[Bug 29065] New: X segfault due to radeon trying to process in reqblank on a client that is freed

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=29065

           Summary: X segfault due to radeon trying to process in reqblank
                    on a client that is freed
           Product: xorg
           Version: git
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Driver/Radeon
        AssignedTo: xorg-driver-ati at lists.x.org
        ReportedBy: prahal at yahoo.com
         QAContact: xorg-team at lists.x.org


Created an attachment (id=37054)
 View: https://bugs.freedesktop.org/attachment.cgi?id=37054
 Review: https://bugs.freedesktop.org/review?bug=29065&attachment=37054

hack to show the random freed values instead of crashing.

radeon send vblank to the kernel with a client pointer in a structure
vblwait.request.signal . The client dies , the X server detects it is not
responding in its loop. Xserver calls client gone. Client and its pixmaps are
freed. The kernel send back the vblank interrupt to xf86 video radeon . In its
dri2 handle frame event radeon tries to process the drawable as if the client
structure and pixmaps ones were still at their old location (saved into the
vblwait passed to the kernel).

I did not switched to drm-next kernel. Will try asap to see if this bug is not
by me missing something as told by
https://bugs.freedesktop.org/show_bug.cgi?id=28410#c28 .

I made a hack that avoid the crash (attached) and prints the funky values that
are at the old location.
Fastest way to reproduce was to use gnome-screensaver-preferences and to switch
opengl screensavers (it looks like each preview of screeensaver is a client and
switching kills the previous one ).

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.