gen3: GNOME Shell triggers a bus error - unhandled error in i915_error_to_vmf_fault
Opening the status menu in GNOME Shell together with other intensive OpenGL software (e.g. VLC playback, WebGL app, or even Glamor under Xorg) triggers a kernel error randomly and crashes the application or Xorg with bus error. It happens both under Xorg and Wayland.
dmesg log with debug information: i915-dmesg.log
Hardware:
00:02.1 Display controller: Intel Corporation 82Q35 Express Integrated Graphics Controller (rev 02)
Renderer: Mesa (Gallium) i915 (chipset: Q35)
Package versions:
- Linux kernel 6.5.5
- mesa 23.2.1
- xorg-server 21.1.8
- mutter 44.5
- gnome-shell 44.5
Architecture: x86_64, distribution: Arch Linux
Kernel output:
------------[ cut here ]------------
unhandled error in i915_error_to_vmf_fault: -105
WARNING: CPU: 1 PID: 1003 at drivers/gpu/drm/i915/gem/i915_gem_mman.c:224 i915_error_to_vmf_fault+0x72/0x80 [i915]
Modules linked in: ntfs3 snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_tables ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security rfkill nfnetlink ip6table_filter ip6_tables iptable_filter snd_hda_codec_analog snd_hda_codec_generic ledtrig_audio snd_hda_intel snd_intel_dspcfg coretemp snd_intel_sdw_acpi snd_hda_codec kvm_intel snd_hda_core snd_hwdep kvm snd_pcm dcdbas at24 iTCO_wdt intel_pmc_bxt snd_timer iTCO_vendor_support ppdev e1000e irqbypass i2c_i801 snd i2c_smbus acpi_cpufreq pcspkr soundcore lpc_ich joydev mousedev parport_pc parport mac_hid fuse crypto_user dm_mod loop zram ip_tables x_tables btrfs blake2b_generic libcrc32c crc32c_generic xor raid6_pq i915 i2c_algo_bit drm_buddy video wmi ttm drm_display_helper sr_mod cdrom sha512_ssse3 cec intel_agp
intel_gtt usbhid
CPU: 1 PID: 1003 Comm: Xorg Not tainted 6.5.5-arch1-1 #1 d82a0f532dd8cfe67d5795c1738d9c01059a0c62
Hardware name: Dell Inc. OptiPlex 755 /0DR845, BIOS A22 06/11/2012
RIP: 0010:i915_error_to_vmf_fault+0x72/0x80 [i915]
Code: 74 0c ba 02 00 00 00 89 d0 c3 cc cc cc cc 89 fa 48 c7 c6 20 d2 83 c0 48 c7 c7 af 81 8b c0 c6 05 b3 ff 16 00 01 e8 7e c7 6b e3 <0f> 0b eb d4 ba 00 01 00 00 eb bd 0f 1f 00 90 90 90 90 90 90 90 90
RSP: 0000:ffff961443423c70 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88cd8a40ba80 RCX: 0000000000000027
RDX: ffff88ce31e616c8 RSI: 0000000000000001 RDI: ffff88ce31e616c0
RBP: ffff961443423ce0 R08: 0000000000000000 R09: ffff961443423b00
R10: 0000000000000003 R11: ffffffffa5aca068 R12: ffff88cd89052440
R13: ffff88cd88286028 R14: ffff88cd8a40bcf8 R15: 00000000ffffff97
FS: 00007f50fbd88480(0000) GS:ffff88ce31e40000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f50ed803008 CR3: 0000000138b58000 CR4: 00000000000406e0
Call Trace:
<TASK>
? i915_error_to_vmf_fault+0x72/0x80 [i915 c62d49fa53167f90a3280a66c63ec0fbf9e6a292]
? __warn+0x81/0x130
? i915_error_to_vmf_fault+0x72/0x80 [i915 c62d49fa53167f90a3280a66c63ec0fbf9e6a292]
? report_bug+0x171/0x1a0
? prb_read_valid+0x1b/0x30
? handle_bug+0x3c/0x80
? exc_invalid_op+0x17/0x70
? asm_exc_invalid_op+0x1a/0x20
? i915_error_to_vmf_fault+0x72/0x80 [i915 c62d49fa53167f90a3280a66c63ec0fbf9e6a292]
vm_fault_gtt+0x118/0x780 [i915 c62d49fa53167f90a3280a66c63ec0fbf9e6a292]
? do_set_pte+0x13d/0x280
__do_fault+0x33/0x130
do_fault+0xdd/0x3d0
__handle_mm_fault+0x65b/0xbb0
handle_mm_fault+0x155/0x350
do_user_addr_fault+0x203/0x640
exc_page_fault+0x7f/0x180
asm_exc_page_fault+0x26/0x30
RIP: 0033:0x7f50fc7dd86d
Code: 40 76 df 48 89 f9 48 29 f1 48 39 d1 72 45 44 0f 10 44 16 e0 44 0f 10 4c 16 d0 83 e1 0f 49 89 f1 48 01 ce 48 83 e6 f0 0f 28 0e <0f> 11 07 48 3b 15 b1 49 06 00 77 57 4c 8d 44 17 c0 48 83 e7 f0 ba
RSP: 002b:00007fff36961948 EFLAGS: 00010206
RAX: 00007f50ed803000 RBX: 00007f50e7804380 RCX: 0000000000000000
RDX: 0000000000001680 RSI: 00007f50e7802d00 RDI: 00007f50ed803000
RBP: 0000000000000003 R08: 00007f50ed802640 R09: 00007f50e7802d00
R10: 0000000000000004 R11: 0000000000001680 R12: 0000000000000384
R13: 0000000000001680 R14: 0000000000001680 R15: 0000000000002000
</TASK>
---[ end trace 0000000000000000 ]---Xorg log:
(EE)
(EE) Backtrace:
(EE) 0: /usr/lib/Xorg (dri3_send_open_reply+0xdd) [0x560903e813bd]
(EE) 1: /usr/lib/libc.so.6 (__sigaction+0x50) [0x7f50fc6a8710]
(EE) 2: /usr/lib/libc.so.6 (__nss_database_lookup+0x1c13d) [0x7f50fc7dd86d]
(EE) 3: /usr/lib/dri/i915_dri.so (__driDriverGetExtensions_d3d12+0x5926a) [0x7f50f95221aa]
(EE) 4: /usr/lib/dri/i915_dri.so (nouveau_drm_screen_create+0x2741fc) [0x7f50f9f77afc]
(EE) 5: /usr/lib/dri/i915_dri.so (nouveau_drm_screen_create+0xb1fc3) [0x7f50f9db58c3]
(EE) 6: /usr/lib/dri/i915_dri.so (__driDriverGetExtensions_d3d12+0xb2402) [0x7f50f957b342]
(EE) 7: /usr/lib/dri/i915_dri.so (__driDriverGetExtensions_d3d12+0x7aa1d) [0x7f50f954395d]
(EE) 8: /usr/lib/dri/i915_dri.so (__driDriverGetExtensions_d3d12+0x836dd) [0x7f50f954c61d]
(EE) 9: /usr/lib/dri/i915_dri.so (__driDriverGetExtensions_d3d12+0x837cc) [0x7f50f954c70c]
(EE) 10: /usr/lib/xorg/modules/libglamoregl.so (glamor_pixmap_exchange_fbos+0x40c2) [0x7f50fb92a282]
(EE) 11: /usr/lib/xorg/modules/libglamoregl.so (glamor_finish+0x175a) [0x7f50fb91123a]
(EE) 12: /usr/lib/xorg/modules/libglamoregl.so (glamor_finish+0x1e8d) [0x7f50fb91196d]
(EE) 13: /usr/lib/Xorg (miCopyRegion+0x96) [0x560903d70566]
(EE) 14: /usr/lib/Xorg (miDoCopy+0x4a6) [0x560903d73446]
(EE) 15: /usr/lib/xorg/modules/libglamoregl.so (glamor_copy_window+0x1d8) [0x7f50fb90a2d8]
(EE) 16: /usr/lib/Xorg (RRXineramaExtensionInit+0x1917) [0x560903df3977]
(EE) 17: /usr/lib/Xorg (SendGraphicsExpose+0x334) [0x560903d9e954]
(EE) 18: /usr/lib/Xorg (SProcXkbDispatch+0x28ab) [0x560903d64fae]
(EE) 19: /usr/lib/libc.so.6 (__libc_init_first+0x90) [0x7f50fc691cd0]
(EE) 20: /usr/lib/libc.so.6 (__libc_start_main+0x8a) [0x7f50fc691d8a]
(EE) 21: /usr/lib/Xorg (_start+0x25) [0x560903d65565]
(EE)
(EE) Bus error at address 0x7f50ed803008
(EE)
Fatal server error:
(EE) Caught signal 7 (Bus error). Server abortingStack trace:
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
tid = <optimized out>
ret = 0
pd = <optimized out>
old_mask = {__val = {0}}
ret = <optimized out>
#1 0x00007f50fc6f88a3 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
#2 0x00007f50fc6a8668 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret = <optimized out>
#3 0x00007f50fc6904b8 in __GI_abort () at abort.c:79
save_stage = 1
act = {__sigaction_handler = {sa_handler = 0x20, sa_sigaction = 0x20}, sa_mask = {__val = {32, 139985810624624, 94596720203127, 171515904, 139985809233443, 94596736874064, 94596736874064, 2, 0, 0, 0, 0, 0, 0, 0, 1}}, sa_flags = 0, sa_restorer = 0x0}
#4 0x0000560903e795b0 in OsAbort () at ../xorg-server-21.1.8/os/utils.c:1352
#5 0x0000560903e7af9b in AbortServer () at ../xorg-server-21.1.8/os/log.c:879
args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7fff369614a0, reg_save_area = 0x7fff369613d0}}
args2 = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 0x7fff369614a0, reg_save_area = 0x7fff369613d0}}
beenhere = 1
#6 FatalError (f=f@entry=0x560903f14340 "Caught signal %d (%s). Server aborting\n") at ../xorg-server-21.1.8/os/log.c:1017
args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7fff369614a0, reg_save_area = 0x7fff369613d0}}
args2 = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 0x7fff369614a0, reg_save_area = 0x7fff369613d0}}
beenhere = 1
#7 0x0000560903e81416 in OsSigHandler (unused=<optimized out>, sip=<optimized out>, signo=7) at ../xorg-server-21.1.8/os/osinit.c:156
#8 OsSigHandler (signo=7, sip=<optimized out>, unused=<optimized out>) at ../xorg-server-21.1.8/os/osinit.c:110
#9 0x00007f50fc6a8710 in <signal handler called> () at /usr/lib/libc.so.6
#10 __memcpy_ssse3 () at ../sysdeps/x86_64/multiarch/memmove-ssse3.S:152
#11 0x00007f50f95221aa in memcpy () at /usr/include/bits/string_fortified.h:29
#12 util_copy_rect () at ../mesa/src/util/format/u_format.c:91
#13 0x00007f50f9f77afc in util_copy_box () at ../mesa/src/gallium/auxiliary/util/u_surface.c:78
#14 u_default_texture_subdata() () at ../mesa/src/gallium/auxiliary/util/u_transfer.c:103
#15 0x00007f50f9db58c3 in i915_texture_subdata() () at ../mesa/src/gallium/drivers/i915/i915_resource_texture.c:903
#16 0x00007f50f957b342 in st_TexSubImage() () at ../mesa/src/mesa/state_tracker/st_cb_texture.c:2134
#17 0x00007f50f954395d in texture_sub_image() () at ../mesa/src/mesa/main/teximage.c:3771
#18 0x00007f50f954c61d in texsubimage_err() () at ../mesa/src/mesa/main/teximage.c:3829
#19 0x00007f50f954c70c in _mesa_TexSubImage2D() () at ../mesa/src/mesa/main/teximage.c:4051
#20 0x00007f50fb92a282 in glamor_upload_boxes
(pixmap=<optimized out>, in_boxes=0x7fff36962270, in_nbox=1, dx_src=0, dy_src=0, dx_dst=<optimized out>, dy_dst=0, bits=0x7f50e7800000 "", byte_stride=5760)
at ../xorg-server-21.1.8/glamor/glamor_transfer.c:75
x2 = <optimized out>
y1 = 0
x1 = 0
y2 = <optimized out>
box = 0x560905ee4468
fbo = <optimized out>
boxes = 0x7fff36962278
nbox = <optimized out>
screen = <optimized out>
glamor_priv = 0x560904fa8c20
priv = <optimized out>
box_index = <optimized out>
bytes_per_pixel = 4
f = <optimized out>
#21 0x00007f50fb91123a in glamor_copy_cpu_fbo
(closure=0x0, bitplane=<optimized out>, upsidedown=0, reverse=0, dy=0, dx=0, nbox=1, box=0x7fff36962270, gc=0x0, dst=0x560905b7ba30, src=0x5609057f2580)
at ../xorg-server-21.1.8/glamor/glamor_copy.c:269
src_stride = <optimized out>
src_bpp = <optimized out>
src_xoff = <optimized out>
src_bits = <optimized out>
src_yoff = <optimized out>
screen = 0x560904fa7310
dst_yoff = <optimized out>
glamor_priv = <optimized out>
dst_pixmap = <optimized out>
dst_xoff = 0
src_pixmap = <optimized out>
dst_pixmap = <optimized out>
src_priv = <optimized out>
dst_priv = <optimized out>
#22 glamor_copy_gl
(src=src@entry=0x5609057f2580, dst=dst@entry=0x560905b7ba30, gc=gc@entry=0x5609060b3a80, box=box@entry=0x7fff36962270, nbox=nbox@entry=1, dx=dx@entry=0, dy=0, reverse=0, upsidedown=0, bitplane=0, closure=0x0) at ../xorg-server-21.1.8/glamor/glamor_copy.c:714
src_pixmap = <optimized out>
dst_pixmap = <optimized out>
src_priv = <optimized out>
dst_priv = <optimized out>
#23 0x00007f50fb91196d in glamor_copy (closure=0x0, bitplane=0, upsidedown=0, reverse=0, dy=0, dx=0, nbox=1, box=0x7fff36962270, gc=0x5609060b3a80, dst=0x560905b7ba30, src=0x5609057f2580)
at ../xorg-server-21.1.8/glamor/glamor_copy.c:741
#24 glamor_copy (src=0x5609057f2580, dst=0x560905b7ba30, gc=0x5609060b3a80, box=0x7fff36962270, nbox=1, dx=0, dy=0, reverse=0, upsidedown=0, bitplane=0, closure=0x0)
at ../xorg-server-21.1.8/glamor/glamor_copy.c:726
#25 0x0000560903d70566 in miCopyRegion
(pSrcDrawable=pSrcDrawable@entry=0x5609057f2580, pDstDrawable=pDstDrawable@entry=0x560905b7ba30, pGC=pGC@entry=0x5609060b3a80, pDstRegion=pDstRegion@entry=0x7fff36962270, dx=dx@entry=0, dy=dy@entry=0, copyProc=0x7f50fb9118f0 <glamor_copy>, bitPlane=0, closure=0x0) at ../xorg-server-21.1.8/mi/micopy.c:121
careful = <optimized out>
reverse = <optimized out>
upsidedown = <optimized out>
pbox = 0x7fff36962270
nbox = <optimized out>
pboxNew1 = <optimized out>
pboxNew2 = <optimized out>
pboxBase = <optimized out>
pboxNext = <optimized out>
pboxTmp = <optimized out>
#26 0x0000560903d73446 in miDoCopy
(pSrcDrawable=0x5609057f2580, pDstDrawable=0x560905b7ba30, pGC=0x5609060b3a80, xIn=0, yIn=0, widthSrc=1440, heightSrc=900, xOut=0, yOut=0, copyProc=0x7f50fb9118f0 <glamor_copy>, bitPlane=0, closure=0x0) at ../xorg-server-21.1.8/mi/micopy.c:294
prgnSrcClip = 0x0
freeSrcClip = 0
prgnExposed = 0x0
rgnDst = {extents = {x1 = 0, y1 = 0, x2 = 1440, y2 = 900}, data = 0x0}
dx = 0
dy = 0
box_x1 = <optimized out>
box_y1 = <optimized out>
box_x2 = <optimized out>
box_y2 = <optimized out>
fastSrc = <optimized out>
fastDst = <optimized out>
fastExpose = <optimized out>
#27 0x00007f50fb90a2d8 in glamor_copy_area
(src=<optimized out>, dst=<optimized out>, gc=<optimized out>, srcx=<optimized out>, srcy=<optimized out>, width=<optimized out>, height=900, dstx=0, dsty=0)
at ../xorg-server-21.1.8/glamor/glamor_copy.c:750
#28 0x0000560903df3977 in damageCopyArea (pSrc=0x5609057f2580, pDst=0x560905b7ba30, pGC=0x5609060b3a80, srcx=0, srcy=<optimized out>, width=<optimized out>, height=900, dstx=0, dsty=0)
at ../xorg-server-21.1.8/miext/damage/damage.c:775
ret = <optimized out>
pGCPriv = 0x5609060b3b10
oldFuncs = 0x560903f86ec0 <damageGCFuncs>
#29 0x0000560903d9e954 in ProcCopyArea (client=0x560905dbf4e0) at ../xorg-server-21.1.8/dix/dispatch.c:1789
pDst = 0x560905b7ba30
pSrc = <optimized out>
pGC = 0x5609060b3a80
stuff = <optimized out>
pRgn = <optimized out>
rc = <optimized out>
#30 0x0000560903d64fae in Dispatch () at ../xorg-server-21.1.8/dix/dispatch.c:550
result = <optimized out>
client = 0x560905dbf4e0
start_tick = 715
i = <optimized out>
alwaysCheckForInput = {0, 1}
#31 dix_main (envp=<optimized out>, argv=0x7fff36962638, argc=15) at ../xorg-server-21.1.8/dix/main.c:272
i = <optimized out>
alwaysCheckForInput = {0, 1}
#32 main (argc=15, argv=0x7fff36962638, envp=<optimized out>) at ../xorg-server-21.1.8/dix/stubmain.c:34
``Edited by Balló György