es2_info crashed with SIGSEGV in nv50_screen_fence_update()

[homix]

[Impact]
Users running the nouveau X driver with the egl_dri2 mesa driver may experience a windowing system crash (kwin_gles, etc.) in the nv50_screen_fence_update() routine.

[Development Fix]
The problem was fixed upstream in mesa 8.0 which we are shipping in Precise. The patch switches from using a context object for flushing purposes, to a screen object; the context object can go NULL sometimes which leads to the crash.

[Stable Fix]
Upstream also created a backport of the mesa 8.0 patch to 7.11, although at time of writing this was not yet released in a 7.11.x point release. The patch applies cleanly to the oneiric mesa and is what we're using for this SRU.

[Text Case]
1. install nouveau video driver
2. call /usr/bin/es2_info from mesa-utils-extra
Broken Behavior: application crashes
Fixed Behavior: egl information is printed out

[Regression Potential]
The scope of this patch is limited to nouveau (and specifically to newer NVIDIA cards of the 8xxx series and up). Indeed it probably has no effect on non-egl window systems (like Unity/Compiz), so the scope is probably quite small.

Since the patch is included upstream as part of the mesa 8.0 tree, and is selected for the 7.11 stable series, the patch is likely quite safe. If there were any regressions caused by this, I would expect symptoms similar to the original bug (i.e. crashes).

[Original Report]
called /usr/bin/es2_info from mesa-utils-extra

ProblemType: Crash
DistroRelease: Ubuntu 11.10
Package: mesa-utils-extra 8.0.1+git20110129+d8f7d6b-0ubuntu2
ProcVersionSignature: Ubuntu 3.0.0-15.26-generic 3.0.13
Uname: Linux 3.0.0-15-generic x86_64
ApportVersion: 1.23-0ubuntu4
Architecture: amd64
Date: Sat Feb 4 23:52:38 2012
ExecutablePath: /usr/bin/es2_info
InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Release amd64 (20111012)
ProcCmdline: es2_info
SegvAnalysis:
 Segfault happened at: 0x7fcea9943fa7: mov (%rax),%eax
 PC (0x7fcea9943fa7) ok
 source "(%rax)" (0x7fceacc81000) not located in a known VMA region (needed readable region)!
 destination "%eax" ok
SegvReason: reading unknown VMA
Signal: 11
SourcePackage: mesa-demos
StacktraceTop:
 ?? () from /usr/lib/x86_64-linux-gnu/egl/egl_gallium.so
 nouveau_fence_update () from /usr/lib/x86_64-linux-gnu/egl/egl_gallium.so
 nv50_default_flush_notify () from /usr/lib/x86_64-linux-gnu/egl/egl_gallium.so
 nouveau_pushbuf_flush () from /usr/lib/x86_64-linux-gnu/libdrm_nouveau.so.1
 nouveau_grobj_free () from /usr/lib/x86_64-linux-gnu/libdrm_nouveau.so.1
Title: es2_info crashed with SIGSEGV in nouveau_fence_update()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare users

[Philipp-dev (philipp-dev)]

Created attachment 54024
backtrace of the crash

Nouveau in the combination with the egl_dri2 driver crashes in the aforementioned function. The egl_gallium driver seems to work fine (tested with Mesa 7.11.2), but this driver is unfortunately not shipped with fedora.

As the bug vanishes if I use the latest Mesa 7.12-devel (git-ccd4d43), I would suggest that some of the patches that substitute the function nv50_screen_fence_update are ported back to 7.11.

Thanks a lot.

For completeness: I'm using a nvidia NVS 3100M and the fedora 2.6.41 kernel.

[Marcin Slusarz (marcin-slusarz)]

Created attachment 54088
simple fix

Cherry-picking 3069a7eaa5d83e7f41616347ba244c0dc0d944ae (and 27e77cb902b4f7f5e127dcd78951e3167f13d59c) to 7.11 should fix it.

Alternatively we could apply attached patch.

Can you verify both patches fix your crash?

[Philipp-dev (philipp-dev)]

The attached patch as well as the commit 3069a7eaa5d83e7f41616347ba244c0dc0d944ae fix the bug. The commit 3069a7ea seems to be sufficient, what also explains why it even worked with mesa master before you commited 27e77cb902b4f7f5e127dcd78951e3167f13d59c. Thanks a lot :)

[Marcin Slusarz (marcin-slusarz)]

Commited to 7.11. Thanks.

[Apport retracing service (apport)]

StacktraceTop:
 nv50_screen_fence_update (pscreen=0x25fe0d0) at nv50_screen.c:269
 nouveau_fence_update (screen=0x25fe0d0, flushed=1 '\001') at nouveau_fence.c:141
 nv50_default_flush_notify (chan=<optimized out>) at nv50_context.c:68
 nouveau_pushbuf_flush (chan=0x25fe480, min=0) at ../../nouveau/nouveau_pushbuf.c:276
 FIRE_RING (chan=0x25fe480) at ../../nouveau/nouveau_pushbuf.h:101

[Robert Hooker (sarvatt)]

The fix from mesa 7.11 branch post 7.11.2, not in any 7.11.x upstream release yet but is included in 8.0 which is in precise:

http://cgit.freedesktop.org/mesa/mesa/commit/?h=7.11&id=0e9b79c22a53efb8413ba6b4e49085a08221a5d3

[Martin Pitt (pitti)]

Hello homix, or anyone else affected,

Accepted mesa into oneiric-proposed. The package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

[Robert Hooker (sarvatt)]

The wrong patch was applied to this SRU and wouldn't fix the bug, an intel fix was used instead of the nouveau one.

[Bryce Harrington (bryce)]

I've re-uploaded the package with the proper fix.

[Adam Conrad (adconrad)]

Hello homix, or anyone else affected,

Accepted mesa into oneiric-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/mesa/7.11-0ubuntu3.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from verification-needed to verification-done. If it does not, change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Ubuntu Foundations Team Bug Bot (crichton)]

The fix for the this bug has been awaiting testing feedback in the -proposed repository for oneiric for more than 90 days. Please test this fix and update the bug appropriately with the results. In the event that the fix for this bug is still not verified 15 days from now the package will be removed from the -proposed repository.

[Brian Murray (brian-murray)]

The version of mea in oneiric-proposed has been removed as this bug report was not verified in a timely fashion.

[Rolf Leggewie (r0lf)]

oneiric has seen the end of its life and is no longer receiving any updates. Marking the oneiric task for this ticket as "Won't Fix".