Etnaviv DRM driver - oops when unloading

[Alexander Holler]

Hello,

I've just build and booted the Etnaviv driver as module with Kernel 4.0.4.

When I unload the driver with rmmod an oops happens:

------------[ cut here ]------------
WARNING: CPU: 1 PID: 2192 at drivers/staging/etnaviv/etnaviv_gem.c:404 
etnaviv_gem_paddr_locked+0x30/0x38 [etnaviv]()
Modules linked in: nft_reject_ipv6 nf_reject_ipv6 nf_log_ipv6 
nf_conntrack_ipv6 nf_defrag_ipv6 nf_tables_ipv6 nft_reject_ipv4 
nf_reject_ipv4 nft_reject nf_log_ipv4 nf_log_common nft_log nft_counter 
nft_meta nf_conntrack_ipv4 nf_defrag_ipv4 nft_ct nf_conntrack nft_hash 
nft_rbtree nf_tables_ipv4 nf_tables nfnetlink bridge stp llc rfcomm bnep 
hci_uart sch_sfq nfsd auth_rpcgss lockd grace sunrpc imx_ipuv3_crtc 
dw_hdmi_imx dw_hdmi evdev imx_ipu_v3 brcmfmac imxdrm brcmutil 
ci_hdrc_imx ci_hdrc imx_thermal etnaviv(C-) usbmisc_imx drm_kms_helper 
gpio_keys
CPU: 1 PID: 2192 Comm: rmmod Tainted: G         C 
4.0.4-wandq-00210-g9240da9 #325
Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[<8010cd14>] (unwind_backtrace) from [<80109778>] (show_stack+0x10/0x14)
[<80109778>] (show_stack) from [<8068ed1c>] (dump_stack+0x94/0xd4)
[<8068ed1c>] (dump_stack) from [<80126a54>] (warn_slowpath_common+0x84/0xb4)
[<80126a54>] (warn_slowpath_common) from [<80126b20>] 
(warn_slowpath_null+0x1c/0x24)
[<80126b20>] (warn_slowpath_null) from [<7f059d28>] 
(etnaviv_gem_paddr_locked+0x30/0x38 [etnaviv])
[<7f059d28>] (etnaviv_gem_paddr_locked [etnaviv]) from [<7f05b198>] 
(etnaviv_gpu_hw_init+0xb4/0x18c [etnaviv])
[<7f05b198>] (etnaviv_gpu_hw_init [etnaviv]) from [<7f05bbf0>] 
(etnaviv_gpu_rpm_resume+0x70/0xcc [etnaviv])
[<7f05bbf0>] (etnaviv_gpu_rpm_resume [etnaviv]) from [<80413044>] 
(__rpm_callback+0x2c/0x60)
[<80413044>] (__rpm_callback) from [<80413098>] (rpm_callback+0x20/0x80)
[<80413098>] (rpm_callback) from [<80413e50>] (rpm_resume+0x350/0x524)
[<80413e50>] (rpm_resume) from [<80414070>] (__pm_runtime_resume+0x4c/0x64)
[<80414070>] (__pm_runtime_resume) from [<8040b9a8>] 
(__device_release_driver+0x1c/0xc4)
[<8040b9a8>] (__device_release_driver) from [<8040c0f4>] 
(driver_detach+0xac/0xb0)
[<8040c0f4>] (driver_detach) from [<8040b75c>] (bus_remove_driver+0x4c/0xa0)
[<8040b75c>] (bus_remove_driver) from [<7f05dcc8>] 
(etnaviv_exit+0x10/0x348 [etnaviv])
[<7f05dcc8>] (etnaviv_exit [etnaviv]) from [<801839d4>] 
(SyS_delete_module+0x174/0x1b8)
[<801839d4>] (SyS_delete_module) from [<80106420>] 
(ret_fast_syscall+0x0/0x34)
---[ end trace e3e10844e84f28b3 ]---
Unable to handle kernel NULL pointer dereference at virtual address 00000058
pgd = d0430000
[00000058] *pgd=60452831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] PREEMPT SMP ARM
Modules linked in: nft_reject_ipv6 nf_reject_ipv6 nf_log_ipv6 
nf_conntrack_ipv6 nf_defrag_ipv6 nf_tables_ipv6 nft_reject_ipv4 
nf_reject_ipv4 nft_reject nf_log_ipv4 nf_log_common nft_log nft_counter 
nft_meta nf_conntrack_ipv4 nf_defrag_ipv4 nft_ct nf_conntrack nft_hash 
nft_rbtree nf_tables_ipv4 nf_tables nfnetlink bridge stp llc rfcomm bnep 
hci_uart sch_sfq nfsd auth_rpcgss lockd grace sunrpc imx_ipuv3_crtc 
dw_hdmi_imx dw_hdmi evdev imx_ipu_v3 brcmfmac imxdrm brcmutil 
ci_hdrc_imx ci_hdrc imx_thermal etnaviv(C-) usbmisc_imx drm_kms_helper 
gpio_keys
CPU: 1 PID: 2192 Comm: rmmod Tainted: G        WC 
4.0.4-wandq-00210-g9240da9 #325
Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
task: d48ce300 ti: d1f26000 task.ti: d1f26000
PC is at etnaviv_buffer_init+0x4/0xa0 [etnaviv]
LR is at etnaviv_gpu_hw_init+0x98/0x18c [etnaviv]
pc : [<7f05d4f0>]    lr : [<7f05b17c>]    psr: a00e0013\x0asp : d1f27e98 
  ip : 00000000  fp : 01c09d58
r10: 00000000  r9 : d1f26000  r8 : 00000004
r7 : 80a02100  r6 : 80411c80  r5 : dd75bfc0  r4 : dd61f410
r3 : 00000000  r2 : 00000730  r1 : 00000000  r0 : dd61f410
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: 6043004a  DAC: 00000015
Process rmmod (pid: 2192, stack limit = 0xd1f26210)
Stack: (0xd1f27e98 to 0xd1f28000)
7e80:                                                       00000001 
dd61f410
7ea0: dd75bfc0 7f05bbf0 7f05bb80 de120a10 de120a74 80413044 de120a10 
00000000
7ec0: de120410 80413098 80411c80 de120a10 00000000 80413e50 01c09d58 
8068bebc
7ee0: ddaf2e25 8068c028 de1bb3a4 7f0601a4 de1d4044 de120a10 de120a74 
00000004
7f00: 600e0013 801065a4 d1f26000 80414070 7f0601a4 de120a10 7f0601a4 
de120a44
7f20: 00000081 8040b9a8 7f0601a4 de120a10 7f0601a4 8040c0f4 7f0601a4 
01c09d8c
7f40: 00000000 8040b75c 7f060240 7f05dcc8 7f05dcb8 801839d4 d4b29488 
616e7465
7f60: 00766976 00000000 d48ce728 00000000 d48ce728 00000000 80a4230c 
d48ce300
7f80: 01c09d58 8013da84 d4b29480 d1f26000 801065a4 00f27fb0 00000006 
01c09d58
7fa0: 7e868e68 80106420 01c09d58 7e868e68 01c09d8c 00000800 63760a00 
63760a00
7fc0: 01c09d58 7e868e68 00000000 00000081 00000001 7e869078 0002e1a0 
01c09d58
7fe0: 76e94400 7e868e14 000186d0 76e9440c 600e0010 01c09d8c 3136315b 
203a5d39
[<7f05d4f0>] (etnaviv_buffer_init [etnaviv]) from [<00000001>] (0x1)
Code: eb4c93a7 e28dd014 e8bd8030 e5903050 (e5932058)
---[ end trace e3e10844e84f28b4 ]---

I've tried it two times, both ended with the same oops. So it seems to 
be reproducible (here).

I haven't had a deeper look at the source, but after a quick look I 
assume a fix isn't that hard.

Regards,

Alexander Holler