[Bug 354688] Re: crash in drm_intel_gem_bo_start_gtt_access

[Albert Damen]

The problem is in xxv-intel, src/i830_video.c
In I830PutImage:
    if (pPriv->buf == NULL) {
        pPriv->buf = drm_intel_bo_alloc(pI830->bufmgr,
                                        "xv buffer", alloc_size, 4096);
        if (pPriv->buf == NULL)
            return BadAlloc;
        if (!pPriv->textured && drm_intel_bo_pin(pPriv->buf, 4096) != 0) {
            drm_intel_bo_unreference(pPriv->buf);
            xf86DrvMsg(pScrn->scrnIndex, X_ERROR,
                       "Failed to pin xv buffer\n");
            return BadAlloc;
        }
    }

The first time totem is run, pPriv->buf is NULL, a buffer is allocated and, given the failed to pin error message, pPriv->buf is now not NULL. drm_intel_bo_unreference frees the buffer, but does not set pPriv->buf back to NULL.
Therefore, next time totem is run, -intel will think we have a valid xv buffer and crash.

Attached patch solves the problem and makes totem return the BadAlloc
error message every time. X no longer crashes.

As the same problem exists in git master, I will forward the bug and
patch upstream.

** Attachment added: "119_fix_crash_xv_large_virtual_size.patch"
   http://launchpadlibrarian.net/24835958/119_fix_crash_xv_large_virtual_size.patch

** Package changed: xorg (Ubuntu Jaunty) => xserver-xorg-video-intel
(Ubuntu Jaunty)

-- 
crash in drm_intel_gem_bo_start_gtt_access
https://bugs.launchpad.net/bugs/354688
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

-- 
ubuntu-bugs mailing list
ubuntu-bugs at lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs