https://bugs.freedesktop.org/show_bug.cgi?id=36255

Summary: [r128] Kernel panic after killing X since 2.6.37 Product: DRI Version: unspecified Platform: x86 (IA32) OS/Version: Linux (All) Status: NEW Severity: major Priority: medium Component: DRM/other AssignedTo: dri-devel@lists.freedesktop.org ReportedBy: connor.behan@gmail.com

Created an attachment (id=45651) --> (https://bugs.freedesktop.org/attachment.cgi?id=45651) Dmesg output

I have seen this bug in kernels 2.6.38, 2.6.37 and NOT 2.6.36. Every time I quit the Xserver using the Xfce session manager, the message printed on the console it returns to is:

EIP: [<e168ef557>] r128_driver_irq_handler +0x15/0x50 [r128] SS:ESP 0068:df007fac CR2: 00000000e08c8044 --- [ end trace 632129fdd65eae19 ] --- Kernel panic - not syncing: Fatal exception in interrupt Pid: 0, comm: swapper tainted: G D 2.6.38-ARCH #1 Call trace:

*some calls including r128_driver_irq_handler and other IRQ functions*

And I have to reboot with Alt+SysRq+REISUB. This only happens when I quit X using the functions in the Xfce session manager. The return to the console will be fine if I use Ctrl+Alt+Backspace, "sudo killall X", or Ctrl+Alt+F1 followed by Ctrl+C. I admit that this is vague information but I simply cannot get an answer our of the Xfce developers as to what function is being used.

From the look I had at the xfce4-session source code I would guess that the

logout is being done with libICE. I know it is not being done with Hal, Consolekit or the XKillClient Xlib function. I will update this bug report as soon as I know which function causes this and have a testcase ready. If you think it will lead to a fix I would be willing to use a pencil and paper to write out the exact call trace in the kernel panic (which I have no way of copying or pasting).