[Bug 104642] Android: NULL pointer dereference with i965 mesa-dev, seems build_id_length related

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=104642

            Bug ID: 104642
           Summary: Android: NULL pointer dereference with i965 mesa-dev,
                    seems build_id_length related
           Product: Mesa
           Version: git
          Hardware: x86-64 (AMD64)
                OS: other
            Status: NEW
          Severity: blocker
          Priority: medium
         Component: Drivers/DRI/i965
          Assignee: intel-3d-bugs at lists.freedesktop.org
          Reporter: issor.oruam at gmail.com
        QA Contact: intel-3d-bugs at lists.freedesktop.org

Created attachment 136731
  --> https://bugs.freedesktop.org/attachment.cgi?id=136731&action=edit
logcat with chrome app crash

Hi,

while testing Android 8.1 build with latest mesa 17.4.0devel and libdrm 2.4.89

SIGSEGV MAPERR due to NULL pointer dereference happens with Chrome (and Firefox
browser) apps, here is logcat extract for chrome


--------- beginning of crash
... F libc    : Fatal signal 11 (SIGSEGV), code 1, fault addr 0x4 in tid 4851
(RenderThread), pid 4503 (.android.chrome)
... I crash_dump32: obtaining output fd from tombstoned, type:
kDebuggerdTombstone
... I /system/bin/tombstoned: received crash request for pid 4503
... I crash_dump32: performing dump of process 4503 (target tid = 4851)
... F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
... F DEBUG   : Build fingerprint:
'Android-x86/android_x86_64/x86_64:8.1.0/OPM1.171019.011/utente12162000:eng/test-keys'
... F DEBUG   : Revision: '0'
... F DEBUG   : ABI: 'x86'
... F DEBUG   : pid: 4503, tid: 4851, name: RenderThread  >>>
com.android.chrome <<<
... F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x4
... F DEBUG   : Cause: null pointer dereference
... F DEBUG   :     eax 00000000  ebx cca69cf4  ecx 00000009  edx bfbff004
... F DEBUG   :     esi 00000000  edi 00000010
... F DEBUG   :     xcs 00000023  xds 0000002b  xes 0000002b  xfs 0000006b  xss
0000002b
... F DEBUG   :     eip cc78d089  ebp bfbfefb8  esp bfbfefb8  flags 00010286
... F DEBUG   : 
... F DEBUG   : backtrace:
... F DEBUG   :     #00 pc 00651089  /system/vendor/lib/dri/i965_dri.so
(build_id_length+9)
... F DEBUG   :     #01 pc 00041ae2  /system/vendor/lib/dri/i965_dri.so
(brw_program_binary_init+130)
... F DEBUG   :     #02 pc 0002dd50  /system/vendor/lib/dri/i965_dri.so
(brwCreateContext+864)
... F DEBUG   :     #03 pc 003d7777  /system/vendor/lib/dri/i965_dri.so
(driCreateContextAttribs+663)
... F DEBUG   :     #04 pc 000112a1 
/android/system/vendor/lib/egl/libGLES_mesa.so
... F DEBUG   :     #05 pc 00004096 
/android/system/vendor/lib/egl/libGLES_mesa.so
... F DEBUG   :     #06 pc 0000ef37  /android/system/lib/libEGL.so


Analysing the backtrace with addr2line the NULL pointer is retured at 
src/util/build_id.c:117

utente at utente-Terabyte:~/oreo-x86_kernel_test$ addr2line -Cfe
out/target/product/x86_64/symbols/system/vendor/lib/dri/i965_dri.so
00651089
build_id_length
external/mesa/src/util/build_id.c:117  <= here it is
00041ae2
brw_program_binary_init
external/mesa/src/mesa/drivers/dri/i965/brw_program_binary.c:53
0002dd50
brw_init_driver_functions
external/mesa/src/mesa/drivers/dri/i965/brw_context.c:334
003d7777
driCreateContextAttribs
external/mesa/src/mesa/drivers/dri/common/dri_util.c:479


utente at utente-Terabyte:~/oreo-x86_kernel_test$ addr2line -Cfe
out/target/product/x86_64/symbols/system/vendor/lib/egl/libGLES_mesa.so
000112a1
dri2_create_context
external/mesa/src/egl/drivers/dri2/egl_dri2.c:1332
00004096
eglCreateContext
external/mesa/src/egl/main/eglapi.c:767


utente at utente-Terabyte:~/oreo-x86_kernel_test$ addr2line -Cfe
out/target/product/x86_64/symbols/system/lib/libEGL.so
0000ef37
eglCreateContext
frameworks/native/opengl/libs/EGL/eglApi.cpp:896


Recent changes in src/util/build_id.c may have removed some Android required
code, or i965 needs to take into account the NULL case.

Thanks for feedback
Mauro

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/intel-3d-bugs/attachments/20180115/02d5d542/attachment.html>