Bug 67156

Summary: [ILK bisected] “Call Trace” when run GLbenchmark v2.7.0 TRex_FixedTimeStep_Offscreen
Product: DRI Reporter: meng <mengmeng.meng>
Component: DRM/IntelAssignee: Daniel Vetter <daniel>
Status: CLOSED FIXED QA Contact: Intel GFX Bugs mailing list <intel-gfx-bugs>
Severity: major    
Priority: high CC: ben, gordon.jin, guang.a.yang
Version: unspecified   
Hardware: All   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:
Attachments:
Description Flags
Xorg.0.log
none
dmesg.log
none
fix error cleanup in bind_to_gtt none

Description meng 2013-07-22 07:29:05 UTC 
System Environment:       
----------------------------------------------
Platform: Ironlake
Libdrm:	  (master)libdrm-2.4.46-2-gfea5408098c3c3057958e85ea9d7146f0b08749e
Mesa:     (master)cd90ebefd4f63d00eb65af6069fb078e454c43f1
Xserver:  (master)xorg-server-1.14.99.1-137-g74469895e39fa38337f59e
Xf86_video_intel: (master)2.21.12-36-g2c78403cb56841f342692b97bb53e995c
Kernel:	  (drm-intel-next-queued) 7984211ee8e1fa03cd4bc9ef3d347f94f8a2c8a8

Bug detailed description:
----------------------------------------------
“Call Trace” when run GLbenchmark v2.7.0 TRex_FixedTimeStep_Offscreen on Ironlake. If the problem appears, the game would park in a frame and X can’t be restarted.The problem exists on X raw and gnome-session. Please see dmesg and Xorg.0.log attached.
It’s kernel drm-intel-next-queued regression, bisecting show the first bad commit is that:
commit 2f63315692b1d3c055972ad33fc7168ae908b97b
Author: Ben Widawsky <ben@bwidawsk.net>
Date:   Wed Jul 17 12:19:03 2013 -0700
    drm/i915: Create VMAs
    Formerly: "drm/i915: Create VMAs (part 1)"

Call Trace:
----------------
[   84.645970]  [<ffffffffa00998d7>] ? i915_gem_object_pin+0x453/0x4de [i915]
[   84.646002]  [<ffffffffa0099dfe>] ? i915_gem_pwrite_ioctl+0x1c6/0x793 [i915]
[   84.646034]  [<ffffffffa0099b7f>] ? i915_gem_fault+0x105/0x1be [i915]
[   84.646061]  [<ffffffff810ae42d>] ? __do_fault+0xac/0x3bb
[   84.646090]  [<ffffffffa009857a>] ? i915_gem_set_domain_ioctl+0x19c/0x1b4 [i915]
[   84.646122]  [<ffffffffa002d4e7>] ? drm_ioctl+0x2b7/0x3c0 [drm]
[   84.646150]  [<ffffffffa0099c38>] ? i915_gem_fault+0x1be/0x1be [i915]
[   84.646180]  [<ffffffff816f4a94>] ? __do_page_fault+0x3a4/0x3ed
[   84.646204]  [<ffffffff810dd818>] ? do_vfs_ioctl+0x43b/0x47c
[   84.646227]  [<ffffffff810dd8ae>] ? SyS_ioctl+0x55/0x7b
[   84.646248]  [<ffffffff816f6dd2>] ? system_call_fastpath+0x16/0x1b
[   84.646276] Code: 8b 77 10 49 bb 00 01 10 00 00 00 ad de 48 89 4e 08 48 89 31 48 b9 00 02 20 00 00 00 ad de 4c 89 5f 10 48 89 4f 18 eb 0b 4c 01 c6 <48> 3b 71 30 74 02 0f 0b 40 8a 70 20 48 8d 48 10 40 f6 c6 01 75
[   84.646408] RIP  [<ffffffffa0035aa3>] drm_mm_remove_node+0x5d/0xcb [drm]
[   84.646439]  RSP <ffff880110141c30>
[   84.646452] CR2: 0000000000000030
[   84.653209] ---[ end trace aa4e1b7cfd37f4b0 ]---

Reproduce steps:
---------------------------------------------
1. xinit&
2. run GLbenchmark v2.7.0 TRex_FixedTimeStep_Offscreen
vblank_mode=0 ./GLBenchmark -data ../../data/ -t 2700801
Comment 1 meng 2013-07-22 07:29:42 UTC 
Created attachment 82803 [details]
Xorg.0.log
Comment 2 meng 2013-07-22 07:30:40 UTC 
Created attachment 82804 [details]
dmesg.log
Comment 3 Chris Wilson 2013-07-22 07:58:14 UTC 
commit 6286ef9b56bfc5d4f3f06ef5488e41da4480dc85
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Fri Jul 19 08:46:27 2013 +0300

    drm/i915: use after free on error path
    
    i915_gem_vma_destroy() frees its argument so we have to move the
    drm_mm_remove_node() call up a few lines.
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Comment 4 Daniel Vetter 2013-07-22 08:09:14 UTC 
Created attachment 82806 [details] [review]
fix error cleanup in bind_to_gtt

Please test the attached patch.
Comment 5 Daniel Vetter 2013-07-22 08:16:12 UTC 
I think it's not quite fixed yet ...
Comment 6 Daniel Vetter 2013-07-22 08:19:05 UTC 
(In reply to comment #0)
> System Environment:       
> ----------------------------------------------
> Platform: Ironlake
> Libdrm:	  (master)libdrm-2.4.46-2-gfea5408098c3c3057958e85ea9d7146f0b08749e
> Mesa:     (master)cd90ebefd4f63d00eb65af6069fb078e454c43f1
> Xserver:  (master)xorg-server-1.14.99.1-137-g74469895e39fa38337f59e
> Xf86_video_intel: (master)2.21.12-36-g2c78403cb56841f342692b97bb53e995c
> Kernel:	  (drm-intel-next-queued) 7984211ee8e1fa03cd4bc9ef3d347f94f8a2c8a8

Hm, does this mean your testing on drm-intel-next-queued?

Testing should always happen on -nightly, and when filing a bug report please also specify the heads of the individual branches merged together in -nightly.
Comment 7 meng 2013-07-22 09:37:18 UTC 
(In reply to comment #4)
> Created attachment 82806 [details] [review] [review]
fix error cleanup in bind_to_gtt
> Please test the attached patch.


Hi, the problem still exists on the commit 6286ef9b56.

It’s fixed on the kernel commit 8928e6e0 that built with above patch.
Comment 8 meng 2013-07-22 09:42:05 UTC 
(In reply to comment #6)

Sorry, my statement confuses you. Actually, this test is on kernel -nightly and the problem exists on -next-queued.
Comment 9 Daniel Vetter 2013-07-22 21:12:33 UTC 
commit 86281e1ca60a5f0ce14d586d8b31d42bd038d33a
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Mon Jul 22 12:12:38 2013 +0200

    drm/i915: fix up error cleanup in i915_gem_object_bind_to_gtt
Comment 10 meng 2013-07-23 01:02:34 UTC 
Verified it with the 86281e1ca60a5f0c.
Comment 11 Elizabeth 2017-10-06 14:44:57 UTC 
Closing old verified.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.