Bug 87207 - Segfault rooted at OsLookupColor+0x119 passes through intel_drv.so (_init+0x5713c)
Summary: Segfault rooted at OsLookupColor+0x119 passes through intel_drv.so (_init+0x5...
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Driver/intel (show other bugs)
Version: unspecified
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Chris Wilson
QA Contact: Intel GFX Bugs mailing list
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-10 20:35 UTC by Sam
Modified: 2016-01-05 15:25 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
Config #1 (1.90 KB, text/plain)
2014-12-10 20:35 UTC, Sam
no flags Details
Crash Log #1 (13.44 KB, text/plain)
2014-12-10 20:36 UTC, Sam
no flags Details
Config #2 (2.90 KB, text/plain)
2014-12-10 20:36 UTC, Sam
no flags Details
Crash Log #2 (34.54 KB, text/plain)
2014-12-10 20:37 UTC, Sam
no flags Details

Description Sam 2014-12-10 20:35:25 UTC
Created attachment 110694 [details]
Config #1

Description of problem:
My Xinerama configuration from Fedora 20 segfaults in Fedora 21. Nvidia proprietary driver is one card and the stock Fedora 21 intel driver is the second card.

Disabling the intel driver or the nvidia driver allows the system to bring up the single associated display.

Versions:
xorg-x11-server 1.16.2-1.fc21
NVIDIA dlloader X Driver  340.65  Tue Dec  2 08:47:36 PST 2014
intel(1): Using Kernel Mode Setting driver: i915, version 1.6.0 20140725

How reproducible:
Consistently.
Disabling the intel driver or the nvidia driver allows the system to bring up the single associated display.

Steps to Reproduce:
1. Install included configurations.
2. Install NVidia's NVIDIA-Linux-x86_64-340.65.run driver.
3. Startx

Actual results:
(EE) Backtrace:
(EE) 0: /usr/libexec/Xorg.bin (OsLookupColor+0x119) [0x59bfd9]
(EE) 1: /lib64/libc.so.6 (__restore_rt+0x0) [0x3cdac3494f]
(EE) 2: /usr/lib64/xorg/modules/drivers/intel_drv.so (_init+0x5713c) [0x7f0b7a7aaa6c]
(EE) 3: /usr/libexec/Xorg.bin (AddScreen+0x101) [0x439351]
(EE) 4: /usr/libexec/Xorg.bin (InitOutput+0x3e1) [0x47b4b1]
(EE) 5: /usr/libexec/Xorg.bin (remove_fs_handlers+0x22a) [0x43cfaa]
(EE) 6: /lib64/libc.so.6 (__libc_start_main+0xf0) [0x3cdac1ffe0]
(EE) 7: /usr/libexec/Xorg.bin (_start+0x29) [0x42761e]
(EE) 8: ? (?+0x29) [0x29]
Comment 1 Sam 2014-12-10 20:36:04 UTC
Created attachment 110695 [details]
Crash Log #1
Comment 2 Sam 2014-12-10 20:36:58 UTC
Created attachment 110696 [details]
Config #2

The same crash was observed on a DELL machine with a radeon card and an similar integrated intel card.
Comment 3 Sam 2014-12-10 20:37:20 UTC
Created attachment 110697 [details]
Crash Log #2
Comment 4 Sam 2014-12-10 20:37:46 UTC
This bug is a reproduction of one I opened against Fedora 21: https://bugzilla.redhat.com/show_bug.cgi?id=1172232
Comment 5 Sam 2014-12-10 20:47:58 UTC
I should note that both of the "broken" configurations work correctly under Fedora 20 which has the driver package:
    xorg-x11-drv-intel-2.21.15-9.fc20.x86_64

vs that on Fedora 21:
    xorg-x11-drv-intel-2.99.916-3.20141117.fc21.x86_64
Comment 6 Chris Wilson 2014-12-10 21:02:38 UTC
Seems to be an uninitialised pointer. Any chance you can capture a bt using gdb? Building xf86-video-intel with --enable-debug=full would be ideal.
Comment 7 Sam 2014-12-10 22:49:35 UTC
I installed the *-debuginfo packages:

[root@sfb3 xorg.conf.d]# gdb /usr/libexec/Xorg.bin 
GNU gdb (GDB) Fedora 7.8.1-30.fc21
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/libexec/Xorg.bin...Reading symbols from /usr/lib/debug/usr/libexec/Xorg.bin.debug...done.
done.
(gdb) r
Starting program: /usr/libexec/Xorg.bin 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

X.Org X Server 1.16.2
Release Date: 2014-11-10
X Protocol Version 11, Revision 0
Build Operating System:  3.17.2-200.fc20.x86_64 
Current Operating System: Linux sfb3.samnet 3.17.4-301.fc21.x86_64 #1 SMP Thu Nov 27 19:09:10 UTC 2014 x86_64
Kernel command line: BOOT_IMAGE=/vmlinuz-3.17.4-301.fc21.x86_64 root=/dev/mapper/fedora-root ro rd.lvm.lv=fedora/swap rd.md=0 rd.dm=0 rd.luks.uuid=luks-cd76133d-e2e2-4c28-b276-14bab25a3f20 rd.lvm.lv=fedora/root rhgb quiet LANG=en_US.UTF-8 3
Build Date: 21 November 2014  01:15:20AM
Build ID: xorg-x11-server 1.16.2-1.fc21 
Current version of pixman: 0.32.6
	Before reporting problems, check http://wiki.x.org
	to make sure that you have the latest version.
Markers: (--) probed, (**) from config file, (==) default setting,
	(++) from command line, (!!) notice, (II) informational,
	(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(==) Log file: "/var/log/Xorg.0.log", Time: Wed Dec 10 16:43:25 2014
(==) Using config directory: "/etc/X11/xorg.conf.d"
(==) Using system config directory "/usr/share/X11/xorg.conf.d"
[tcsetpgrp failed in terminal_inferior: Operation not permitted]
[New Thread 0x7ffff2ed6700 (LWP 3392)]

Program received signal SIGSEGV, Segmentation fault.
sna_mode_init (sna=0x7ffff2689000, screen=0x9dafa0) at sna_driver.c:1075
1075		sna->mode.rrGetInfo = rp->rrGetInfo;
Missing separate debuginfos, use: debuginfo-install audit-libs-2.4.1-1.fc21.x86_64 bzip2-libs-1.0.6-14.fc21.x86_64 dbus-libs-1.8.6-3.fc21.x86_64 elfutils-libelf-0.160-1.fc21.x86_64 elfutils-libs-0.160-1.fc21.x86_64 freetype-2.5.3-11.fc21.x86_64 libXau-1.0.8-4.fc21.x86_64 libXdmcp-1.1.1-7.fc21.x86_64 libXfont-1.5.0-2.fc21.x86_64 libdrm-2.4.58-3.fc21.x86_64 libfontenc-1.1.2-3.fc21.x86_64 libgcrypt-1.6.1-7.fc21.x86_64 libgpg-error-1.13-3.fc21.x86_64 libpciaccess-0.13.3-0.3.fc21.x86_64 libpng-1.6.10-3.fc21.x86_64 libselinux-2.3-5.fc21.x86_64 libunwind-1.1-7.fc21.x86_64 libxshmfence-1.1-3.fc21.x86_64 openssl-libs-1.0.1j-1.fc21.x86_64 pcre-8.35-7.fc21.x86_64 pixman-0.32.6-4.fc21.x86_64 systemd-libs-216-12.fc21.x86_64 xz-libs-5.1.2-14alpha.fc21.x86_64 zlib-1.2.8-7.fc21.x86_64
(gdb) bt all
No symbol "all" in current context.
(gdb) help bt
Print backtrace of all stack frames, or innermost COUNT frames.
With a negative argument, print outermost -COUNT frames.
Use of the 'full' qualifier also prints the values of the local variables.
Use of the 'no-filters' qualifier prohibits frame filters from executing
on this backtrace.

(gdb) bt full
#0  sna_mode_init (sna=0x7ffff2689000, screen=0x9dafa0) at sna_driver.c:1075
        rp = 0x0
#1  sna_screen_init (screen=screen@entry=0x9dafa0, argc=argc@entry=1, argv=argv@entry=0x7fffffffe4c8) at sna_driver.c:1176
        scrn = 0x867b00
        sna = 0x7ffff2689000
        visuals = 0x9db730
        depths = 0x9db6b0
        nvisuals = 2
        ndepths = 7
        rootdepth = 24
        defaultVisual = 630
#2  0x0000000000439351 in AddScreen (pfnInit=0x7ffff35b4930 <sna_screen_init>, argc=argc@entry=1, argv=argv@entry=0x7fffffffe4c8) at dispatch.c:3821
        i = 1
        pScreen = 0x9dafa0
#3  0x000000000047b4b1 in InitOutput (pScreenInfo=pScreenInfo@entry=0x838280 <screenInfo>, argc=argc@entry=1, argv=argv@entry=0x7fffffffe4c8) at xf86Init.c:917
        i = 1
        j = <optimized out>
        k = <optimized out>
        scr_index = <optimized out>
        modulelist = <optimized out>
        optionlist = 0x84f770
        screenpix24 = <optimized out>
        pix24 = <optimized out>
        pix24From = <optimized out>
        pix24Fail = 0
        autoconfig = <optimized out>
        sigio_blocked = 0
        want_hw_access = <optimized out>
        configured_device = <optimized out>
#4  0x000000000043cf6a in dix_main (argc=1, argv=0x7fffffffe4c8, envp=<optimized out>) at main.c:202
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#5  0x0000003cdac1ffe0 in __libc_start_main (main=0x4275f0 <main>, argc=1, argv=0x7fffffffe4c8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe4b8)
    at libc-start.c:289
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 2960306975316988272, 4355573, 140737488348352, 0, 0, -2960306652655300240, 2984948345770955120}, mask_was_saved = 0}}, priv = {pad = {
              0x0, 0x0, 0x5a8c20 <__libc_csu_init>, 0x7fffffffe4c8}, data = {prev = 0x0, cleanup = 0x0, canceltype = 5934112}}}
        not_first_call = <optimized out>
#6  0x000000000042761e in _start ()
No symbol table info available.
(gdb) 

...

(gdb) list
1070		xf86RandR12SetRotations(screen, RR_Rotate_All | RR_Reflect_All);
1071		xf86RandR12SetTransformSupport(screen, TRUE);
1072	
1073		/* Wrap RR queries to catch pending MST topology changes */
1074		rp = rrGetScrPriv(screen);
1075		sna->mode.rrGetInfo = rp->rrGetInfo;
1076		rp->rrGetInfo = sna_randr_getinfo;
1077	
1078		return TRUE;
1079	}
(gdb) print screen
$1 = (ScreenPtr) 0x9dafa0
(gdb) print rp
$2 = (rrScrPrivPtr) 0x0
(gdb) frame
#0  sna_mode_init (sna=0x7ffff2689000, screen=0x9dafa0) at sna_driver.c:1075
1075		sna->mode.rrGetInfo = rp->rrGetInfo;
(gdb)
Comment 8 Chris Wilson 2014-12-11 07:53:35 UTC
Hmm, iirc this is due to a conflict between Xinerama and Randr. Thanks for the stacktrace, I think I have enough now to fix it.
Comment 9 Sam 2014-12-11 08:07:04 UTC
Excellent. Thank you for your efforts!
Comment 10 Chris Wilson 2014-12-11 08:55:52 UTC
commit f587d71f3c91f9ddcc4cdbe8a0f9ce59590d9db2
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Thu Dec 11 08:53:54 2014 +0000

    sna: Catch NULL RandR screen private
    
    If Xinerama is enabled, than RandR12 will be silently disabled. Be
    careful not to dereference the rrScrPiv when it doesn't exist.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=87207
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Comment 11 Mark van Rossum 2016-01-05 15:25:50 UTC
Might this be related to the bug I reported at
https://bugzilla.redhat.com/show_bug.cgi?id=1294536 

In which version has this been corrected?


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.