Bug 89693 - [SNB] BUG drm_framebuffer_free_bug
Summary: [SNB] BUG drm_framebuffer_free_bug
Status: CLOSED FIXED
Alias: None
Product: DRI
Classification: Unclassified
Component: DRM/Intel (show other bugs)
Version: XOrg git
Hardware: Other All
: medium normal
Assignee: Intel GFX Bugs mailing list
QA Contact: Intel GFX Bugs mailing list
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-03-20 13:49 UTC by mikhail.v.gavrilov
Modified: 2017-07-24 22:47 UTC (History)
3 users (show)

See Also:
i915 platform:
i915 features:


Attachments
system log (1.58 MB, text/plain)
2015-03-20 19:40 UTC, mikhail.v.gavrilov
no flags Details

Description mikhail.v.gavrilov 2015-03-20 13:49:18 UTC
kernel BUG at drivers/gpu/drm/drm_crtc.c:530!
invalid opcode: 0000 [#1] SMP 
Modules linked in: snd_usb_audio snd_usbmidi_lib snd_rawmidi gspca_zc3xx gspca_main videodev media vfat fat bnep bluetooth rfkill fuse xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ebtable_broute bridge ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw intel_rapl iosf_mbi snd_hda_codec_hdmi hid_logitech_hidpp snd_hda_codec_realtek snd_hda_codec_generic x86_pkg_temp_thermal snd_hda_intel snd_hda_controller coretemp kvm_intel kvm iTCO_wdt snd_hda_codec
 snd_hwdep gpio_ich crc32_pclmul crc32c_intel snd_seq usblp iTCO_vendor_support snd_seq_device snd_pcm mei_me lpc_ich snd_timer snd soundcore mei i2c_i801 serio_raw mfd_core nfsd auth_rpcgss nfs_acl lockd grace sunrpc binfmt_misc i915 i2c_algo_bit video uas 8021q drm_kms_helper garp stp usb_storage llc drm mrp r8169 mii hid_logitech_dj
CPU: 0 PID: 17168 Comm: pool Not tainted 4.0.0-0.rc4.git0.1.fc22.i686+PAE #1
Hardware name: Gigabyte Technology Co., Ltd. H67N-USB3-B3/H67N-USB3-B3, BIOS F9 03/27/2012
task: cf374080 ti: eb1f6000 task.ti: eb1f6000
EIP: 0060:[<f812d238>] EFLAGS: 00210246 CPU: 0
EIP is at drm_framebuffer_free_bug+0x8/0x10 [drm]
EAX: f6ad3884 EBX: f69e7200 ECX: 00000000 EDX: 8020000c
ESI: f6ad3880 EDI: f69e7200 EBP: eb1f7d08 ESP: eb1f7d08
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
CR0: 80050033 CR2: bfac6004 CR3: 123d1000 CR4: 000407f0
Stack:
 eb1f7d2c f812f1cd f812d7bf 00000001 00000000 00000000 f694bc00 f694bc00
 f694be00 eb1f7d54 f8103370 00000001 00000000 f813d240 f6a38f00 f694bc00
 f6a38f00 f694bc00 f694bc00 eb1f7d68 f810508e f694bc00 db048d80 f694bc00
Call Trace:
 [<f812f1cd>] drm_plane_force_disable+0x7d/0xb0 [drm]
 [<f812d7bf>] ? drm_mode_plane_set_obj_prop+0x2f/0xa0 [drm]
 [<f8103370>] restore_fbdev_mode+0x40/0xf0 [drm_kms_helper]
 [<f813d240>] ? __drm_modeset_lock_all+0xf0/0x110 [drm]
 [<f810508e>] drm_fb_helper_restore_fbdev_mode_unlocked+0x1e/0x50 [drm_kms_helper]
 [<f831e7dd>] intel_fbdev_restore_mode+0x1d/0x50 [i915]
 [<f834345d>] i915_driver_lastclose+0xd/0x20 [i915]
 [<f812277a>] drm_lastclose+0x2a/0x140 [drm]
 [<f8122af9>] drm_release+0x269/0x440 [drm]
 [<c05a85b8>] __fput+0xc8/0x1d0
 [<c05a86fd>] ____fput+0xd/0x10
 [<c047f799>] task_work_run+0xc9/0xe0
 [<c0468ff3>] do_exit+0x353/0xa30
 [<c0594b2d>] ? kmem_cache_alloc_trace+0x1bd/0x1f0
 [<c04bcef2>] ? wake_nocb_leader+0x52/0x60
 [<c04710d7>] ? recalc_sigpending+0x17/0x50
 [<c04718bb>] ? dequeue_signal+0x2b/0x180
 [<c0469747>] do_group_exit+0x37/0xa0
 [<c04742d4>] get_signal+0x234/0x5d0
 [<c0411039>] do_signal+0x29/0xa50
 [<c05b6f3d>] ? do_filp_open+0x3d/0xa0
 [<c05c2988>] ? __alloc_fd+0x68/0x100
 [<c05b5ea4>] ? putname+0x34/0x70
 [<c05b5ea4>] ? putname+0x34/0x70
 [<c05a6018>] ? do_sys_open+0x188/0x220
 [<c0411ab7>] do_notify_resume+0x57/0x80
 [<c0a912e5>] work_notifysig+0x30/0x37
Code: 8b 56 08 8d 83 a0 01 00 00 e8 e5 d5 5c c8 89 f8 e8 0e 19 96 c8 89 f0 e8 f7 6b 46 c8 5b 5e 5f 5d c3 66 90 55 89 e5 66 66 66 66 90 <0f> 0b 8d b6 00 00 00 00 55 89 e5 57 56 53 66 66 66 66 90 85 c9
EIP: [<f812d238>] drm_framebuffer_free_bug+0x8/0x10 [drm] SS:ESP 0068:eb1f7d08
Comment 1 Paulo Zanoni 2015-03-20 19:10:36 UTC
Hi

What are the steps to reproduce this problem? How reproducible is the bug?

Which platform are you using? Please provide the output of "lspci -nn".

Is there any way for you to provide us a complete dmesg? Even better if you are able to boot with drm.debug=0xe.

When did this start happening? Are you able to bisect this bug? Bisecting is a _really_ good way to help fixing the bug, and since you're running RC Kernels, maybe the bisect interval would be small.

Thanks,
Paulo
Comment 2 mikhail.v.gavrilov 2015-03-20 19:40:20 UTC
> What are the steps to reproduce this problem? How reproducible is the bug?
I turned off the computer and it happened the first time.


# lspci -nn
00:00.0 Host bridge [0600]: Intel Corporation 2nd Generation Core Processor Family DRAM Controller [8086:0100] (rev 09)
00:02.0 VGA compatible controller [0300]: Intel Corporation 2nd Generation Core Processor Family Integrated Graphics Controller [8086:0102] (rev 09)
00:16.0 Communication controller [0780]: Intel Corporation 6 Series/C200 Series Chipset Family MEI Controller #1 [8086:1c3a] (rev 04)
00:1a.0 USB controller [0c03]: Intel Corporation 6 Series/C200 Series Chipset Family USB Enhanced Host Controller #2 [8086:1c2d] (rev 05)
00:1b.0 Audio device [0403]: Intel Corporation 6 Series/C200 Series Chipset Family High Definition Audio Controller [8086:1c20] (rev 05)
00:1c.0 PCI bridge [0604]: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 1 [8086:1c10] (rev b5)
00:1c.1 PCI bridge [0604]: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 2 [8086:1c12] (rev b5)
00:1d.0 USB controller [0c03]: Intel Corporation 6 Series/C200 Series Chipset Family USB Enhanced Host Controller #1 [8086:1c26] (rev 05)
00:1e.0 PCI bridge [0604]: Intel Corporation 82801 PCI Bridge [8086:244e] (rev a5)
00:1f.0 ISA bridge [0601]: Intel Corporation H67 Express Chipset Family LPC Controller [8086:1c4a] (rev 05)
00:1f.2 SATA controller [0106]: Intel Corporation 6 Series/C200 Series Chipset Family SATA AHCI Controller [8086:1c02] (rev 05)
00:1f.3 SMBus [0c05]: Intel Corporation 6 Series/C200 Series Chipset Family SMBus Controller [8086:1c22] (rev 05)
01:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller [10ec:8168] (rev 06)
02:00.0 USB controller [0c03]: NEC Corporation uPD720200 USB 3.0 Host Controller [1033:0194] (rev 04)
Comment 3 mikhail.v.gavrilov 2015-03-20 19:40:40 UTC
Created attachment 114497 [details]
system log
Comment 4 Matt Roper 2015-03-24 19:56:35 UTC
This sounds like it might be fixed by:

commit 220dd2bc43e23f72fcdf6cc6ced3107c7023f123
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Fri Feb 27 12:58:13 2015 +0100

    drm: Fixup racy refcounting in plane_force_disable

which we had in -next, but were missing in -fixes until this morning.  Can you try cherry-picking that commit and see if it solves your problem?
Comment 5 Breno Leitao 2015-04-15 13:25:17 UTC
I have been using kernel 4-rc4 and faced this problem also. I am cherry picking this patch to see if the problem is reproducible.
Comment 6 Daniel Martin 2015-05-06 07:25:44 UTC
(In reply to Matt Roper from comment #4)
> This sounds like it might be fixed by:
> 
> commit 220dd2bc43e23f72fcdf6cc6ced3107c7023f123
> Author: Daniel Vetter <daniel.vetter@ffwll.ch>
> Date:   Fri Feb 27 12:58:13 2015 +0100
> 
>     drm: Fixup racy refcounting in plane_force_disable
> 
> which we had in -next, but were missing in -fixes until this morning.  Can
> you try cherry-picking that commit and see if it solves your problem?

I can confirm that this commit fixes the problem, cherry-picked it to v3.19.something, tested on a Lenovo X250.
And the commit is part of v4.0 (since rc5?), so I think that this bug can be closed.
Comment 7 Jani Nikula 2015-05-06 09:36:28 UTC
(In reply to Daniel Martin from comment #6)
> I can confirm that this commit fixes the problem, cherry-picked it to
> v3.19.something, tested on a Lenovo X250.
> And the commit is part of v4.0 (since rc5?), so I think that this bug can be
> closed.

It's also cc: stable so should show up in earlier releases eventually too. Thanks for the report and testing, closing.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.