<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Segfault after munmap(kms_sw_dt->ro_mapped)"
href="https://bugs.freedesktop.org/show_bug.cgi?id=107098">107098</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Segfault after munmap(kms_sw_dt->ro_mapped)
</td>
</tr>
<tr>
<th>Product</th>
<td>Mesa
</td>
</tr>
<tr>
<th>Version</th>
<td>18.0
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86-64 (AMD64)
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux (All)
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>Other
</td>
</tr>
<tr>
<th>Assignee</th>
<td>mesa-dev@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>jpalus@fastmail.com
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>mesa-dev@lists.freedesktop.org
</td>
</tr></table>
<p>
<div>
<pre>Recently I've done a big update in my Linux guest running under VirtualBox
(Mesa 18.1.2, xorg server 1.20, kernel 4.17) and found X server segfaulting.
Linux guest inside VirtualBox runs modesetting driver, backed by vboxvideo KMS
driver and from what I understand modesetting is trying to use gallium
acceleration through swrast (I'm not really fluent in graphic stack so please
excuse me if I'm using some terms incorrectly).
After few debugging sessions, in which places of segfault were different
depending on glibc version, it appears the problem is caused by line in
kms_dri_sw_winsys.c:
munmap(kms_sw_dt->ro_mapped, kms_sw_dt->size);
Judging by code kms_sw_dt->mapped / kms_sw_dt->ro_mapped are expected to be not
NULL if they point to mmaped memory or NULL otherwise. Now the problem is that
in my case kms_sw_dt->ro_mapped is NULL, so probably munmap() call is expected
to be a no-op, however it does not seem to be the case. On the contrary it
screws entire process big time, as if it unmapped process memory? All pointers
are no longer valid and it seems first dereference afterwards throws segfault.
With newer glibc it even occurs within symbol lookup mechanism.
Two things worked for me as a workaround:
* setting AccelMethod=none
* adding condition on above munmap() to call it only if ro_mapped is not NULL
Now I can't really tell if it's ok whether kms_sw_dt->ro_mapped is NULL, or how
should munmap() behave when called with NULL. Perhaps there should be a flag
whether mmap() was performed instead of relying on pointer value.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>