Bug 853622

Summary: Kernel oops while attempting to open an image in eog
Product: [Fedora] Fedora Reporter: Imed Chihi <imed.chihi>
Component: xorg-x11-drv-atiAssignee: X/OpenGL Maintenance List <xgl-maint>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 17CC: gansalmon, ichihi, itamar, jonathan, kernel-maint, madhu.chinakonda, xgl-maint
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-08-01 13:46:19 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
abrt logs none

Description Imed Chihi 2012-09-01 12:24:53 UTC
Created attachment 608823 [details]
abrt logs

Description of problem:
Xorg triggers a kernel BUG() when eog (Eye of Gnome) attempts to display a particular image file.

Version-Release number of selected component (if applicable):
Fedora 17 running kernel 3.5.2-3.fc17.x86_64 SMP.

How reproducible:
In gnome-terminal, run:
$ eog Scanned\ Document-00.png

Steps to Reproduce:
1. Open a gnome-terminal session
2. run:
 $ eog Scanned\ Document-00.png
  
Actual results:
Kernel oops.

Expected results:
Image displays in eog window.

Additional info:
1. abrt logs attached
2. reproducer image Scanned\ Document-00.png attached
3. reproducer image generated from a scan by simple-scan
4. Fedora 17 with latest updates up to 31 AUG 2012

Comment 1 Imed Chihi 2012-09-01 12:27:24 UTC
Created attachment 608824 [details]
Reproducer image

Comment 2 Imed Chihi 2012-09-01 12:29:11 UTC
Reproducer image is actually a JPG, not a PNG as stated in the initial bug report.

Comment 3 Josh Boyer 2012-09-04 00:57:19 UTC
Not sure why you didn't just let abrt file this bug.  Would have saved us from doing the copy/paste of the backtrace by hand.

BUG: unable to handle kernel paging request at ffffea8001e0b6d0
IP: [<ffffffffa006567f>] ttm_bo_mem_put+0x1f/0x30 [ttm]
PGD 0 
Oops: 0000 [#1] SMP 
CPU 2 
Modules linked in: fuse tpm_bios rfcomm bnep ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state ip6table_filter nf_conntrack ip6_tables arc4 ath9k snd_hda_codec_hdmi snd_hda_codec_idt ath9k_common ath9k_hw snd_hda_intel snd_hda_codec uvcvideo videobuf2_vmalloc videobuf2_memops snd_hwdep videobuf2_core videodev media coretemp ath mac80211 snd_pcm kvm_intel snd_page_alloc cfg80211 snd_timer kvm btusb hp_wmi bluetooth r8169 sparse_keymap snd rfkill lpc_ich mii hp_accel mei lis3lv02d mfd_core soundcore microcode input_polldev serio_raw uinput crc32c_intel wmi video radeon i2c_algo_bit drm_kms_helper ttm drm i2c_core [last unloaded: scsi_wait_scan]
Pid: 805, comm: Xorg Not tainted 3.5.2-3.fc17.x86_64 #1 Hewlett-Packard HP ProBook 4520s/1411
RIP: 0010:[<ffffffffa006567f>]  [<ffffffffa006567f>] ttm_bo_mem_put+0x1f/0x30 [ttm]
RSP: 0018:ffff8800b45b7a18  EFLAGS: 00010282
RAX: 0000007ffff50000 RBX: ffff8800b45b7ae8 RCX: 0000000036a4c000
RDX: ffffea0001ebb680 RSI: ffff8800b3b904a8 RDI: ffffea8001e0b6a8
RBP: ffff8800b45b7a18 R08: ffff8800b45b7ae8 R09: ffffffffa0135ce0
R10: ffffc900114fe838 R11: 0000000000000000 R12: ffff8800b3b90448
R13: ffff8800b3b90448 R14: ffff88009b7bb100 R15: ffff8800b45b7ae8
FS:  00007f53eb86d8c0(0000) GS:ffff8800bac80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffea8001e0b6d0 CR3: 00000000b450e000 CR4: 00000000000007e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process Xorg (pid: 805, threadinfo ffff8800b45b6000, task ffff8800a1b55c40)
Stack:
 ffff8800b45b7a28 ffffffffa0068bd2 ffff8800b45b7a58 ffffffffa0069000
 ffff8800b24a4588 ffff8800b24a4608 ffff8800b3b90448 ffff8800b24a4560
 ffff8800b45b7ac8 ffffffffa006710f ffff8800b45b7a03 ffffff0000000015
Call Trace:
 [<ffffffffa0068bd2>] ttm_bo_free_old_node+0x12/0x20 [ttm]
 [<ffffffffa0069000>] ttm_bo_move_ttm+0x110/0x150 [ttm]
 [<ffffffffa006710f>] ttm_bo_handle_move_mem+0x4bf/0x580 [ttm]
 [<ffffffffa00680e2>] ttm_bo_move_buffer+0x132/0x140 [ttm]
 [<ffffffffa002032e>] ? drm_mm_insert_helper+0x11e/0x130 [drm]
 [<ffffffffa006818d>] ttm_bo_validate+0x9d/0x120 [ttm]
 [<ffffffffa0068521>] ttm_bo_init+0x311/0x3e0 [ttm]
 [<ffffffffa00a9617>] radeon_bo_create+0x1c7/0x2d0 [radeon]
 [<ffffffffa00a92e0>] ? radeon_bo_clear_va+0x80/0x80 [radeon]
 [<ffffffffa00bb401>] radeon_gem_object_create+0x61/0x100 [radeon]
 [<ffffffffa0066ac2>] ? ttm_bo_unreserve_locked+0x32/0x40 [ttm]
 [<ffffffffa00bb7ce>] radeon_gem_create_ioctl+0x5e/0xf0 [radeon]
 [<ffffffff8160a25d>] ? mutex_lock+0x1d/0x50
 [<ffffffffa00154f3>] drm_ioctl+0x4d3/0x580 [drm]
 [<ffffffff81154550>] ? mmap_region+0x2c0/0x5b0
 [<ffffffffa00bb770>] ? radeon_gem_pwrite_ioctl+0x30/0x30 [radeon]
 [<ffffffff811996c9>] do_vfs_ioctl+0x99/0x580
 [<ffffffff812793da>] ? inode_has_perm.isra.31.constprop.61+0x2a/0x30
 [<ffffffff8127a9b7>] ? file_has_perm+0x97/0xb0
 [<ffffffff81199c49>] sys_ioctl+0x99/0xa0
 [<ffffffff81614969>] system_call_fastpath+0x16/0x1b
Code: 45 b0 eb 83 0f 0b 0f 0b 0f 1f 40 00 55 48 89 e5 66 66 66 66 90 8b 46 24 48 8b 57 08 48 c1 e0 07 48 83 3e 00 48 8d 7c 02 28 74 07 <48> 8b 47 28 ff 50 18 5d c3 0f 1f 84 00 00 00 00 00 55 48 89 e5 
RIP  [<ffffffffa006567f>] ttm_bo_mem_put+0x1f/0x30 [ttm]
 RSP <ffff8800b45b7a18>

Comment 4 Fedora End Of Life 2013-07-04 04:30:16 UTC
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 5 Fedora End Of Life 2013-08-01 13:46:25 UTC
Fedora 17 changed to end-of-life (EOL) status on 2013-07-30. Fedora 17 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.