/* * (C) 2001 Clemson University and The University of Chicago * * See COPYING in top-level directory. */ #ifndef __UPCALL_H #define __UPCALL_H /* * Sanitized this header file to fix * 32-64 bit interaction issues between * client-core and device */ struct orangefs_io_request_s { __s32 __pad1; __s32 buf_index; __s32 count; __s32 __pad2; __s64 offset; struct orangefs_object_kref refn; enum ORANGEFS_io_type io_type; __s32 readahead_size; }; struct orangefs_lookup_request_s { __s32 sym_follow; __s32 __pad1; struct orangefs_object_kref parent_refn; char d_name[ORANGEFS_NAME_MAX]; }; struct orangefs_create_request_s { struct orangefs_object_kref parent_refn; struct ORANGEFS_sys_attr_s attributes; char d_name[ORANGEFS_NAME_MAX]; }; struct orangefs_symlink_request_s { struct orangefs_object_kref parent_refn; struct ORANGEFS_sys_attr_s attributes; char entry_name[ORANGEFS_NAME_MAX]; char target[ORANGEFS_NAME_MAX]; }; struct orangefs_getattr_request_s { struct orangefs_object_kref refn; __u32 mask; __u32 __pad1; }; struct orangefs_setattr_request_s { struct orangefs_object_kref refn; struct ORANGEFS_sys_attr_s attributes; }; struct orangefs_remove_request_s { struct orangefs_object_kref parent_refn; char d_name[ORANGEFS_NAME_MAX]; }; struct orangefs_mkdir_request_s { struct orangefs_object_kref parent_refn; struct ORANGEFS_sys_attr_s attributes; char d_name[ORANGEFS_NAME_MAX]; }; struct orangefs_readdir_request_s { struct orangefs_object_kref refn; __u64 token; __s32 max_dirent_count; __s32 buf_index; }; struct orangefs_readdirplus_request_s { struct orangefs_object_kref refn; __u64 token; __s32 max_dirent_count; __u32 mask; __s32 buf_index; __s32 __pad1; }; struct orangefs_rename_request_s { struct orangefs_object_kref old_parent_refn; struct orangefs_object_kref new_parent_refn; char d_old_name[ORANGEFS_NAME_MAX]; char d_new_name[ORANGEFS_NAME_MAX]; }; struct orangefs_statfs_request_s { __s32 fs_id; __s32 __pad1; }; struct orangefs_truncate_request_s { struct orangefs_object_kref refn; __s64 size; }; struct orangefs_mmap_ra_cache_flush_request_s { struct orangefs_object_kref refn; }; struct orangefs_fs_mount_request_s { char orangefs_config_server[ORANGEFS_MAX_SERVER_ADDR_LEN]; }; struct orangefs_fs_umount_request_s { __s32 id; __s32 fs_id; char orangefs_config_server[ORANGEFS_MAX_SERVER_ADDR_LEN]; }; struct orangefs_getxattr_request_s { struct orangefs_object_kref refn; __s32 key_sz; __s32 __pad1; char key[ORANGEFS_MAX_XATTR_NAMELEN]; }; struct orangefs_setxattr_request_s { struct orangefs_object_kref refn; struct ORANGEFS_keyval_pair keyval; __s32 flags; __s32 __pad1; }; struct orangefs_listxattr_request_s { struct orangefs_object_kref refn; __s32 requested_count; __s32 __pad1; __u64 token; }; struct orangefs_removexattr_request_s { struct orangefs_object_kref refn; __s32 key_sz; __s32 __pad1; char key[ORANGEFS_MAX_XATTR_NAMELEN]; }; struct orangefs_op_cancel_s { __u64 op_tag; }; struct orangefs_fsync_request_s { struct orangefs_object_kref refn; }; enum orangefs_param_request_type { ORANGEFS_PARAM_REQUEST_SET = 1, ORANGEFS_PARAM_REQUEST_GET = 2 }; enum orangefs_param_request_op { ORANGEFS_PARAM_REQUEST_OP_ACACHE_TIMEOUT_MSECS = 1, ORANGEFS_PARAM_REQUEST_OP_ACACHE_HARD_LIMIT = 2, ORANGEFS_PARAM_REQUEST_OP_ACACHE_SOFT_LIMIT = 3, ORANGEFS_PARAM_REQUEST_OP_ACACHE_RECLAIM_PERCENTAGE = 4, ORANGEFS_PARAM_REQUEST_OP_PERF_TIME_INTERVAL_SECS = 5, ORANGEFS_PARAM_REQUEST_OP_PERF_HISTORY_SIZE = 6, ORANGEFS_PARAM_REQUEST_OP_PERF_RESET = 7, ORANGEFS_PARAM_REQUEST_OP_NCACHE_TIMEOUT_MSECS = 8, ORANGEFS_PARAM_REQUEST_OP_NCACHE_HARD_LIMIT = 9, ORANGEFS_PARAM_REQUEST_OP_NCACHE_SOFT_LIMIT = 10, ORANGEFS_PARAM_REQUEST_OP_NCACHE_RECLAIM_PERCENTAGE = 11, ORANGEFS_PARAM_REQUEST_OP_STATIC_ACACHE_TIMEOUT_MSECS = 12, ORANGEFS_PARAM_REQUEST_OP_STATIC_ACACHE_HARD_LIMIT = 13, ORANGEFS_PARAM_REQUEST_OP_STATIC_ACACHE_SOFT_LIMIT = 14, ORANGEFS_PARAM_REQUEST_OP_STATIC_ACACHE_RECLAIM_PERCENTAGE = 15, ORANGEFS_PARAM_REQUEST_OP_CLIENT_DEBUG = 16, ORANGEFS_PARAM_REQUEST_OP_CCACHE_TIMEOUT_SECS = 17, ORANGEFS_PARAM_REQUEST_OP_CCACHE_HARD_LIMIT = 18, ORANGEFS_PARAM_REQUEST_OP_CCACHE_SOFT_LIMIT = 19, ORANGEFS_PARAM_REQUEST_OP_CCACHE_RECLAIM_PERCENTAGE = 20, ORANGEFS_PARAM_REQUEST_OP_CAPCACHE_TIMEOUT_SECS = 21, ORANGEFS_PARAM_REQUEST_OP_CAPCACHE_HARD_LIMIT = 22, ORANGEFS_PARAM_REQUEST_OP_CAPCACHE_SOFT_LIMIT = 23, ORANGEFS_PARAM_REQUEST_OP_CAPCACHE_RECLAIM_PERCENTAGE = 24, ORANGEFS_PARAM_REQUEST_OP_TWO_MASK_VALUES = 25, }; struct orangefs_param_request_s { enum orangefs_param_request_type type; enum orangefs_param_request_op op; __s64 value; char s_value[ORANGEFS_MAX_DEBUG_STRING_LEN]; }; enum orangefs_perf_count_request_type { ORANGEFS_PERF_COUNT_REQUEST_ACACHE = 1, ORANGEFS_PERF_COUNT_REQUEST_NCACHE = 2, ORANGEFS_PERF_COUNT_REQUEST_CAPCACHE = 3, }; struct orangefs_perf_count_request_s { enum orangefs_perf_count_request_type type; __s32 __pad1; }; struct orangefs_fs_key_request_s { __s32 fsid; __s32 __pad1; }; struct orangefs_upcall_s { __s32 type; __u32 uid; __u32 gid; int pid; int tgid; /* Trailers unused but must be retained for protocol compatibility. */ __s64 trailer_size; char *trailer_buf; union { struct orangefs_io_request_s io; struct orangefs_lookup_request_s lookup; struct orangefs_create_request_s create; struct orangefs_symlink_request_s sym; struct orangefs_getattr_request_s getattr; struct orangefs_setattr_request_s setattr; struct orangefs_remove_request_s remove; struct orangefs_mkdir_request_s mkdir; struct orangefs_readdir_request_s readdir; struct orangefs_readdirplus_request_s readdirplus; struct orangefs_rename_request_s rename; struct orangefs_statfs_request_s statfs; struct orangefs_truncate_request_s truncate; struct orangefs_mmap_ra_cache_flush_request_s ra_cache_flush; struct orangefs_fs_mount_request_s fs_mount; struct orangefs_fs_umount_request_s fs_umount; struct orangefs_getxattr_request_s getxattr; struct orangefs_setxattr_request_s setxattr; struct orangefs_listxattr_request_s listxattr; struct orangefs_removexattr_request_s removexattr; struct orangefs_op_cancel_s cancel; struct orangefs_fsync_request_s fsync; struct orangefs_param_request_s param; struct orangefs_perf_count_request_s perf_count; struct orangefs_fs_key_request_s fs_key; } req; }; #endif /* __UPCALL_H */ reference it. It seems to be some race condition where the object is going away at shutdown time, since both times happened when shutting down the X server. The call chains were different: - VT ioctl(KDSETMODE, KD_TEXT): intel_cleanup_plane_fb+0x5b/0xa0 [i915] drm_atomic_helper_cleanup_planes+0x6f/0x90 [drm_kms_helper] intel_atomic_commit_tail+0x749/0xfe0 [i915] intel_atomic_commit+0x3cb/0x4f0 [i915] drm_atomic_commit+0x4b/0x50 [drm] restore_fbdev_mode+0x14c/0x2a0 [drm_kms_helper] drm_fb_helper_restore_fbdev_mode_unlocked+0x34/0x80 [drm_kms_helper] drm_fb_helper_set_par+0x2d/0x60 [drm_kms_helper] intel_fbdev_set_par+0x18/0x70 [i915] fb_set_var+0x236/0x460 fbcon_blank+0x30f/0x350 do_unblank_screen+0xd2/0x1a0 vt_ioctl+0x507/0x12a0 tty_ioctl+0x355/0xc30 do_vfs_ioctl+0xa3/0x5e0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x13/0x94 - i915 unpin_work workqueue: intel_unpin_work_fn+0x58/0x140 [i915] process_one_work+0x1f1/0x480 worker_thread+0x48/0x4d0 kthread+0x101/0x140 and this patch purely papers over the issue by adding a NULL pointer check and a WARN_ON_ONCE() to avoid the oops that would then generally make the machine unresponsive. Other callers of i915_gem_object_to_ggtt() seem to also check for the returned pointer being NULL and warn about it, so this clearly has happened before in other places. [ Reported it originally to the i915 developers on Jan 8, applying the ugly workaround on my own now after triggering the problem for the second time with no feedback. This is likely to be the same bug reported as https://bugs.freedesktop.org/show_bug.cgi?id=98829 https://bugs.freedesktop.org/show_bug.cgi?id=99134 which has a patch for the underlying problem, but it hasn't gotten to me, so I'm applying the workaround. ] Cc: Daniel Vetter <daniel.vetter@intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Imre Deak <imre.deak@intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>