https://bugs.freedesktop.org/show_bug.cgi?id=99515
Bug ID: 99515 Summary: SIGSEGV MAPERR on Android nougat-x86 with mesa 17.0.0rc Product: Mesa Version: 17.0 Hardware: x86-64 (AMD64) OS: other Status: NEW Severity: normal Priority: medium Component: Drivers/Gallium/radeonsi Assignee: dri-devel@lists.freedesktop.org Reporter: issor.oruam@gmail.com QA Contact: dri-devel@lists.freedesktop.org
Created attachment 129125 --> https://bugs.freedesktop.org/attachment.cgi?id=129125&action=edit Dmesg
Hi,
I've been seeying SIGSEGV MAPERR with radeonsi (HD7750 and HD7950) It can be triggered in various situations/primitives, like EGLSwapBuffersWithDamage, EGLterminate and others, but the crash has always the same outcome and backtrace.
I think it is important to highlight that the issue started happening with nougat, which uses multiple threads/render threads, as opposed to marshmallow which was using single threading and it is not affected.
Now this may have exposed a non thread safe path in radeonsi code, because other drivers (intel, nouveau with Ilia's draft locking patches) are not affected by this issue.
Dmesg, Logcat and addr2line log in the attachments Available to provide further info and to test patches, if needed. Mauro
--------- beginning of crash 01-21 19:30:40.195 1457 1457 F libc : Fatal signal 11 (SIGSEGV), code 1, fault addr 0x0 in tid 1457 (surfaceflinger) 01-21 19:30:40.195 1443 1443 W : debuggerd: handling request: pid=1457 uid=0 gid=1003 tid=1457 01-21 19:30:40.196 1743 1743 E : debuggerd: Unable to connect to activity manager (connect failed: No such file or directory) 01-21 19:30:40.246 1743 1743 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** 01-21 19:30:40.246 1743 1743 F DEBUG : Build fingerprint: 'Android-x86/android_x86_64/x86_64:7.1.1/NMF26O/utente12301216:eng/test-keys' 01-21 19:30:40.246 1743 1743 F DEBUG : Revision: '0' 01-21 19:30:40.246 1743 1743 F DEBUG : ABI: 'x86_64' 01-21 19:30:40.246 1743 1743 F DEBUG : pid: 1457, tid: 1457, name: surfaceflinger >>> /system/bin/surfaceflinger <<< 01-21 19:30:40.246 1743 1743 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 01-21 19:30:40.246 1743 1743 F DEBUG : rax 000077505a696cc0 rbx 000077505fa75a20 rcx 0000000000000000 rdx 0000000000000020 01-21 19:30:40.246 1743 1743 F DEBUG : rsi 0000000000000000 rdi 000077505a696cc0 01-21 19:30:40.246 1743 1743 F DEBUG : r8 ffffffffffffffd8 r9 0400050000000000 r10 0000000000000002 r11 0000000000000246 01-21 19:30:40.246 1743 1743 F DEBUG : r12 000077505fa75600 r13 0000000001000000 r14 000077505fa75a48 r15 000077505a6c3980 01-21 19:30:40.246 1743 1743 F DEBUG : cs 0000000000000033 ss 000000000000002b 01-21 19:30:40.246 1743 1743 F DEBUG : rip 000077505eb7b5f8 rbp 0000000000500000 rsp 00007ffea2d36c70 eflags 0000000000010206 01-21 19:30:40.326 1743 1743 F DEBUG : 01-21 19:30:40.326 1743 1743 F DEBUG : backtrace: 01-21 19:30:40.326 1743 1743 F DEBUG : #00 pc 000000000024f5f8 /system/lib64/dri/gallium_dri.so 01-21 19:30:40.326 1743 1743 F DEBUG : #01 pc 0000000000262843 /system/lib64/dri/gallium_dri.so
utente@utente-MS-7576:~/nougat-x86_kernel_49$ addr2line -Cfe out/target/product/x86_64/symbols/system/lib64/dri/gallium_dri.so 000000000024f5f8 list_add /proc/self/cwd/external/mesa/src/util/list.h:62 0000000000262843 pb_destroy /proc/self/cwd/external/mesa/src/gallium/auxiliary/pipebuffer/pb_buffer.h:232 0000000000260816
https://bugs.freedesktop.org/show_bug.cgi?id=99515
--- Comment #1 from Mauro Rossi issor.oruam@gmail.com --- Created attachment 129126 --> https://bugs.freedesktop.org/attachment.cgi?id=129126&action=edit Logcat
https://bugs.freedesktop.org/show_bug.cgi?id=99515
--- Comment #2 from Mauro Rossi issor.oruam@gmail.com --- Created attachment 129127 --> https://bugs.freedesktop.org/attachment.cgi?id=129127&action=edit addr2line log
https://bugs.freedesktop.org/show_bug.cgi?id=99515
--- Comment #3 from Mauro Rossi issor.oruam@gmail.com --- Created attachment 129239 --> https://bugs.freedesktop.org/attachment.cgi?id=129239&action=edit various EGL issues with addr2line logs
https://bugs.freedesktop.org/show_bug.cgi?id=99515
--- Comment #4 from Mauro Rossi issor.oruam@gmail.com --- Hi,
the problem has disappeared in the last week, I've seen a series of commits for radeonsi, but could some developer point out what changes have been done,
which may have corrected a NULL pointer dereference MAPERR at address 0x0 happening at list_add after a destroy_buffer_locked?
11-27 18:00:55.044 3215 3215 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
addr2list output (when issue was present)
utente@utente-MS-7576:~/nougat-x86_kernel_49$ addr2line -Cfe out/target/product/x86_64/symbols/system/lib64/dri/gallium_dri.so 245108 list_add /proc/self/cwd/external/mesa/src/util/list.h:62 5eb80e destroy_buffer_locked /proc/self/cwd/external/mesa/src/gallium/auxiliary/pipebuffer/pb_cache.c:50 248872 pb_destroy /proc/self/cwd/external/mesa/src/gallium/auxiliary/pipebuffer/pb_buffer.h:232 250044 r600_fence_reference /proc/self/cwd/external/mesa/src/gallium/drivers/radeon/r600_pipe_common.c:1072 2f5a8c dri_flush /proc/self/cwd/external/mesa/src/gallium/state_trackers/dri/dri_drawable.c:527 ^C
Besides closing this bug, the information is important in order to backport bug corrections in mesa 17.0.x and mesa 13.0.x
Mauro
https://bugs.freedesktop.org/show_bug.cgi?id=99515
--- Comment #5 from Mauro Rossi issor.oruam@gmail.com --- In the previous post is what happened with x86_64 nougat-x86 build, for all mesa 17.0.x cycle.
Here follows what still happens with mesa 17.0.3 with x86 build of nougat-x86. I hope by coupling these information of x86_64 and x86 build may help to figure out the issue.
Mauro
--------- beginning of crash 04-04 00:08:20.947 1528 1889 F libc : Fatal signal 11 (SIGSEGV), code 1, fault addr 0x8 in tid 1889 (Thread-2) 04-04 00:08:20.947 1234 1234 W : debuggerd: handling request: pid=1528 uid=1000 gid=1000 tid=1889 04-04 00:08:20.957 1902 1902 E : debuggerd: Unable to connect to activity manager (connect failed: No such file or directory) 04-04 00:08:20.957 1902 1902 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** 04-04 00:08:20.957 1902 1902 F DEBUG : Build fingerprint: 'Android-x86/android_x86/x86:7.1.1/NMF26O/utente01090017:eng/test-keys' 04-04 00:08:20.957 1902 1902 F DEBUG : Revision: '0' 04-04 00:08:20.957 1902 1902 F DEBUG : ABI: 'x86' 04-04 00:08:20.957 1902 1902 F DEBUG : pid: 1528, tid: 1889, name: Thread-2
system_server <<<
04-04 00:08:20.957 1902 1902 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8 04-04 00:08:20.957 1902 1902 F DEBUG : eax 00a44000 ebx 00000000 ecx 00000000 edx 903089c0 04-04 00:08:20.957 1902 1902 F DEBUG : esi 00000000 edi 9bf0eff4 04-04 00:08:20.957 1902 1902 F DEBUG : xcs 00000073 xds 0000007b xes 0000007b xfs 0000003b xss 0000007b 04-04 00:08:20.957 1902 1902 F DEBUG : eip 8d1e708f ebp 8df43048 esp 8df42fd0 flags 00010217 04-04 00:08:20.965 1902 1902 F DEBUG : 04-04 00:08:20.965 1902 1902 F DEBUG : backtrace: 04-04 00:08:20.965 1902 1902 F DEBUG : #00 pc 0022f08f /android/system/lib/dri/gallium_dri.so 04-04 00:08:20.965 1902 1902 F DEBUG : #01 pc 002318f3 /android/system/lib/dri/gallium_dri.so 04-04 00:08:20.965 1902 1902 F DEBUG : #02 pc 00245685 /android/system/lib/dri/gallium_dri.so 04-04 00:08:20.965 1902 1902 F DEBUG : #03 pc 00694298 /android/system/lib/dri/gallium_dri.so 04-04 00:08:20.965 1902 1902 F DEBUG : #04 pc 004c9853 /android/system/lib/dri/gallium_dri.so 04-04 00:08:20.965 1902 1902 F DEBUG : #05 pc 004cea9a /android/system/lib/dri/gallium_dri.so 04-04 00:08:20.965 1902 1902 F DEBUG : #06 pc 0044f289 /android/system/lib/dri/gallium_dri.so 04-04 00:08:20.965 1902 1902 F DEBUG : #07 pc 004ce687 /android/system/lib/dri/gallium_dri.so 04-04 00:08:20.965 1902 1902 F DEBUG : #08 pc 004595cb /android/system/lib/dri/gallium_dri.so 04-04 00:08:20.965 1902 1902 F DEBUG : #09 pc 004ce6e3 /android/system/lib/dri/gallium_dri.so 04-04 00:08:20.965 1902 1902 F DEBUG : #10 pc 0045b0ea /android/system/lib/dri/gallium_dri.so 04-04 00:08:20.965 1902 1902 F DEBUG : #11 pc 0000d276 /android/system/lib/libglapi.so 04-04 00:08:20.965 1902 1902 F DEBUG : #12 pc 000108af /android/system/lib/libandroid_servers.so 04-04 00:08:20.965 1902 1902 F DEBUG : #13 pc 00063d46 /android/data/dalvik-cache/x86/system@framework@services.jar@classes.dex (offset 0xc3f000)
utente@utente-desktop:~/nougat-x86$ addr2line -Cfe out/target/product/x86/symbols/system/lib/dri/gallium_dri.so 0022f08f /android/system/lib/dri/gallium_dri.so 002318f3 /android/system/lib/dri/gallium_dri.so 00245685 /android/system/lib/dri/gallium_dri.so 00694298 /android/system/lib/dri/gallium_dri.so 004c9853 /android/system/lib/dri/gallium_dri.so 004cea9a /android/system/lib/dri/gallium_dri.so 0044f289 /android/system/lib/dri/gallium_dri.so 004ce687 /android/system/lib/dri/gallium_dri.so 004595cb /android/system/lib/dri/gallium_dri.so 004ce6e3 /android/system/lib/dri/gallium_dri.so 0045b0ea /android/system/lib/dri/gallium_dri.so radeon_bomgr_free_va /proc/self/cwd/external/mesa/src/gallium/winsys/radeon/drm/radeon_drm_bo.c:289 radeon_bo_destroy_or_cache /proc/self/cwd/external/mesa/src/gallium/winsys/radeon/drm/radeon_drm_bo.c:399 pb_destroy /proc/self/cwd/external/mesa/src/gallium/auxiliary/pipebuffer/pb_buffer.h:232 u_resource_destroy_vtbl /proc/self/cwd/external/mesa/src/gallium/auxiliary/util/u_transfer.c:127 pipe_resource_reference /proc/self/cwd/external/mesa/src/gallium/auxiliary/util/u_inlines.h:141 st_FreeTextureImageBuffer /proc/self/cwd/external/mesa/src/mesa/state_tracker/st_cb_texture.c:187 _mesa_delete_texture_image /proc/self/cwd/external/mesa/src/mesa/main/teximage.c:189 st_DeleteTextureImage /proc/self/cwd/external/mesa/src/mesa/state_tracker/st_cb_texture.c:144 _mesa_delete_texture_object /proc/self/cwd/external/mesa/src/mesa/main/texobj.c:408 st_DeleteTextureObject /proc/self/cwd/external/mesa/src/mesa/state_tracker/st_cb_texture.c:171 _mesa_reference_texobj_ /proc/self/cwd/external/mesa/src/mesa/main/texobj.c:569 ^C
04-04 00:08:22.152 1907 1907 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** 04-04 00:08:22.153 1907 1907 F DEBUG : Build fingerprint: 'Android-x86/android_x86/x86:7.1.1/NMF26O/utente01090017:eng/test-keys' 04-04 00:08:22.153 1907 1907 F DEBUG : Revision: '0' 04-04 00:08:22.153 1907 1907 F DEBUG : ABI: 'x86' 04-04 00:08:22.153 1907 1907 F DEBUG : pid: 1515, tid: 1518, name: BootAnimation >>> /system/bin/bootanimation <<< 04-04 00:08:22.153 1907 1907 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x8 04-04 00:08:22.153 1907 1907 F DEBUG : eax 01500000 ebx 00000000 ecx 00000000 edx a1cc5040 04-04 00:08:22.153 1907 1907 F DEBUG : esi 00000000 edi a753b0f4 04-04 00:08:22.153 1907 1907 F DEBUG : xcs 00000073 xds 0000007b xes 0000007b xfs 00000000 xss 0000007b 04-04 00:08:22.153 1907 1907 F DEBUG : eip a250308f ebp a2d001e8 esp a2d00170 flags 00010217 04-04 00:08:22.159 1907 1907 F DEBUG : 04-04 00:08:22.159 1907 1907 F DEBUG : backtrace: 04-04 00:08:22.159 1907 1907 F DEBUG : #00 pc 0022f08f /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #01 pc 0063111a /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #02 pc 002318e9 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #03 pc 002382b1 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #04 pc 00694298 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #05 pc 002430a3 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #06 pc 00245668 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #07 pc 00694298 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #08 pc 002430a3 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #09 pc 002452b7 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #10 pc 00683274 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #11 pc 0021a0d5 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #12 pc 00608a99 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #13 pc 004b39e7 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #14 pc 004b23dd /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #15 pc 004bab58 /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #16 pc 0037418a /system/lib/dri/gallium_dri.so 04-04 00:08:22.159 1907 1907 F DEBUG : #17 pc 0000a7ee /system/lib/libglapi.so 04-04 00:08:22.159 1907 1907 F DEBUG : #18 pc 0000550b /system/bin/bootanimation 04-04 00:08:22.159 1907 1907 F DEBUG : #19 pc 000051ae /system/bin/bootanimation 04-04 00:08:22.159 1907 1907 F DEBUG : #20 pc 00012095 /system/lib/libutils.so (_ZN7android6Thread11_threadLoopEPv+309) 04-04 00:08:22.159 1907 1907 F DEBUG : #21 pc 00011883 /system/lib/libutils.so (_ZN13thread_data_t10trampolineEPKS_+259) 04-04 00:08:22.159 1907 1907 F DEBUG : #22 pc 000750c2 /system/lib/libc.so (_ZL15__pthread_startPv+210) 04-04 00:08:22.159 1907 1907 F DEBUG : #23 pc 000202de /system/lib/libc.so (__start_thread+30) 04-04 00:08:22.159 1907 1907 F DEBUG : #24 pc 0001e0b6 /system/lib/libc.so (__bionic_clone+70)
utente@utente-desktop:~/nougat-x86$ addr2line -Cfe out/target/product/x86/symbols/system/lib/dri/gallium_dri.so 0022f08f /system/lib/dri/gallium_dri.so 0063111a /system/lib/dri/gallium_dri.so 002318e9 /system/lib/dri/gallium_dri.so 002382b1 /system/lib/dri/gallium_dri.so 00694298 /system/lib/dri/gallium_dri.so 002430a3 /system/lib/dri/gallium_dri.so 00245668 /system/lib/dri/gallium_dri.so 00694298 /system/lib/dri/gallium_dri.so 002430a3 /system/lib/dri/gallium_dri.so 002452b7 /system/lib/dri/gallium_dri.so 00683274 /system/lib/dri/gallium_dri.so 0021a0d5 /system/lib/dri/gallium_dri.so 00608a99 /system/lib/dri/gallium_dri.so 004b39e7 /system/lib/dri/gallium_dri.so 004b23dd /system/lib/dri/gallium_dri.so 004bab58 /system/lib/dri/gallium_dri.so 0037418a /system/lib/dri/gallium_dri.so radeon_bomgr_free_va /proc/self/cwd/external/mesa/src/gallium/winsys/radeon/drm/radeon_drm_bo.c:289 destroy_buffer_locked /proc/self/cwd/external/mesa/src/gallium/auxiliary/pipebuffer/pb_cache.c:50 radeon_bo_destroy_or_cache /proc/self/cwd/external/mesa/src/gallium/winsys/radeon/drm/radeon_drm_bo.c:397 pb_destroy /proc/self/cwd/external/mesa/src/gallium/auxiliary/pipebuffer/pb_buffer.h:232 u_resource_destroy_vtbl /proc/self/cwd/external/mesa/src/gallium/auxiliary/util/u_transfer.c:127 pipe_resource_reference /proc/self/cwd/external/mesa/src/gallium/auxiliary/util/u_inlines.h:141 r600_resource_reference /proc/self/cwd/external/mesa/src/gallium/drivers/radeon/r600_pipe_common.h:865 u_resource_destroy_vtbl /proc/self/cwd/external/mesa/src/gallium/auxiliary/util/u_transfer.c:127 pipe_resource_reference /proc/self/cwd/external/mesa/src/gallium/auxiliary/util/u_inlines.h:141 r600_surface_destroy /proc/self/cwd/external/mesa/src/gallium/drivers/radeon/r600_texture.c:1822 pipe_surface_reference /proc/self/cwd/external/mesa/src/gallium/auxiliary/util/u_inlines.h:113 si_set_framebuffer_state /proc/self/cwd/external/mesa/src/gallium/drivers/radeonsi/si_state.c:2387 cso_set_framebuffer /proc/self/cwd/external/mesa/src/gallium/auxiliary/cso_cache/cso_context.c:712 update_framebuffer_state /proc/self/cwd/external/mesa/src/mesa/state_tracker/st_atom_framebuffer.c:213 st_validate_state /proc/self/cwd/external/mesa/src/mesa/state_tracker/st_atom.c:219 (discriminator 1) st_Clear /proc/self/cwd/external/mesa/src/mesa/state_tracker/st_cb_clear.c:409 _mesa_Clear /proc/self/cwd/external/mesa/src/mesa/main/clear.c:224 ^C
https://bugs.freedesktop.org/show_bug.cgi?id=99515
Mauro Rossi issor.oruam@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED
--- Comment #6 from Mauro Rossi issor.oruam@gmail.com --- Hi,
commit ce27b27 "radeon: initialize hole variable before calling container_of" solves the issue and should be backported to mesa 13.0 and mesa 17.0 branches to have this bug resolved in next maintenance releases.
Tested with nougat-x86 on HD7750 and HD7950
Mauro
dri-devel@lists.freedesktop.org
-
bugzilla-daemon＠freedesktop.org