crash in drm_intel_gem_bo_start_gtt_access

Bug #354688 reported by Steve Langasek on 2009-04-03
102
This bug affects 6 people
Affects Status Importance Assigned to Milestone
xf86-video-intel
Fix Released
Medium
xserver-xorg-video-intel (Ubuntu)
Medium
Bryce Harrington
Jaunty
Medium
Bryce Harrington

Bug Description

Binary package hint: xorg

X crashed while trying to launch a just-downloaded mp3 file using totem. Backtrace in /var/log/gdm/:0.log.1.

Backtrace:
0: /usr/X11R6/bin/X(xorg_backtrace+0x26) [0x4f1b36]
1: /usr/X11R6/bin/X(xf86SigHandler+0x41) [0x485a61]
2: /lib/libc.so.6 [0x7f444f58f040]
3: /usr/lib/libdrm_intel.so.1(drm_intel_gem_bo_start_gtt_access+0x38) [0x7f444d5a73a8]
4: /usr/lib/xorg/modules/drivers//intel_drv.so [0x7f444d7e2483]
5: /usr/lib/xorg/modules/drivers//intel_drv.so [0x7f444d7e75fe]
6: /usr/X11R6/bin/X [0x49c416]
7: /usr/lib/xorg/modules/extensions//libextmod.so [0x7f444e6ed59b]
8: /usr/X11R6/bin/X(Dispatch+0x364) [0x44e304]
9: /usr/X11R6/bin/X(main+0x3bd) [0x433d8d]
10: /lib/libc.so.6(__libc_start_main+0xe6) [0x7f444f57a5a6]
11: /usr/X11R6/bin/X [0x433219]
Saw signal 11. Server aborting.
 ddxSigGiveUp: Closing log
 ddxSigGiveUp: re-raising 11

No crash file was generated. (Hmm, apport limits crash files to 200 MB - could that be the reason?)

ProblemType: Bug
Architecture: amd64
DistroRelease: Ubuntu 9.04
Package: xserver-xorg 1:7.4~5ubuntu17
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersion: Linux version 2.6.28-11-generic (buildd@crested) (gcc version 4.3.3 (Ubuntu 4.3.3-5ubuntu4) ) #38-Ubuntu SMP Fri Mar 27 10:01:17 UTC 2009
SourcePackage: xorg
Uname: Linux 2.6.28-11-generic x86_64

Steve Langasek (vorlon) wrote :
Steve Langasek (vorlon) wrote :

Readily reproducible for me here, so if more info is needed, let me know.

The crash appears (based on a disassembly of the function with gdb - nothing so proper as catching a crash in action) to be happening at the line

    set_domain.handle = bo_gem->gem_handle;

when dereferencing bo_gem.

tags: added: regression-potential
Steve Langasek (vorlon) on 2009-04-03
Changed in xorg (Ubuntu):
importance: Undecided → High
status: New → Confirmed
VangelistX (vangelistx) wrote :

Please have a look at that bug:

https://bugs.launchpad.net/ubuntu/+source/xorg/+bug/354735

Maybe is the same one?

Steve Langasek (vorlon) wrote :

No, these bugs don't appear to have any relation to one another.

Steve Langasek (vorlon) wrote :

Have twiddled a few knobs, and:

 (EE) intel(0): Cannot support DRI with frame buffer width > 2048.

this message in Xorg.0.log appears to be key. If I lower the virtual res in xorg.conf, I don't get the crash. If I subsequently set NoAccel, I still don't get the crash. It's only when I have my usual virtual res set (2960x1850) do I see the error. (This system doesn't work with UXA, so don't ask me to test that. :)

The first time I try to run totem, it errors out with this message:

The program 'totem' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
  (Details: serial 76 error_code 11 request_code 132 minor_code 19)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)

There is a corresponding error in Xorg.0.log:

 (EE) intel(0): Failed to pin xv buffer

And then the second totem invocation will crash X.

Changed in xorg (Ubuntu Jaunty):
importance: High → Medium
Bryce Harrington (bryce) wrote :

Steve, thanks for chasing it down in gdb, but could you also put a trace onto this bug report?

Heh, of course as fate would have it, there's three exact instances of that line. Smells like a nullptr deref but a full backtrace would help in sorting it out.

Steve Langasek (vorlon) wrote :

A backtrace from gdb looks the same as the backtrace included in the bug description. Is there more specific information that you're looking for?

I had a closer look at the disassembly, the segfault is actually in the line

        ret = ioctl(bufmgr_gem->fd, DRM_IOCTL_I915_GEM_SET_DOMAIN, &set_domain);

when resolving bufmgr_gem->fd.

This bug was originally reported at https://bugs.launchpad.net/ubuntu/jaunty/+source/xserver-xorg-video-intel/+bug/354688

xf86-video-intel 2.6.3

X crashed while trying to launch a just-downloaded mp3 file using totem.

The crash only occurred with virtual display set to >2048 width. Without the virtual display setting, the crash did not occur.

The first time I try to run totem, it errors out with this message:

The program 'totem' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
  (Details: serial 76 error_code 11 request_code 132 minor_code 19)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)

There is a corresponding error in Xorg.0.log:

(EE) intel(0): Failed to pin xv buffer

And then the second totem invocation will crash X.

Xorg.0.log also contains the error:
(EE) intel(0): Cannot support DRI with frame buffer width > 2048

Created an attachment (id=24573)
xorg.conf

Created an attachment (id=24574)
Full backtrace

The problem is in xxv-intel, src/i830_video.c
In I830PutImage:
    if (pPriv->buf == NULL) {
        pPriv->buf = drm_intel_bo_alloc(pI830->bufmgr,
                                        "xv buffer", alloc_size, 4096);
        if (pPriv->buf == NULL)
            return BadAlloc;
        if (!pPriv->textured && drm_intel_bo_pin(pPriv->buf, 4096) != 0) {
            drm_intel_bo_unreference(pPriv->buf);
            xf86DrvMsg(pScrn->scrnIndex, X_ERROR,
                       "Failed to pin xv buffer\n");
            return BadAlloc;
        }
    }

The first time totem is run, pPriv->buf is NULL, a buffer is allocated and, given the failed to pin error message, pPriv->buf is now not NULL. drm_intel_bo_unreference frees the buffer, but does not set pPriv->buf back to NULL.
Therefore, next time totem is run, -intel will think we have a valid xv buffer and crash.

Attached patch solves the problem and makes totem return the BadAlloc error message every time. X no longer crashes.

Created an attachment (id=24575)
Proposed fix

Albert Damen (albrt) wrote :

I was able to reproduce this on my 945 and got a full backtrace.

Albert Damen (albrt) wrote :

The problem is in xxv-intel, src/i830_video.c
In I830PutImage:
    if (pPriv->buf == NULL) {
        pPriv->buf = drm_intel_bo_alloc(pI830->bufmgr,
                                        "xv buffer", alloc_size, 4096);
        if (pPriv->buf == NULL)
            return BadAlloc;
        if (!pPriv->textured && drm_intel_bo_pin(pPriv->buf, 4096) != 0) {
            drm_intel_bo_unreference(pPriv->buf);
            xf86DrvMsg(pScrn->scrnIndex, X_ERROR,
                       "Failed to pin xv buffer\n");
            return BadAlloc;
        }
    }

The first time totem is run, pPriv->buf is NULL, a buffer is allocated and, given the failed to pin error message, pPriv->buf is now not NULL. drm_intel_bo_unreference frees the buffer, but does not set pPriv->buf back to NULL.
Therefore, next time totem is run, -intel will think we have a valid xv buffer and crash.

Attached patch solves the problem and makes totem return the BadAlloc error message every time. X no longer crashes.

As the same problem exists in git master, I will forward the bug and patch upstream.

affects: xorg (Ubuntu Jaunty) → xserver-xorg-video-intel (Ubuntu Jaunty)

Setting virtual >2048 on 945 results in DRI disabled.

Bryce Harrington (bryce) wrote :

Hi Steve, actually what I meant was I needed a full backtrace, like what Albert attached, sorry I wasn't more specific... been a long week.

Albert, thanks muchly for the analysis and patch. It looks good and I'll upload it tomorrow. Meanwhile please do see if you can get upstream's comment on it and let us know the bug number for future reference.

I've pulled albert's patch in for Ubuntu Jaunty, after jbarnes took a quick look and gave a thumbs up. Would be most comfortable in that choice if this patch made it into the upstream tree as well.

Steve Beattie (sbeattie) on 2009-04-06
Changed in xserver-xorg-video-intel (Ubuntu Jaunty):
assignee: nobody → canonical-desktop-team
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package xserver-xorg-video-intel - 2:2.6.3-0ubuntu7

---------------
xserver-xorg-video-intel (2:2.6.3-0ubuntu7) jaunty; urgency=low

  * Add 119_drm_bo_unreference_needs_null.patch:
    - The first time through the Xv code, an allocated buffer is
      unreferenced but the pointer is not reset to NULL. Thus, the next time
      a video is played, -intel thinks it has a valid buffer and crashes
      when it tries to access the freed memory. Fixes a number of crashes
      reported since moving to the 2.6.3 driver.
    - Fixes crash on i945 with frame buffer width > 2048. DRI is disabled
      on this chipset when the frame buffer exceeds this width.
      (LP: #354688)
    - Fixes crash on i865 where DRI is off because of patch 116
      (LP: #352760)
    - Fixes crash on i845 starting after 304871 was fixed
      (LP: #354889)
    - Fixes crash on i830 when manually disabling DRI
      (LP: #347527)

 -- Bryce Harrington <email address hidden> Mon, 06 Apr 2009 14:28:29 -0700

Changed in xserver-xorg-video-intel (Ubuntu Jaunty):
status: Confirmed → Fix Released
Changed in xserver-xorg-video-intel:
status: Unknown → Confirmed

Nice to see this one fixed.

Changed in xserver-xorg-video-intel (Ubuntu Jaunty):
assignee: canonical-desktop-team → bryceharrington
nowardev (nowardev) wrote :

in the server kernel we still have this problem but with generic and rt kernel it works fine here i have attached my lspci and other stuff anyway for me now there is not this problem anymore

https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/356088

Björn Tillenius (bjornt) wrote :

The issue I reported in bug 353023 is still not quite fixed. I don't get any crashes anymore, but I still can't play video, neither in mplayer nor in totem. Should I file a new bug about that?

I'm attaching my new Xorg.0.log file.

IcedEarth (hartley-rat) wrote :

Me too, as in regard to Bug #351869. I have updated to the new xserver-xorg-video-intel this morning, (2:2.6.3-0ubuntu8) still unable to play video in VLC, totem etc.

Totem:

The program 'totem' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
  (Details: serial 82 error_code 11 request_code 132 minor_code 19)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)

VLC:

[????????] x11 video output error: X11 request 132.19 failed with error code 11:
 BadAlloc (insufficient resources for operation)
X Error of failed request: BadAlloc (insufficient resources for operation)
  Major opcode of failed request: 132 (XVideo)
  Minor opcode of failed request: 19 ()
  Serial number of failed request: 81
  Current serial number in output stream: 82

sorry cannot provide more information, cant use gdb yet.

I also can't play any video format at any video player (totem, kaffeine, mplayer, vlc, miro...). The outputs are the same presented by IcedEarth.

Workaround to get it working: open gstreamer-properties. Then, Video tab, Default Output section. Change the Plugin from "Autodetect" to "X Window System (No Xv)" and close. This way, totem will play any video format, but the other players still not working.

# uname -a
Linux laptop 2.6.28-11-generic #42-Ubuntu SMP Fri Apr 17 01:58:03 UTC 2009 x86_64 GNU/Linux

# lspci
00:02.0 VGA compatible controller: Intel Corporation Mobile 945GM/GMS, 943/940GML Express Integrated Graphics Controller (rev 03)

# dpkg -l | grep xorg-video-intel
ii xserver-xorg-video-intel 2:2.6.3-0ubuntu9 X.Org X server -- Intel i8xx, i9xx display driver

I just updated my system (aptitude update & full-upgrade).

Is it necessary a full backtrace?

*** Bug 21326 has been marked as a duplicate of this bug. ***

Changed in xserver-xorg-video-intel:
status: Confirmed → Fix Released
Bob McElrath (bob+ubuntu) wrote :

I confirm João's comment above. With the official jaunty release 2.6.3-0ubuntu9, video players crash when directed to use xv. Telling gstreamer not to use xv works around it.

In my case, video in vlc/mplayer/totem works fine initially, but if one forces a repaint of the screen, X will crash. In particular, hitting the hardware volume knobs (which cause a popup window with the volume level to appear overlaid on the video) causes the video to freeze and then X to crash.

Is this the same bug or is the original bug here truly fixed?

Sampe (samuel-rodelius) wrote :

I just installed this update:
replacing: xserver-xorg-video-intel 2:2.6.3-0ubuntu9 (with .../xserver-xorg-video-intel_2%3a2.6.3-0ubuntu9.1_amd64.deb
It does NOT solve this bug, though I'am not sure it should but at least you now it is still there in the xserver-xorg-video-intel_2%3a2.6.3-0 package...

Evan Carroll (evancarroll) wrote :

Changing back to confirmed, there is not yet a fix (bug still occurs in a new install) there is a workaround as mentioned in
https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/354688/comments/16

Changed in xserver-xorg-video-intel (Ubuntu Jaunty):
status: Fix Released → Confirmed
Steve Langasek (vorlon) wrote :

The crash bug *is* fixed. Other issues should be filed as separate reports (if they aren't already).

Changed in xserver-xorg-video-intel (Ubuntu Jaunty):
status: Confirmed → Fix Released
Changed in xserver-xorg-video-intel:
importance: Unknown → Medium
Changed in xserver-xorg-video-intel:
importance: Medium → Unknown
Changed in xserver-xorg-video-intel:
importance: Unknown → Medium
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.