25 -08:00
rpmsg rpmsg: virtio_rpmsg_bus: fix channel creation 2016-12-30 03:12:11 -08:00
rtc ktime: Cleanup ktime_set() usage 2016-12-25 17:21:22 +01:00
s390 virtio/s390: virtio: constify virtio_config_ops structures 2017-01-19 23:46:34 +02:00
sbus Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
scsi Revert "sd: remove __data_len hack for WRITE SAME" 2017-01-26 10:01:20 -07:00
sfi
sh lib: radix-tree: check accounting of existing slot replacement users 2016-12-12 18:55:08 -08:00
sn
soc soc: ti: wkup_m3_ipc: Fix error return code in wkup_m3_ipc_probe() 2017-01-12 13:37:49 -08:00
spi spi: Fixes for v4.10 2017-01-20 12:25:11 -08:00
spmi
ssb
staging staging: octeon: Call SET_NETDEV_DEV() 2017-01-03 17:11:50 +01:00
target target: support XCOPY requests without parameters 2017-01-10 08:41:30 -08:00
tc
thermal Revert "thermal: thermal_hwmon: Convert to hwmon_device_register_with_info()" 2017-01-25 09:51:08 +08:00
thunderbolt Char/Misc driver patches for 4.10-rc1 2016-12-13 12:11:01 -08:00
tty sysrq: attach sysrq handler correctly for 32-bit kernel 2017-01-11 09:22:54 +01:00
uio uio-hv-generic: store physical addresses instead of virtual 2016-12-10 14:57:58 +01:00
usb xhci: remove WARN_ON if dma mask is not set for platform devices 2017-01-20 14:55:20 +01:00
uwb
vfio vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null 2017-01-24 10:12:04 -07:00
vhost vhost/vsock: handle vhost_vq_init_access() error 2017-01-25 00:33:10 +02:00
video fbdev: color map copying bounds checking 2017-01-24 16:26:14 -08:00
virt
virtio vring: Force use of DMA API for ARM-based systems with legacy devices 2017-01-25 00:33:11 +02:00
vlynq
vme vme: Fix wrong pointer utilization in ca91cx42_slave_get 2017-01-11 10:42:16 +01:00
w1
watchdog Watchdog updates for v4.10 2016-12-24 11:27:45 -08:00
xen Merge branch 'stable/for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb 2017-01-27 12:17:07 -08:00
zorro Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
Kconfig
Makefile