Bug 103499 - NULL pointer dereferences in some corner cases
Summary: NULL pointer dereferences in some corner cases
Status: NEEDINFO
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/i965 (show other bugs)
Version: 17.2
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Jason Ekstrand
QA Contact: Intel 3D Bugs Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-10-28 19:24 UTC by Vadim A. Misbakh-Soloviov (mva)
Modified: 2017-10-28 20:00 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Vadim A. Misbakh-Soloviov (mva) 2017-10-28 19:24:40 UTC
Hi there!
Unfortunately, I'm facing strange issues with segfaults because of null pointer dereferences on my wife's laptop with Haswell.

Firstly, without "debug" symbols being built, gdb said that segfault is happening in `intel_miptree_level_has_hiz` function (that made me think about this bug is being related to the one on the end of the message).

When I recompiled mesa with debug symbols, I got following backtrace:
```
Thread 1 (Thread 0x7ffff7e27800 (LWP 70027)):
#0  0x00007fffdf2be4f9 in intel_miptree_check_level_layer (mt=0x0, level=0, layer=0) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/drivers/dri/i965/intel_mipmap_tree.c:419
        __PRETTY_FUNCTION__ = "intel_miptree_check_level_layer"
#1  0x00007fffdf2c1987 in intel_miptree_level_has_hiz (mt=0x0, level=0) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/drivers/dri/i965/intel_mipmap_tree.c:1826
No locals.
#2  0x00007fffdf2bd78b in intel_renderbuffer_has_hiz (irb=0x950430) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/drivers/dri/i965/intel_fbo.c:934
No locals.
#3  0x00007fffdf27bf50 in brw_fast_clear_depth (ctx=0xb21b40) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/drivers/dri/i965/brw_clear.c:114
        brw = 0xb21b40
        fb = 0xa50630
        depth_irb = 0x950430
        mt = 0x0
        depth_att = 0xa50808
        clear_value = 2.37853907e-38
#4  0x00007fffdf27c37d in brw_clear (ctx=0xb21b40, mask=50) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/drivers/dri/i965/brw_clear.c:228
        brw = 0xb21b40
        fb = 0xa50630
        partial_clear = false
        tri_mask = 32767
        __PRETTY_FUNCTION__ = "brw_clear"
#5  0x00007fffdeda062d in clear (no_error=false, mask=17664, ctx=0xb21b40) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/main/clear.c:221
        bufferMask = 50
#6  _mesa_Clear (mask=17664) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/main/clear.c:242
        ctx = 0xb21b40
#7  0x00007ffff5efa38a in QSGBatchRenderer::Renderer::renderBatches() () from /usr/lib64/libQt5Quick.so.5
<...>
```


After some discussion with Jason Ekstrand on the IRC, I've tried to apply that patch:

```

diff --git a/src/mesa/drivers/dri/i965/brw_clear.c b/src/mesa/drivers/dri/i965/brw_clear.c
index fe8634b..b0a6602 100644
--- a/src/mesa/drivers/dri/i965/brw_clear.c
+++ b/src/mesa/drivers/dri/i965/brw_clear.c
@@ -112,6 +112,9 @@ brw_fast_clear_depth(struct gl_context *ctx)
    if (devinfo->gen < 6)
       return false;
 
+   if (depth_irb->mt == NULL)
+      return false;
+
    if (!intel_renderbuffer_has_hiz(depth_irb))
       return false;
 
```

And now, backtrace looks like that:
```
Thread 1 (Thread 0x7ffff7e27800 (LWP 133740)):
#0  0x00007fffdf01bbb6 in intel_miptree_render_aux_usage (brw=0xb28d70, mt=0x0, srgb_enabled=false, blend_enabled=false) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/drivers/dri/i965/intel_mipmap_tree.c:2575
No locals.
#1  0x00007fffdeffa1c7 in brw_update_renderbuffer_surface (brw=0xb28d70, rb=0xa4c8f0, flags=0, unit=0, surf_index=0) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/drivers/dri/i965/brw_wm_surface_state.c:219
        ctx = 0xb28d70
        irb = 0xa4c8f0
        mt = 0x0
        aux_usage = ISL_AUX_USAGE_HIZ
        rb_format = MESA_FORMAT_X8B8G8R8_UNORM
        view = {usage = 0, format = 3691008000, base_level = 32767, levels = 4096, base_array_layer = 3, array_len = 9437200, swizzle = {r = ISL_CHANNEL_SELECT_ZERO, g = ISL_CHANNEL_SELECT_ZERO, b = ISL_CHANNEL_SELECT_ZERO, a = ISL_CHANNEL_SELECT_ZERO}}
        offset = 32767
#2  0x00007fffdeffc097 in brw_update_renderbuffer_surfaces (brw=0xb28d70, fb=0xa6d970, render_target_start=0, surf_offset=0xb4f584) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/drivers/dri/i965/brw_wm_surface_state.c:1055
        surf_index = 0
        flags = 0
        i = 0
        w = 0
        h = 0
        s = 0
#3  0x00007fffdeffc28f in update_renderbuffer_surfaces (brw=0xb28d70) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/drivers/dri/i965/brw_wm_surface_state.c:1080
        ctx = 0xb28d70
        wm_prog_data = 0xa3a838
        fb = 0xa6d970
#4  0x00007fffdeff0c4c in check_and_emit_atom (brw=0xb28d70, state=0x7fffffffb320, atom=0xb4feb8) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/drivers/dri/i965/brw_state_upload.c:457
No locals.
#5  0x00007fffdeff053a in brw_upload_pipeline_state (brw=0xb28d70, pipeline=BRW_RENDER_PIPELINE) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/drivers/dri/i965/brw_state_upload.c:571
        atom = 0xb4feb8
        dirty_count = 0
        ctx = 0xb28d70
        i = 33
        state = {mesa = 4294967295, brw = 18446744073709551615}
        fb_samples = 1
        atoms = 0xb4fba0
        num_atoms = 69
#6  0x00007fffdeff0067 in brw_upload_render_state (brw=0xb28d70) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/drivers/dri/i965/brw_state_upload.c:593
No locals.
#7  0x00007fffdefd7338 in brw_try_draw_prims (ctx=0xb28d70, arrays=0x1c351f8, prims=0x7fffffffb588, nr_prims=1, ib=0x7fffffffb5b0, index_bounds_valid=false, min_index=0, max_index=4294967295, xfb_obj=0x0, stream=0, indirect=0x0) at /var/tmp/portage/media-libs/mesa-17.2.3
/work/mesa-17.2.3/src/mesa/drivers/dri/i965/brw_draw.c:777
        sampler_state_size = 16
        new_basevertex = 0
        estimated_max_prim_size = 5120
        new_baseinstance = 0
        vs_prog_data = 0x0
        _warned = false
        msg_id = 0
        brw = 0xb28d70
        i = 0
        fail_next = false
#8  0x00007fffdefd6c02 in brw_draw_prims (ctx=0xb28d70, prims=0x7fffffffb588, nr_prims=1, ib=0x7fffffffb5b0, index_bounds_valid=0 '\000', min_index=0, max_index=4294967295, gl_xfb_obj=0x0, stream=0, indirect=0x0) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.
3/src/mesa/drivers/dri/i965/brw_draw.c:869
        msg_id = 0
        msg_id = 0
        brw = 0xb28d70
        arrays = 0x1c351f8
        xfb_obj = 0x0
#9  0x00007fffdeccb8fd in vbo_validated_drawrangeelements (ctx=0xb28d70, mode=5, index_bounds_valid=0 '\000', start=0, end=4294967295, count=4, type=5123, indices=0x2, basevertex=0, numInstances=1, baseInstance=0) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2
.3/src/mesa/vbo/vbo_exec_array.c:918
        vbo = 0x1c31d30
        ib = {count = 4, index_size = 2, obj = 0xa6b9d0, ptr = 0x2}
        prim = {mode = 5, indexed = 1, begin = 1, end = 1, weak = 0, no_current_update = 0, is_indirect = 0, pad = 0, start = 0, count = 4, basevertex = 0, num_instances = 1, base_instance = 0, draw_id = 0, indirect_offset = 2}
#10 0x00007fffdecc8745 in vbo_exec_DrawElements (mode=5, count=4, type=5123, indices=0x2) at /var/tmp/portage/media-libs/mesa-17.2.3/work/mesa-17.2.3/src/mesa/vbo/vbo_exec_array.c:1068
        ctx = 0xb28d70
#11 0x00007ffff5ef9b01 in QSGBatchRenderer::Renderer::renderMergedBatch(QSGBatchRenderer::Batch const*) () from /usr/lib64/libQt5Quick.so.5
<...>
```

So, it's still falls into null pointer dereference, as far as I understand the situation.

I'd like to provide any additional info, if that was not enough to catch the problem.
 

P.S. this bug may (or may not) be related to https://bugs.freedesktop.org/show_bug.cgi?id=101539


P.P.S.: Unfortunately, bisecting would be too hard, since there was a huge version gap between "working" and "not working" state (13.0.2 -> 17.0.3) and it was also huge system upgrade (too much system packages was upgraded, including glibc, gcc, llvm, clang, whatever). So, proper bisecting can take forever :'(
Comment 1 Vadim A. Misbakh-Soloviov (mva) 2017-10-28 19:27:22 UTC
P.P.S.: sorry, I made a typo: mesa upgrade was 13.0.2 -> 17.2.3 (not a 17.0.3)
Comment 2 Vadim A. Misbakh-Soloviov (mva) 2017-10-28 19:36:09 UTC
Oh, just in case: content of the line 2575 in mentioned file is `switch (mt->aux_usage) {`
Comment 3 Jason Ekstrand 2017-10-28 19:54:01 UTC
What application is this? Also, what distro and do you have any patches on top except the hack I have you?
Comment 4 Vadim A. Misbakh-Soloviov (mva) 2017-10-28 20:00:54 UTC
1) the application is kscreenlocker_greet from KDE (UI of the screen locker, where it asks user to type a password).

On Gentoo it resides in `/usr/lib64/libexec/kscreenlocker_greet` (on other distros that path may vary)

2) Distro is Gentoo (as well as on two another machines where I can't reproduce the bug. All of them have the same versions of the software, although, slightly differs in hardware: that one is haswell, while two others is broadwell and sandybridge)

3) No. There is no another patches, except "that hack" from you.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.