System Environment: ---------------------------------------------- Platform: Ironlake Libdrm: (master)libdrm-2.4.46-2-gfea5408098c3c3057958e85ea9d7146f0b08749e Mesa: (master)cd90ebefd4f63d00eb65af6069fb078e454c43f1 Xserver: (master)xorg-server-1.14.99.1-137-g74469895e39fa38337f59e Xf86_video_intel: (master)2.21.12-36-g2c78403cb56841f342692b97bb53e995c Kernel: (drm-intel-next-queued) 7984211ee8e1fa03cd4bc9ef3d347f94f8a2c8a8 Bug detailed description: ---------------------------------------------- “Call Trace” when run GLbenchmark v2.7.0 TRex_FixedTimeStep_Offscreen on Ironlake. If the problem appears, the game would park in a frame and X can’t be restarted.The problem exists on X raw and gnome-session. Please see dmesg and Xorg.0.log attached. It’s kernel drm-intel-next-queued regression, bisecting show the first bad commit is that: commit 2f63315692b1d3c055972ad33fc7168ae908b97b Author: Ben Widawsky <ben@bwidawsk.net> Date: Wed Jul 17 12:19:03 2013 -0700 drm/i915: Create VMAs Formerly: "drm/i915: Create VMAs (part 1)" Call Trace: ---------------- [ 84.645970] [<ffffffffa00998d7>] ? i915_gem_object_pin+0x453/0x4de [i915] [ 84.646002] [<ffffffffa0099dfe>] ? i915_gem_pwrite_ioctl+0x1c6/0x793 [i915] [ 84.646034] [<ffffffffa0099b7f>] ? i915_gem_fault+0x105/0x1be [i915] [ 84.646061] [<ffffffff810ae42d>] ? __do_fault+0xac/0x3bb [ 84.646090] [<ffffffffa009857a>] ? i915_gem_set_domain_ioctl+0x19c/0x1b4 [i915] [ 84.646122] [<ffffffffa002d4e7>] ? drm_ioctl+0x2b7/0x3c0 [drm] [ 84.646150] [<ffffffffa0099c38>] ? i915_gem_fault+0x1be/0x1be [i915] [ 84.646180] [<ffffffff816f4a94>] ? __do_page_fault+0x3a4/0x3ed [ 84.646204] [<ffffffff810dd818>] ? do_vfs_ioctl+0x43b/0x47c [ 84.646227] [<ffffffff810dd8ae>] ? SyS_ioctl+0x55/0x7b [ 84.646248] [<ffffffff816f6dd2>] ? system_call_fastpath+0x16/0x1b [ 84.646276] Code: 8b 77 10 49 bb 00 01 10 00 00 00 ad de 48 89 4e 08 48 89 31 48 b9 00 02 20 00 00 00 ad de 4c 89 5f 10 48 89 4f 18 eb 0b 4c 01 c6 <48> 3b 71 30 74 02 0f 0b 40 8a 70 20 48 8d 48 10 40 f6 c6 01 75 [ 84.646408] RIP [<ffffffffa0035aa3>] drm_mm_remove_node+0x5d/0xcb [drm] [ 84.646439] RSP <ffff880110141c30> [ 84.646452] CR2: 0000000000000030 [ 84.653209] ---[ end trace aa4e1b7cfd37f4b0 ]--- Reproduce steps: --------------------------------------------- 1. xinit& 2. run GLbenchmark v2.7.0 TRex_FixedTimeStep_Offscreen vblank_mode=0 ./GLBenchmark -data ../../data/ -t 2700801
Created attachment 82803 [details] Xorg.0.log
Created attachment 82804 [details] dmesg.log
commit 6286ef9b56bfc5d4f3f06ef5488e41da4480dc85 Author: Dan Carpenter <dan.carpenter@oracle.com> Date: Fri Jul 19 08:46:27 2013 +0300 drm/i915: use after free on error path i915_gem_vma_destroy() frees its argument so we have to move the drm_mm_remove_node() call up a few lines. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Created attachment 82806 [details] [review] fix error cleanup in bind_to_gtt Please test the attached patch.
I think it's not quite fixed yet ...
(In reply to comment #0) > System Environment: > ---------------------------------------------- > Platform: Ironlake > Libdrm: (master)libdrm-2.4.46-2-gfea5408098c3c3057958e85ea9d7146f0b08749e > Mesa: (master)cd90ebefd4f63d00eb65af6069fb078e454c43f1 > Xserver: (master)xorg-server-1.14.99.1-137-g74469895e39fa38337f59e > Xf86_video_intel: (master)2.21.12-36-g2c78403cb56841f342692b97bb53e995c > Kernel: (drm-intel-next-queued) 7984211ee8e1fa03cd4bc9ef3d347f94f8a2c8a8 Hm, does this mean your testing on drm-intel-next-queued? Testing should always happen on -nightly, and when filing a bug report please also specify the heads of the individual branches merged together in -nightly.
(In reply to comment #4) > Created attachment 82806 [details] [review] [review] fix error cleanup in bind_to_gtt > Please test the attached patch. Hi, the problem still exists on the commit 6286ef9b56. It’s fixed on the kernel commit 8928e6e0 that built with above patch.
(In reply to comment #6) Sorry, my statement confuses you. Actually, this test is on kernel -nightly and the problem exists on -next-queued.
commit 86281e1ca60a5f0ce14d586d8b31d42bd038d33a Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Mon Jul 22 12:12:38 2013 +0200 drm/i915: fix up error cleanup in i915_gem_object_bind_to_gtt
Verified it with the 86281e1ca60a5f0c.
Closing old verified.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.