kern/49838: radeon drm2 kernel panic

[tnn%nygren.pp.se@localhost]

>Number:         49838
>Category:       kern
>Synopsis:       radeon drm2 kernel panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Apr 13 10:20:00 +0000 2015
>Originator:     Tobias Nygren
>Release:        current
>Organization:
>Environment:
7.99.9 amd64 Sun Apr 12 21:37:21 CEST 2015
>Description:
This happened while I was messing with the "teapot" demo from MesaDemos.
The teapot demo itself crashes after a few seconds, so this panic is possibly related to client getting untimely SIGSEGV.

rb_tree_iterate() at netbsd:rb_tree_iterate+0x1a6
drm_vma_offset_remove() at netbsd:drm_vma_offset_remove+0x2d
ttm_bo_unref() at netbsd:ttm_bo_unref+0x79
radeon_bo_unref() at netbsd:radeon_bo_unref+0x3d
radeon_gem_object_free() at netbsd:radeon_gem_object_free+0x1c
drm_gem_object_handle_unreference_unlocked() at netbsd:drm_gem_object_handle_unreference_unlocked+0xf5
drm_gem_handle_delete() at netbsd:drm_gem_handle_delete+0x86
drm_ioctl() at netbsd:drm_ioctl+0x14f
sys_ioctl() at netbsd:sys_ioctl+0x2c5
syscall() at netbsd:syscall+0xb2

>How-To-Repeat:
Using wip versions of MesaLib, xorg-server, run ./teapot from graphics/MesaDemos repeatedly on Radeon HD 5450.

teapot crashes after a few seconds with the following, sometimes takes kernel with it:

0  0x00007f7ff1528a2f in memcpy () from /usr/lib/libc.so.12
#1  0x00007f7ff077b1a4 in u_upload_data () from /usr/pkg/lib/dri/r600_dri.so
#2  0x00007f7ff0992a87 in r600_set_constant_buffer ()
   from /usr/pkg/lib/dri/r600_dri.so
#3  0x00007f7ff070a5d2 in cso_set_constant_buffer ()
   from /usr/pkg/lib/dri/r600_dri.so
#4  0x00007f7ff05f5aaa in st_upload_constants ()
   from /usr/pkg/lib/dri/r600_dri.so
#5  0x00007f7ff05f588f in st_validate_state ()
   from /usr/pkg/lib/dri/r600_dri.so
#6  0x00007f7ff060a735 in st_draw_vbo () from /usr/pkg/lib/dri/r600_dri.so
#7  0x00007f7ff05e1d10 in vbo_exec_vtx_flush ()
   from /usr/pkg/lib/dri/r600_dri.so
#8  0x00007f7ff05c8aaa in vbo_exec_FlushVertices ()
   from /usr/pkg/lib/dri/r600_dri.so
#9  0x00007f7ff04c81ec in _mesa_set_enable () from /usr/pkg/lib/dri/r600_dri.so
#10 0x0000000000403939 in draw ()
#11 0x00007f7ff741fb4c in processWindowWorkList ()
   from /usr/pkg/lib/libglut.so.3
#12 0x00007f7ff741e6b3 in glutMainLoop () from /usr/pkg/lib/libglut.so.3
#13 0x000000000040327b in main ()

>Fix:
unknown