CachyOS package issue: https://github.com/CachyOS/linux-cachyos/issues/1058
Hi,
I hit a kernel Oops in the AMDGPU/TTM swapout path on a Radeon RX 7800 XT. The
failure happened immediately after a global OOM condition and was followed by an
RCU stall and a host reset.
The kernel was `7.2.4-1-cachyos` on CachyOS. The GPU is a Sapphire Navi32 / RX
7800 XT (`1002:747e`, subsystem `1da2:475d`). The relevant userspace versions
were Mesa `26.2.2-2`, KWin/Plasma `6.7.5-1.1`, and libdrm `2.4.134-1.1`.
The first failure in the affected boot was:
```text
kswapd0 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0
oom-kill: ... global_oom ...
Out of memory: Killed process <redacted>
amdgpu 0000:03:00.0: [drm] *ERROR* Not enough memory for command submission!
WARNING: drivers/gpu/drm/ttm/ttm_resource.c:235
at ttm_resource_add_bulk_move+0x124/0x150 [ttm]
BUG: kernel NULL pointer dereference, address: 0000000000000008
Oops: Oops: 0000 [#1] SMP NOPTI
RIP: ttm_resource_add_bulk_move+0xc9/0x150 [ttm]
```
The call chain was:
```text
ttm_resource_add_bulk_move
ttm_resource_alloc
ttm_bo_swapout_cb
ttm_lru_walk_for_evict
ttm_bo_swapout
ttm_global_swapout
ttm_tt_populate
ttm_bo_populate
ttm_bo_vm_fault_reserved
amdgpu_gem_fault
```
After the Oops, an `amdgpu` KFD cleanup worker and an `amdgpu_drm_release`
path were both blocked on TTM-related spinlocks. The journal does not contain
`Kernel panic - not syncing`; I am calling this an Oops followed by a lockup or
reset, not a confirmed formal panic.
This looks related to the recent TTM fixes:
-
[3db7d7d](https://github.com/torvalds/linux/commit/3db7d7d583419f7b1f2e141e36418802dbb25cf8)
fixes swapped-out resources remaining in a `bulk_move` range.
-
[fcfe647](https://github.com/torvalds/linux/commit/fcfe64715b425262af1b36f498f9197f3537ceed)
changes the cleanup condition after `ttm_tt_swapout()` from `if (!ret)` to
`if (ret > 0)`.
I checked the source release used for `linux-cachyos 7.2.4-1`:
[`cachyos-7.2.4-1`](https://github.com/CachyOS/linux/releases/tag/cachyos-7.2.4-1).
It still contains:
```c
ret = ttm_tt_swapout(bdev, tt, swapout_walk->gfp_flags);
if (!ret) {
ttm_resource_del_bulk_move_unevictable(bo->resource, bo);
ttm_resource_move_to_lru_tail(bo->resource);
}
```
The installed `ttm.ko` has the matching `test eax,eax` / `jne` branch, so the
installed binary also has the old zero-only condition. The CachyOS 7.2.4
packaging recipe does not list a TTM bulk-move patch. The current
`cachyos-7.2.6-1` source release also still contains `if (!ret)` at this call
site; 7.2.6 has not been boot-tested on the affected host.
The kernel was tainted with `CPU_OUT_OF_SPEC`, `OOT_MODULE`, and
`UNSIGNED_MODULE`; the Oops also set `WARN` and `DIE`.
Does this match the stale `bulk_move` endpoint issue fixed by
`3db7d7d`/`fcfe647`,
and should those fixes be backported to kernels based on 7.2.4?
