Kernel oops in udl driver

[Hans de Goede]

Hi,

While testing server managed fd support for the xf86-video-modesetting driver
I encountered the following oops on exiting the Xserver (this happened only once
during all my testing). This was with the Xserver / udev configured to use a
single Xserver for both the intel-gfx of my workstation as well as the udl.

Here is the log:

[ 2206.402405] [drm] wait for urb interrupted: ffffffc2 available: 4
[ 2206.405149] BUG: unable to handle kernel NULL pointer dereference at 000000000000003c
[ 2206.406642] IP: [<ffffffffa00f6fa0>] i915_gem_unmap_dma_buf+0x80/0x110 [i915]
[ 2206.408182] PGD 0
[ 2206.409704] Oops: 0000 [#1] SMP
[ 2206.411246] Modules linked in: asix usbnet mii udl drm_usb fuse ipt_MASQUERADE xt_CHECKSUM tun ip6t_rpfilter ip6t_REJECT xt_conntrack cfg80211 rfkill ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw sch5636 sch56xx_common iTCO_wdt iTCO_vendor_support gpio_ich ppdev snd_usb_audio snd_usbmidi_lib snd_rawmidi
x86_pkg_temp_thermal coretemp kvm_intel kvm snd_hda_codec_hdmi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel microcode snd_hda_codec_conexant snd_hda_codec_generic tuner_simple tuner_types tuner msp3400 serio_raw snd_hda_intel
[ 2206.417063]  i2c_i801 snd_bt87x snd_hda_codec snd_hwdep snd_seq snd_seq_device bttv snd_pcm btcx_risc tveeprom videobuf_dma_sg videobuf_core snd_timer rc_core snd v4l2_common soundcore videodev media lpc_ich mfd_core shpchp e1000e ptp pps_core tpm_infineon parport_pc parport tpm_tis tpm binfmt_misc usb_storage crc32c_intel i915 video i2c_algo_bit drm_kms_helper drm i2c_core
[ 2206.421350] CPU: 3 PID: 7173 Comm: Xorg.bin Not tainted 3.14.0-0.rc6.git4.1.fc21.x86_64 #1
[ 2206.423512] Hardware name: FUJITSU D3071-S1/D3071-S1, BIOS V4.6.4.0 R1.12.0.SR.4 for D3071-S1x 05/03/2013
[ 2206.425727] task: ffff8801f5a29970 ti: ffff8801ae60e000 task.ti: ffff8801ae60e000
[ 2206.427975] RIP: 0010:[<ffffffffa00f6fa0>]  [<ffffffffa00f6fa0>] i915_gem_unmap_dma_buf+0x80/0x110 [i915]
[ 2206.430297] RSP: 0018:ffff8801ae60fc48  EFLAGS: 00010246
[ 2206.432626] RAX: 0000000000000000 RBX: ffff8801a8189210 RCX: 0000000000000001
[ 2206.434992] RDX: 00000000000007e9 RSI: ffff88018430f000 RDI: ffff8800a0a91830
[ 2206.437381] RBP: ffff8801ae60fc80 R08: 0000000000000000 R09: 00000000000007e9
[ 2206.439797] R10: 0000000000000000 R11: ffffffffffffffdc R12: ffff8800662b9880
[ 2206.442244] R13: ffff8800a0a91830 R14: 0000000000000000 R15: 0000000000000004
[ 2206.444721] FS:  00007fcc5c024900(0000) GS:ffff880235a00000(0000) knlGS:0000000000000000
[ 2206.447240] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2206.449782] CR2: 000000000000003c CR3: 00000001a957e000 CR4: 00000000000407e0
[ 2206.452362] Stack:
[ 2206.454946]  000007e9810f8c1d ffff88018430f000 ffff8800568a0500 ffff8801a8189210
[ 2206.457616]  0000000000000000 ffff8801c6394e00 ffff8801ae60fd60 ffff8801ae60fca8
[ 2206.460296]  ffffffff8150bac1 ffff8800568a0500 ffff8801c63fd068 ffff8801c63fd000
[ 2206.462998] Call Trace:
[ 2206.465700]  [<ffffffff8150bac1>] dma_buf_unmap_attachment+0x51/0x80
[ 2206.468471]  [<ffffffffa002dc02>] drm_prime_gem_destroy+0x22/0x40 [drm]
[ 2206.471240]  [<ffffffffa066f955>] udl_gem_free_object+0x35/0x60 [udl]
[ 2206.474054]  [<ffffffffa001658a>] drm_gem_object_free+0x2a/0x30 [drm]
[ 2206.476880]  [<ffffffffa0016be4>] drm_gem_object_handle_unreference_unlocked+0xe4/0x120 [drm]
[ 2206.479751]  [<ffffffffa0016e6c>] drm_gem_object_release_handle+0x5c/0x80 [drm]
[ 2206.482608]  [<ffffffff813c8d74>] idr_for_each+0x114/0x1c0
[ 2206.485477]  [<ffffffffa0016e10>] ? drm_gem_dumb_destroy+0x20/0x20 [drm]
[ 2206.488366]  [<ffffffff817d85ae>] ? mutex_unlock+0xe/0x10
[ 2206.491261]  [<ffffffffa00178e0>] drm_gem_release+0x20/0x30 [drm]
[ 2206.494150]  [<ffffffffa0016413>] drm_release+0x533/0x5c0 [drm]
[ 2206.497052]  [<ffffffff812353e5>] __fput+0xf5/0x2c0
[ 2206.499937]  [<ffffffff812355fe>] ____fput+0xe/0x10
[ 2206.502802]  [<ffffffff810c0ba4>] task_work_run+0xb4/0xe0
[ 2206.505655]  [<ffffffff810997f4>] do_exit+0x304/0xd00
[ 2206.508497]  [<ffffffff810d9680>] ? wake_up_state+0x10/0x20
[ 2206.511333]  [<ffffffff810aa33e>] ? signal_wake_up_state+0x1e/0x30
[ 2206.514162]  [<ffffffff8109a27c>] do_group_exit+0x4c/0xc0
[ 2206.516978]  [<ffffffff8109a304>] SyS_exit_group+0x14/0x20
[ 2206.519789]  [<ffffffff817e5829>] system_call_fastpath+0x16/0x1b
[ 2206.522594] Code: 85 ff 0f 84 93 00 00 00 41 83 fe 02 0f 87 95 00 00 00 44 89 f1 44 89 ca 48 89 c6 4c 89 ef 44 89 4d cc 48 89 45 d0 e8 90 f2 2f e1 <4d> 8b 57 38 4d 85 d2 74 1a 44 8b 4d cc 48 8b 45 d0 45 31 c0 44
[ 2206.525878] RIP  [<ffffffffa00f6fa0>] i915_gem_unmap_dma_buf+0x80/0x110 [i915]
[ 2206.528933]  RSP <ffff8801ae60fc48>
[ 2206.531951] CR2: 000000000000003c
[ 2206.534936] ---[ end trace 3cc7e685273df0dd ]---

As stated in the oops I was running the following kernel when this happened:
3.14.0-0.rc6.git4.1.fc21.x86_64

Regards,

Hans