Bug 814611 - SIGSEGV in intel dri driver
Summary: SIGSEGV in intel dri driver
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: mesa
Version: 17
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Adam Jackson
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-04-20 09:03 UTC by Paolo Bonzini
Modified: 2013-07-31 17:43 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-07-31 17:43:10 UTC
Type: Bug


Attachments (Terms of Use)

Description Paolo Bonzini 2012-04-20 09:03:30 UTC
Description of problem:
After leaving the computer unattended for a few hours, all GL apps started crashing.  "Fixed" just by restarting the X server.

Version-Release number of selected component (if applicable):
8.0.1-9.fc17

How reproducible:
once only

Steps to Reproduce:
unknown
  
Additional info:
backtrace produced respectively by mutter and glxgears:

(gdb) bt
#0  brw_update_renderbuffer_surface (brw=0x783ac0, rb=0x14e0f20, unit=0) at brw_wm_surface_state.c:919
#1  0x00007ffff0a18970 in brw_update_renderbuffer_surfaces (brw=0x783ac0) at brw_wm_surface_state.c:1016
#2  0x00007ffff0a02c40 in brw_upload_state (brw=brw@entry=0x783ac0) at brw_state_upload.c:503
#3  0x00007ffff09f0797 in brw_try_draw_prims (max_index=<optimized out>, min_index=<optimized out>, ib=0x0, nr_prims=1, prim=0x7fffffffd5d0, arrays=0x7f84b8, ctx=0x783ac0) at brw_draw.c:482
#4  brw_draw_prims (ctx=0x783ac0, arrays=0x7f84b8, prim=0x7fffffffd5d0, nr_prims=1, ib=0x0, index_bounds_valid=<optimized out>, min_index=0, max_index=3, tfb_vertcount=0x0) at brw_draw.c:566
#5  0x00007ffff0b147b3 in vbo_draw_arrays (ctx=0x783ac0, mode=7, start=0, count=4, numInstances=1) at vbo/vbo_exec_array.c:600
#6  0x00000039ada57216 in _cogl_journal_flush_modelview_and_entries (batch_start=<optimized out>, batch_len=1, data=0x7fffffffd7e0) at ./cogl-journal.c:315
#7  0x00000039ada56d2c in _cogl_journal_flush_vbo_offsets_and_entries (batch_start=0x1555000, batch_len=1, data=<optimized out>) at ./cogl-journal.c:667
#8  0x00000039ada56946 in _cogl_journal_flush_clip_stacks_and_entries (batch_start=0x1555000, batch_len=1, data=0x7fffffffd7e0) at ./cogl-journal.c:746
#9  0x00000039ada58149 in _cogl_journal_flush (journal=<optimized out>) at ./cogl-journal.c:1452
#10 0x00000039ada5953c in _cogl_framebuffer_flush_journal (framebuffer=framebuffer@entry=0x14dd010) at ./cogl-framebuffer.c:637
#11 0x00000039ada5ab4f in cogl_framebuffer_clear4f (framebuffer=0x14dd010, buffers=3, red=1, green=1, blue=1, alpha=1) at ./cogl-framebuffer.c:423
#12 0x00000039ad69ea5d in ?? () from /lib64/libclutter-1.0.so.0
#13 0x00000037e7e0f923 in _g_closure_invoke_va (closure=closure@entry=0x14da9c0, return_value=return_value@entry=0x0, instance=instance@entry=0x14dd510, args=args@entry=0x7fffffffdc18, n_params=0, param_types=
    0x0) at gclosure.c:840
#14 0x00000037e7e27d68 in g_signal_emit_valist (instance=0x14dd510, signal_id=<optimized out>, detail=0, var_args=var_args@entry=0x7fffffffdc18) at gsignal.c:3207
#15 0x00000037e7e287a2 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3352
#16 0x00000039ad64134d in clutter_actor_continue_paint () from /lib64/libclutter-1.0.so.0
#17 0x00000039ad650233 in ?? () from /lib64/libclutter-1.0.so.0
#18 0x00000039ad6a2979 in ?? () from /lib64/libclutter-1.0.so.0
#19 0x00000039ad63963a in ?? () from /lib64/libclutter-1.0.so.0
#20 0x00000039ad6a15f3 in ?? () from /lib64/libclutter-1.0.so.0
#21 0x00000039ad6879dd in ?? () from /lib64/libclutter-1.0.so.0
#22 0x00000037e6e475bc in g_main_dispatch (context=0x623470) at gmain.c:2515
#23 g_main_context_dispatch (context=context@entry=0x623470) at gmain.c:3052
#24 0x00000037e6e479d8 in g_main_context_iterate (context=0x623470, block=block@entry=1, dispatch=dispatch@entry=1, self=<error reading variable: Unhandled dwarf expression opcode 0xfa>) at gmain.c:3123
#25 0x00000037e6e47dd2 in g_main_loop_run (loop=0x624860) at gmain.c:3317
#26 0x00000039aca54237 in meta_run () at core/main.c:555
#27 0x0000000000400e56 in main (argc=1, argv=0x7fffffffe3c8) at core/mutter.c:96
(gdb) p irb
$1 = (struct intel_renderbuffer *) 0x14e0f20
(gdb) p irb->mt
$2 = (struct intel_mipmap_tree *) 0x0


yakj:~ pbonzini$ DISPLAY=:0 gdb --args glxgears
GNU gdb (GDB) Fedora (7.4.50.20120120-35.fc17)
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/glxgears...(no debugging symbols found)...done.
Missing separate debuginfos, use: debuginfo-install glx-utils-7.10-6.20101028.fc17.x86_64
(gdb) r
Starting program: /usr/bin/glxgears
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Running synchronized to the vertical refresh.  The framerate should be
approximately the same as the monitor refresh rate.

Program received signal SIGSEGV, Segmentation fault.
brw_update_renderbuffer_surface (brw=0x7ffff7fdc040, rb=0x616540, unit=0) at brw_wm_surface_state.c:919
919        struct intel_region *region = irb->mt->region;
(gdb) bt
#0  brw_update_renderbuffer_surface (brw=0x7ffff7fdc040, rb=0x616540, unit=0) at brw_wm_surface_state.c:919
#1  0x00007ffff7a1c970 in brw_update_renderbuffer_surfaces (brw=0x7ffff7fdc040) at brw_wm_surface_state.c:1016
#2  0x00007ffff7a06c40 in brw_upload_state (brw=brw@entry=0x7ffff7fdc040) at brw_state_upload.c:503
#3  0x00007ffff79f4797 in brw_try_draw_prims (max_index=<optimized out>, min_index=<optimized out>, ib=0x0, nr_prims=2, prim=0x7f08c0, arrays=0x67bef0, ctx=0x7ffff7fdc040) at brw_draw.c:482
#4  brw_draw_prims (ctx=0x7ffff7fdc040, arrays=0x67bef0, prim=0x7f08c0, nr_prims=2, ib=0x0, index_bounds_valid=<optimized out>, min_index=0, max_index=161, tfb_vertcount=0x0) at brw_draw.c:566
#5  0x00007ffff7b2836f in vbo_save_playback_vertex_list (ctx=0x7ffff7fdc040, data=0x7f0128) at vbo/vbo_save_draw.c:298
#6  0x00007ffff7a73602 in ext_opcode_execute (node=0x7f0120, ctx=0x7ffff7fdc040) at main/dlist.c:602
#7  execute_list (ctx=0x7ffff7fdc040, list=<optimized out>) at main/dlist.c:7468
#8  0x00007ffff7a76f2a in _mesa_CallList (list=1) at main/dlist.c:8885

Comment 1 Lukas Zapletal 2013-01-16 22:57:38 UTC
I am experiencing the same error after Fedora 18 upgrade. After some time (no hibernation/suspend or even screen saver), I am not able to run any OpenGL app.

#rpm -qa kernel xorg-x11-server-Xorg xorg-x11-drv-intel
xorg-x11-drv-intel-2.20.16-1.fc18.i686
xorg-x11-drv-intel-2.20.16-1.fc18.x86_64
kernel-3.7.2-201.fc18.x86_64
xorg-x11-server-Xorg-1.13.1-4.fc18.x86_64

Comment 2 Paolo Bonzini 2013-01-17 12:22:58 UTC
I think this is a different issue and caused by the kernel.  Downgrading to kernel 3.6.x works for me, while 3.7.x crashes in <20 minutes.

The journal has:

kernel: [drm:i915_hangcheck_hung] *ERROR* Hangcheck timer elapsed... GPU hung
kernel: [drm] capturing error event; look for more information in /debug/dri/0/i915_error_state
kernel: [drm:i915_hangcheck_hung] *ERROR* Hangcheck timer elapsed... GPU hung
kernel: [drm:init_ring_common] *ERROR* render ring initialization failed ctl 0001f001 head 00003000 tail 00000000 start 00003000
kernel: [drm:i915_hangcheck_hung] *ERROR* Hangcheck timer elapsed... GPU hung
kernel: [drm:i915_reset] *ERROR* GPU hanging too fast, declaring wedged!
kernel: [drm:i915_reset] *ERROR* Failed to reset chip.
kernel: ------------[ cut here ]------------
kernel: kernel BUG at drivers/gpu/drm/i915/i915_gem.c:3476!
kernel: invalid opcode: 0000 [#1] SMP 
kernel: Modules linked in: fuse ebtable_nat ebtables xt_CHECKSUM iptable_mangle bridge stp llc rfcomm xt_physdev xt_recent ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack ipt_MASQUERADE ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack bnep snd_hda_codec_conexant snd_hda_intel snd_hda_codec snd_hwdep arc4 iwldvm snd_seq uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_core i915 videodev media snd_seq_device snd_pcm i2c_algo_bit mac80211 drm_kms_helper drm iTCO_wdt i2c_i801 coretemp thinkpad_acpi btusb i2c_core iTCO_vendor_support lpc_ich r592 snd_page_alloc snd_timer snd iwlwifi mei cfg80211 e1000e bluetooth memstick mfd_core joydev tpm_tis ppdev microcode video parport_pc parport wmi soundcore rfkill vhost_net tun macvtap macvlan
kernel:  kvm_intel kvm nfsd ecryptfs auth_rpcgss encrypted_keys nfs_acl lockd sunrpc trusted tpm tpm_bios binfmt_misc uinput firewire_ohci sdhci_pci firewire_core sdhci yenta_socket crc_itu_t mmc_core ata_generic pata_acpi
kernel: CPU 0 
kernel: Pid: 616, comm: Xorg Not tainted 3.7.2-201.fc18.x86_64 #1 LENOVO 2241B48/2241B48
kernel: RIP: 0010:[<ffffffffa0509847>]  [<ffffffffa0509847>] i915_gem_object_unpin+0x47/0x50 [i915]
kernel: RSP: 0018:ffff88007086b938  EFLAGS: 00010246
kernel: RAX: ffff880077ed4000 RBX: ffff880077b2d000 RCX: 0000000000000000
kernel: RDX: 0000000000000002 RSI: 0000000000070008 RDI: ffff880065d97400
kernel: RBP: ffff88007086b938 R08: 0000000000000028 R09: 0000000000000006
kernel: R10: ffffffffa0554360 R11: 0000000000000004 R12: ffff880037a02800
kernel: R13: ffff880037a02820 R14: 0000000000000000 R15: ffff880037a02800
kernel: FS:  00007f79df400940(0000) GS:ffff88007c200000(0000) knlGS:0000000000000000
kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
kernel: CR2: 00007f33bd689e10 CR3: 0000000071356000 CR4: 00000000000007f0
kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
kernel: DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
kernel: Process Xorg (pid: 616, threadinfo ffff88007086a000, task ffff880077ebdc80)
kernel: Stack:
kernel:  ffff88007086b948 ffffffffa051af5e ffff88007086b978 ffffffffa051e7e6
kernel:  ffff880073c9d7d8 ffff880077b2d000 0000000000000001 ffff880037a02c50
kernel:  ffff88007086bc08 ffffffffa05213d2 ffff880000000001 000000008121aaa8
kernel: Call Trace:
kernel:  [<ffffffffa051af5e>] intel_unpin_fb_obj+0x3e/0x40 [i915]
kernel:  [<ffffffffa051e7e6>] intel_crtc_disable+0x96/0x130 [i915]
kernel:  [<ffffffffa05213d2>] intel_set_mode+0x262/0xa50 [i915]
kernel:  [<ffffffff8121d0fc>] ? ext4_dirty_inode+0x3c/0x60
kernel:  [<ffffffff8125b012>] ? jbd2_journal_stop+0x1b2/0x2a0
kernel:  [<ffffffff81237c56>] ? __ext4_journal_stop+0x76/0xa0
kernel:  [<ffffffff8121b96d>] ? ext4_da_write_end+0x9d/0x350
kernel:  [<ffffffff812f18c1>] ? vsnprintf+0x461/0x600
kernel:  [<ffffffff812f1b04>] ? snprintf+0x34/0x40
kernel:  [<ffffffffa0521d11>] ? intel_crtc_set_config+0x151/0x970 [i915]
kernel:  [<ffffffffa05222d6>] intel_crtc_set_config+0x716/0x970 [i915]
kernel:  [<ffffffff81131251>] ? __generic_file_aio_write+0x1d1/0x3d0
kernel:  [<ffffffffa03b92a6>] drm_framebuffer_remove+0xc6/0x150 [drm]
kernel:  [<ffffffffa03bcc95>] drm_mode_rmfb+0xd5/0xe0 [drm]
kernel:  [<ffffffffa03ac4a3>] drm_ioctl+0x4d3/0x580 [drm]
kernel:  [<ffffffffa03bcbc0>] ? drm_mode_addfb2+0x6d0/0x6d0 [drm]
kernel:  [<ffffffff81194d57>] ? do_sync_write+0xa7/0xe0
kernel:  [<ffffffff811d35bb>] ? fsnotify+0x24b/0x340
kernel:  [<ffffffff811a64e9>] do_vfs_ioctl+0x99/0x580
kernel:  [<ffffffff811a6a61>] sys_ioctl+0x91/0xb0
kernel:  [<ffffffff81195752>] ? sys_write+0x52/0xa0
kernel:  [<ffffffff8163dad9>] system_call_fastpath+0x16/0x1b
kernel: Code: 00 74 2a 89 d0 83 e2 0f c0 e8 04 83 e8 01 83 e0 0f 89 c1 c1 e1 04 09 ca 84 c0 88 97 e9 00 00 00 75 07 80 a7 ea 00 00 00 fb 5d c3 <0f> 0b 0f 0b 0f 1f 44 00 00 66 66 66 66 90 55 48 89 e5 41 57 41 
kernel: RIP  [<ffffffffa0509847>] i915_gem_object_unpin+0x47/0x50 [i915]
kernel:  RSP <ffff88007086b938>


The "ctl 0001f001 head 00003000 tail 00000000 start 00003000" part is always the same, and the BUG is only there in 3.7.2-201.fc18.x86_64.

Comment 3 Fedora End Of Life 2013-07-03 19:21:12 UTC
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 4 Fedora End Of Life 2013-07-31 17:43:14 UTC
Fedora 17 changed to end-of-life (EOL) status on 2013-07-30. Fedora 17 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.