xsrc/56966: X server segfault in radeon_bo_is_referenced_by_cs

[dholland%NetBSD.org@localhost]

>Number:         56966
>Category:       xsrc
>Synopsis:       X server segfault in radeon_bo_is_referenced_by_cs
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    xsrc-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Aug 16 19:50:00 +0000 2022
>Originator:     David A. Holland
>Release:        NetBSD 9.99.97 (20220602)
>Organization:
>Environment:
System: NetBSD valkyrie 9.99.97 NetBSD 9.99.97 (VALKYRIE) #9: Thu Jun  2 20:39:54 EDT 2022  dholland@valkyrie:/usr/src/sys/arch/amd64/compile/VALKYRIE amd64
Architecture: x86_64
Machine: amd64
>Description:

Got up in the morning to find the console mostly unresponsive (monitor
in powersave, not waking up in response to mouse or keyboard) but it
responded to VT switch, and on one of the consoles that had had an X
server running I found a backtrace from an X server segfault.

First it had:

	Failed to allocate:
	size      : 8192 bytes
	alignment : 512 bytes
	domains   : 4

then

(EE)
(EE) Backtrace:
(EE)
(EE) 0: /usr/X11R7/bin/X (xorg_backtrace+0x44) [0x1bedc602b]
   :
(EE)
(EE) Segmentation fault at 0x1c
(EE)
Fatal server error:
(EE) Caught signal 11 (Segmentation fault). Server aborting

and some further uninteresting stuff, then a shell prompt. The server
had been started with startx -- :3.

The trace is:
   xorg_backtrace + 0x44
   os_move_fd + 0x79
   __sigtramp_siginfo_2 + 0x0
   radeon_bo_is_referenced_by_cs + 0x2 (in libdrm_radeon.so.0)
   RADEONPrepareAccess_CS + 0x8a (in radeon_drv.so)
   ExaDoPrepareAccess + 0x200 (in libexa.so)
   exaPixmapSave + 0x3d3
   exaDoMigration_mixed + 0xf5
   exaOpReadsDestination + 0xaa3
   exaComposite + 0x348
   DamageRegionAppend + 0x582 (in X)
   exaTrapezoids + 0x289 (in libexa.so)
   XineramaGetImageData + 0x4815 (in X)
   Dispatch + 0x25d
   dix_main + 0x36f

This happened about 1h45 after I went to sleep and there was nothing
running on the server in question but the default X session (twm,
xclock, couple xterms). It was not in the foreground at the time it
died; from what I can deduce from logs, dying switched it into the
foreground, probably but not necessarily after the initial segfault.

It is not clear if the allocation failure print is connected or from
earlier; it doesn't appear in the X server log, only on the tty.

>How-To-Repeat:

No clue.

>Fix: