Bug 111559 - [CI][DRMTIP] igt@gem_eio@in-flight-suspend - crash - Received signal SIGSEGV
Summary: [CI][DRMTIP] igt@gem_eio@in-flight-suspend - crash - Received signal SIGSEGV
Status: NEW
Alias: None
Product: DRI
Classification: Unclassified
Component: DRM/Intel (show other bugs)
Version: DRI git
Hardware: Other All
: medium major
Assignee: Intel GFX Bugs mailing list
QA Contact: Intel GFX Bugs mailing list
Depends on:
Reported: 2019-09-05 07:14 UTC by Lakshmi
Modified: 2019-09-09 03:53 UTC (History)
1 user (show)

See Also:
i915 platform: GLK
i915 features: GEM/Other


Note You need to log in before you can comment on or make changes to this bug.
Description Lakshmi 2019-09-05 07:14:25 UTC

Starting subtest: in-flight-suspend
Received signal SIGSEGV.
Stack trace: 
 #0 [fatal_sig_handler+0xd6]
 #1 [killpg+0x40]
 #2 [_dl_find_dso_for_object+0x3194]
 #3 [igt_spin_free+0x66]
 #4 [__real_main825+0xd05]
 #5 [main+0x27]
 #6 [__libc_start_main+0xe7]
 #7 [_start+0x2a]
Subtest in-flight-suspend: CRASH (2.179s)
Comment 1 CI Bug Log 2019-09-05 07:15:44 UTC
The CI Bug Log issue associated to this bug has been updated.

### New filters associated

* GLK:  igt@gem_eio@in-flight-suspend - crash - Received signal SIGSEGV
  - https://intel-gfx-ci.01.org/tree/drm-tip/drmtip_359/fi-glk-dsi/igt@gem_eio@in-flight-suspend.html
Comment 2 Chris Wilson 2019-09-05 11:52:55 UTC
Seems quite bizarre. igt_spin_free has the obligatory if (!spin) return guard, and 0x66 does imply we got into the function before dying. On a local build, gdb suggests 0x66 is 

(gdb) list *igt_spin_free+0x66
0x23a66 is in igt_spin_free (igt_dummyload.c:448).
444		igt_spin_end(spin);
445		gem_munmap((void *)((unsigned long)spin->condition & (~4095UL)),
446			   BATCH_SIZE);
448		if (spin->poll) {
449			gem_munmap(spin->poll, 4096);
450			gem_close(fd, spin->poll_handle);
451		}

spin is not NULL, so the suggestion is either spin->condition lead to a SIGSEGV in gem_munmap() (unlikely, it should return -EFAULT if broken) or spin->poll is garbage. But igt_spin_t is calloc... And spin->poll is never assigned to again.

I don't see this as being a i915.ko bug, and I haven't spotted a potential issue here, my worries turn towards random memcorruption. Hopefully a second look can find a way igt_spin_t can be corrupt.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.