** Description changed: + SRU Justification + + Impact: The i915 driver is not holding references to DRM objects during + eviction. Thus an object could be freed while i915 is still referencing + it, which results in a kernel BUG and an xserver freeze. + + Fix: Backport of upstream fix to hold references to objects during + eviction and a related fix to object cleanup in the error paths. + + Test case: Verified on LP #843904. + + ---- + in linux-image-2.6.32-34-generic from Lucid LTS, when viewing http://www.bahnbilder.ch/pictures/original/9030.jpg in Firefox, X freezes, and dmesg shows the following: [ 2319.730128] ------------[ cut here ]------------ [ 2319.730135] kernel BUG at /build/buildd/linux-2.6.32/drivers/gpu/drm/i915/i915_gem.c:1478! - [ 2319.730138] invalid opcode: 0000 [#1] SMP + [ 2319.730138] invalid opcode: 0000 [#1] SMP [ 2319.730141] last sysfs file: /sys/devices/virtual/net/pan1/statistics/collisions - [ 2319.730143] CPU 0 + [ 2319.730143] CPU 0 [ 2319.730145] Modules linked in: btrfs zlib_deflate crc32c libcrc32c ufs qnx4 hfsplus hfs minix ntfs vfat msdos fat jfs xfs exportfs reiserfs ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack nf_defrag_ipv4 bridge stp sha256_generic cryptd aes_x86_64 aes_generic dm_crypt iptable_filter ip_tables x_tables binfmt_misc ppdev vboxnetadp vboxnetflt vboxdrv joydev snd_hda_codec_intelhdmi snd_hda_codec_realtek arc4 snd_hda_intel snd_hda_codec snd_hwdep uvcvideo iwlagn iwlcore mac80211 jmb38x_ms snd_pcm snd_timer videodev v4l1_compat v4l2_compat_ioctl32 r8169 memstick mii psmouse serio_raw sdhci_pci sdhci led_class cfg80211 snd soundcore snd_page_alloc lp parport fbcon tileblit font bitblit softcursor vga16fb vgastate i915 drm_kms_helper ahci drm i2c_algo_bit video output intel_agp [ 2319.730199] Pid: 2010, comm: compiz Not tainted 2.6.32-34-generic #76-Ubuntu 28477MG [ 2319.730201] RIP: 0010:[<ffffffffa0086ece>] [<ffffffffa0086ece>] i915_gem_object_put_pages+0x13e/0x150 [i915] [ 2319.730220] RSP: 0018:ffff880120417a38 EFLAGS: 00010246 [ 2319.730222] RAX: 0000000000000000 RBX: ffff8800b396bc00 RCX: 01000000000000c1 [ 2319.730224] RDX: 0000000000000026 RSI: 0000000000000000 RDI: ffff880139671d80 [ 2319.730226] RBP: ffff880120417a58 R08: 0000000000000000 R09: dead000000100100 [ 2319.730228] R10: dead000000200200 R11: dead000000100100 R12: ffff8800b396bc00 [ 2319.730231] R13: ffff880139671d80 R14: 0000000002e31000 R15: ffff880139e3afb0 [ 2319.730234] FS: 00007fb8ea22c760(0000) GS:ffff880028200000(0000) knlGS:0000000000000000 [ 2319.730236] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 2319.730238] CR2: 00007f9dc57ce000 CR3: 0000000127dc3000 CR4: 00000000000406f0 [ 2319.730240] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2319.730242] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 2319.730245] Process compiz (pid: 2010, threadinfo ffff880120416000, task ffff880128b996f0) [ 2319.730247] Stack: [ 2319.730248] 0000000000000000 ffff8800b396bc00 ffff880139671d80 ffff880139e0d800 [ 2319.730252] <0> ffff880120417a88 ffffffffa0088921 ffff8800b396bc00 ffff880120417aa8 [ 2319.730256] <0> ffff880120417a78 ffff880120417ab8 ffff880120417af8 ffffffffa008dc81 [ 2319.730260] Call Trace: [ 2319.730271] [<ffffffffa0088921>] i915_gem_object_unbind+0x121/0x290 [i915] [ 2319.730281] [<ffffffffa008dc81>] i915_gem_evict_something+0x2b1/0x390 [i915] [ 2319.730291] [<ffffffffa0087584>] i915_gem_object_bind_to_gtt+0x184/0x360 [i915] [ 2319.730301] [<ffffffffa00890d0>] i915_gem_object_pin+0x180/0x190 [i915] [ 2319.730311] [<ffffffffa008a56f>] i915_gem_object_pin_and_relocate+0x5f/0x3a0 [i915] [ 2319.730320] [<ffffffffa008bb6e>] i915_gem_do_execbuffer+0x53e/0xd70 [i915] [ 2319.730330] [<ffffffffa0084da4>] ? i915_gem_clflush_object+0x44/0x80 [i915] [ 2319.730335] [<ffffffff8134b71b>] ? agp_flush_chipset+0x1b/0x20 [ 2319.730353] [<ffffffffa0034819>] ? drm_agp_chipset_flush+0x19/0x20 [drm] [ 2319.730363] [<ffffffffa008c70d>] i915_gem_execbuffer+0x18d/0x360 [i915] [ 2319.730373] [<ffffffffa008d67c>] ? i915_gem_pwrite_ioctl+0x6c/0x1e0 [i915] [ 2319.730382] [<ffffffffa002def8>] drm_ioctl+0x318/0x4c0 [drm] [ 2319.730392] [<ffffffffa008a982>] ? i915_gem_fault+0xd2/0x200 [i915] [ 2319.730402] [<ffffffffa008c580>] ? i915_gem_execbuffer+0x0/0x360 [i915] [ 2319.730407] [<ffffffff81112ea4>] ? __do_fault+0x54/0x500 [ 2319.730411] [<ffffffff811544e2>] vfs_ioctl+0x22/0xa0 [ 2319.730414] [<ffffffff81154791>] do_vfs_ioctl+0x81/0x380 [ 2319.730418] [<ffffffff81545358>] ? do_page_fault+0x158/0x3b0 [ 2319.730421] [<ffffffff81154b11>] sys_ioctl+0x81/0xa0 [ 2319.730426] [<ffffffff810121b2>] system_call_fastpath+0x16/0x1b - [ 2319.730428] Code: 0a e1 eb de 66 0f 1f 84 00 00 00 00 00 e8 2b 7b 00 00 83 bb c4 00 00 00 01 0f 85 2a ff ff ff c7 43 54 00 00 00 00 e9 1e ff ff ff <0f> 0b eb fe 0f 0b eb fe 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 + [ 2319.730428] Code: 0a e1 eb de 66 0f 1f 84 00 00 00 00 00 e8 2b 7b 00 00 83 bb c4 00 00 00 01 0f 85 2a ff ff ff c7 43 54 00 00 00 00 e9 1e ff ff ff <0f> 0b eb fe 0f 0b eb fe 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 [ 2319.730460] RIP [<ffffffffa0086ece>] i915_gem_object_put_pages+0x13e/0x150 [i915] [ 2319.730469] RSP <ffff880120417a38> [ 2319.730472] ---[ end trace 0b520cfaddb649d0 ]--- This is reproducible, and did not happen in 2.6.32-32-generic. ProblemType: Bug DistroRelease: Ubuntu 10.04 Package: linux-image-2.6.32-34-generic 2.6.32-34.76 Regression: Yes Reproducible: Yes ProcVersionSignature: Ubuntu 2.6.32-34.76-generic 2.6.32.44+drm33.19 Uname: Linux 2.6.32-34-generic x86_64 AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.21. AplayDevices: Error: [Errno 2] No such file or directory Architecture: amd64 ArecordDevices: Error: [Errno 2] No such file or directory AudioDevicesInUse: - USER PID ACCESS COMMAND - /dev/snd/controlC0: rohieb 2028 F.... pulseaudio + USER PID ACCESS COMMAND + /dev/snd/controlC0: rohieb 2028 F.... pulseaudio CRDA: Error: [Errno 2] No such file or directory Card0.Amixer.info: Error: [Errno 2] No such file or directory Card0.Amixer.values: Error: [Errno 2] No such file or directory Date: Wed Sep 7 15:42:24 2011 EcryptfsInUse: Yes HibernationDevice: RESUME=UUID=5e4663af-272d-47f4-b396-8a4813415806 MachineType: LENOVO 28477MG ProcCmdLine: BOOT_IMAGE=/boot/vmlinuz-2.6.32-34-generic root=UUID=129e2abc-1682-4b83-8be5-802a35e35f16 ro noquiet splash RelatedPackageVersions: linux-firmware 1.34.10 RfKill: - 0: phy0: Wireless LAN - Soft blocked: no - Hard blocked: no + 0: phy0: Wireless LAN + Soft blocked: no + Hard blocked: no SourcePackage: linux dmi.bios.date: 06/24/2010 dmi.bios.vendor: LENOVO dmi.bios.version: 6JET81WW (1.39 ) dmi.board.name: 28477MG dmi.board.vendor: LENOVO dmi.board.version: Not Available dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: Not Available dmi.modalias: dmi:bvnLENOVO:bvr6JET81WW(1.39):bd06/24/2010:svnLENOVO:pn28477MG:pvrThinkPadSL510:rvnLENOVO:rn28477MG:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable: dmi.product.name: 28477MG dmi.product.version: ThinkPad SL510 dmi.sys.vendor: LENOVO
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/843904 Title: X freeze on i915_gem.c line 1478 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/843904/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
